1 00:00:00,360 --> 00:00:02,190 In this lesson, we're going to be learning 2 00:00:02,190 --> 00:00:04,800 about special permissions and attributes. 3 00:00:04,800 --> 00:00:07,380 In most circumstances and most of the time, 4 00:00:07,380 --> 00:00:10,170 our standard read, write, and execute permissions 5 00:00:10,170 --> 00:00:12,600 are good enough for our account users. 6 00:00:12,600 --> 00:00:16,079 However, sometimes these normal permissions are inadequate, 7 00:00:16,079 --> 00:00:18,540 and we need special permissions to be utilized 8 00:00:18,540 --> 00:00:22,140 in order to maximize our less privileged user permissions. 9 00:00:22,140 --> 00:00:23,460 With special permissions, 10 00:00:23,460 --> 00:00:26,340 less privileged users are allowed to execute a file 11 00:00:26,340 --> 00:00:29,910 by assuming the privileges of the file's owner or group. 12 00:00:29,910 --> 00:00:32,640 There are two main special permissions that can be used. 13 00:00:32,640 --> 00:00:35,670 These are known as the set user ID or SUID 14 00:00:35,670 --> 00:00:38,430 and the set group ID or SGID. 15 00:00:38,430 --> 00:00:41,940 Now, a set user ID or SUID is when a user's allowed 16 00:00:41,940 --> 00:00:45,030 to have similar permissions as the owner of the file. 17 00:00:45,030 --> 00:00:47,130 Certain executable files and commands, 18 00:00:47,130 --> 00:00:48,510 like the password command, 19 00:00:48,510 --> 00:00:51,030 require access to additional resources. 20 00:00:51,030 --> 00:00:53,610 Instead of granting those permissions individually, 21 00:00:53,610 --> 00:00:55,110 the password command is configured 22 00:00:55,110 --> 00:00:58,260 so that any user can execute it as the root user, 23 00:00:58,260 --> 00:00:59,850 who's the owner of that command, 24 00:00:59,850 --> 00:01:01,110 and this gives them permission 25 00:01:01,110 --> 00:01:02,760 to have additional resources needed 26 00:01:02,760 --> 00:01:05,430 to change their own password on the system. 27 00:01:05,430 --> 00:01:07,950 In the set group ID or SGID, 28 00:01:07,950 --> 00:01:09,810 a user is allowed to have similar permissions 29 00:01:09,810 --> 00:01:12,360 as the group owner of the files and directories. 30 00:01:12,360 --> 00:01:14,730 Any subdirectories created in this directory 31 00:01:14,730 --> 00:01:15,810 will automatically inherit 32 00:01:15,810 --> 00:01:18,210 the set group ID permissions as well. 33 00:01:18,210 --> 00:01:20,100 This inheritance is really useful 34 00:01:20,100 --> 00:01:21,930 because users in a shared environment 35 00:01:21,930 --> 00:01:23,250 don't need to change their group 36 00:01:23,250 --> 00:01:25,560 when they create objects in that directory. 37 00:01:25,560 --> 00:01:27,900 But if you need additional permissions set, 38 00:01:27,900 --> 00:01:30,240 you can always do that using the chmod command 39 00:01:30,240 --> 00:01:32,220 to set those permissions. 40 00:01:32,220 --> 00:01:35,160 To give a file or directory the special set user ID 41 00:01:35,160 --> 00:01:36,990 and set group ID permissions, 42 00:01:36,990 --> 00:01:39,060 you can always use the chmod command 43 00:01:39,060 --> 00:01:41,790 in either symbolic mode or absolute mode. 44 00:01:41,790 --> 00:01:42,780 If you need to determine 45 00:01:42,780 --> 00:01:45,570 if a file or directory is using set user ID, 46 00:01:45,570 --> 00:01:48,810 you can enter the command ls -la. 47 00:01:48,810 --> 00:01:51,150 This is going to list out all the files or directories 48 00:01:51,150 --> 00:01:52,830 in the given directory. 49 00:01:52,830 --> 00:01:53,820 When you do this, 50 00:01:53,820 --> 00:01:57,120 the execute permission for the owner will appear as S 51 00:01:57,120 --> 00:01:59,190 if the set user ID is used, 52 00:01:59,190 --> 00:02:01,770 and the execute permission for the group will appear as S 53 00:02:01,770 --> 00:02:04,410 if the set group ID is being used. 54 00:02:04,410 --> 00:02:07,500 Now, you can also configure the set user ID on a file 55 00:02:07,500 --> 00:02:11,009 using either symbolic or absolute mode as I said earlier. 56 00:02:11,009 --> 00:02:12,660 When you're using the symbolic mode, 57 00:02:12,660 --> 00:02:16,680 you're going to type chmod u+s and the filename. 58 00:02:16,680 --> 00:02:17,910 Using absolute mode, 59 00:02:17,910 --> 00:02:22,890 You're going to type chmod 4# # # and then the filename. 60 00:02:22,890 --> 00:02:24,570 This is going to have the last three bits 61 00:02:24,570 --> 00:02:27,000 set to the standard permissions that you want to set 62 00:02:27,000 --> 00:02:31,410 like 777 or 742 or something like that. 63 00:02:31,410 --> 00:02:32,910 For the set group ID, 64 00:02:32,910 --> 00:02:35,700 you can do this symbolically or absolute as well. 65 00:02:35,700 --> 00:02:38,370 To set the group ID on a directory symbolically, 66 00:02:38,370 --> 00:02:42,510 you're going to enter chmod g+s and the directory name. 67 00:02:42,510 --> 00:02:43,920 Using the absolute mode, 68 00:02:43,920 --> 00:02:46,110 you're going to enter chmod 2 # # # 69 00:02:47,010 --> 00:02:48,150 and then the directory name, 70 00:02:48,150 --> 00:02:49,500 where the three numbers there 71 00:02:49,500 --> 00:02:51,780 are the permissions for that group. 72 00:02:51,780 --> 00:02:55,140 If you need to remove the set user ID or the set group ID, 73 00:02:55,140 --> 00:02:57,300 you can do this by using the minus operator 74 00:02:57,300 --> 00:02:58,590 in the symbolic mode, 75 00:02:58,590 --> 00:03:01,290 or setting the first permission bit to zero 76 00:03:01,290 --> 00:03:03,480 if you're using absolute mode. 77 00:03:03,480 --> 00:03:04,980 Another special permission we have 78 00:03:04,980 --> 00:03:06,780 is known as the sticky bit. 79 00:03:06,780 --> 00:03:09,180 Now, a sticky bit is a special permission bit 80 00:03:09,180 --> 00:03:11,910 that provides protection for files in a directory. 81 00:03:11,910 --> 00:03:14,490 It ensures that only the owner of a file or directory 82 00:03:14,490 --> 00:03:17,940 or the root user can actually delete that file or directory. 83 00:03:17,940 --> 00:03:20,400 Without the sticky bit, any user with write 84 00:03:20,400 --> 00:03:23,760 and execute permissions on an object can delete the object. 85 00:03:23,760 --> 00:03:25,800 But when you add that sticky bit, 86 00:03:25,800 --> 00:03:27,510 this is going to ensure that these users 87 00:03:27,510 --> 00:03:29,790 don't have the privilege to delete things, 88 00:03:29,790 --> 00:03:31,290 but they still have the rest of the privileges 89 00:03:31,290 --> 00:03:34,320 that come with writing and executing files or directories. 90 00:03:34,320 --> 00:03:36,480 To set this permission using symbolic mode, 91 00:03:36,480 --> 00:03:40,440 simply enter chmod +t and the directory name. 92 00:03:40,440 --> 00:03:42,750 To set the sticky bit using absolute mode, 93 00:03:42,750 --> 00:03:47,750 you can do this by using chmod 1 # # # directory name. 94 00:03:47,820 --> 00:03:51,150 Remember, files can have one or more attributes set on them 95 00:03:51,150 --> 00:03:54,090 that define how the system interacts with these files. 96 00:03:54,090 --> 00:03:56,400 These attributes go beyond the typical permissions 97 00:03:56,400 --> 00:03:58,230 and enable you to go more granular 98 00:03:58,230 --> 00:04:01,290 and customize what the system is and is not allowed to do 99 00:04:01,290 --> 00:04:02,850 with a given file. 100 00:04:02,850 --> 00:04:03,960 This includes allowing the file 101 00:04:03,960 --> 00:04:06,330 to be open for writing in an append mode, 102 00:04:06,330 --> 00:04:08,490 setting the file to be automatically compressed, 103 00:04:08,490 --> 00:04:11,280 saving the file if it's deleted so it can be recovered, 104 00:04:11,280 --> 00:04:15,210 and making the file immutable, which means unchangeable. 105 00:04:15,210 --> 00:04:17,820 Now, the immutable flag is an attribute for a file 106 00:04:17,820 --> 00:04:20,190 or directory that prevents it from being modified 107 00:04:20,190 --> 00:04:21,990 even by the root user. 108 00:04:21,990 --> 00:04:24,690 In other words, no one can delete, rename, 109 00:04:24,690 --> 00:04:26,880 or write to an immutable file. 110 00:04:26,880 --> 00:04:29,130 Setting the immutable flag is really useful 111 00:04:29,130 --> 00:04:31,980 for files that are highly sensitive and important. 112 00:04:31,980 --> 00:04:33,450 These files should be the ones 113 00:04:33,450 --> 00:04:35,790 that are not likely to change anytime soon. 114 00:04:35,790 --> 00:04:38,520 And therefore, they're going to be made immutable. 115 00:04:38,520 --> 00:04:41,580 When viewing file attributes, the lowercase i character 116 00:04:41,580 --> 00:04:45,390 indicates an immutable flag is set on a particular file. 117 00:04:45,390 --> 00:04:47,520 If you want to use the list attributes command, 118 00:04:47,520 --> 00:04:51,210 which is lsattr, you can then be able to list out 119 00:04:51,210 --> 00:04:53,640 the attributes for a file or directory. 120 00:04:53,640 --> 00:04:58,140 To use this command, simply enter lsattr the options 121 00:04:58,140 --> 00:05:00,060 and the file or directory name. 122 00:05:00,060 --> 00:05:01,770 There are several attributes that can be used 123 00:05:01,770 --> 00:05:03,780 with the list attributes command. 124 00:05:03,780 --> 00:05:06,840 The option -R is going to recursively list the attributes 125 00:05:06,840 --> 00:05:09,420 of all the directories and their contents. 126 00:05:09,420 --> 00:05:13,050 The option -a lists all the files in the directory. 127 00:05:13,050 --> 00:05:15,930 The option -d will list directories like files 128 00:05:15,930 --> 00:05:18,360 and so it'll list them showing their contents 129 00:05:18,360 --> 00:05:20,730 instead of actually showing the directories. 130 00:05:20,730 --> 00:05:24,930 The option -v is going to list the version number of the files. 131 00:05:24,930 --> 00:05:28,530 The change attributes command or chattr 132 00:05:28,530 --> 00:05:31,650 is used to change the attributes of a file or directory. 133 00:05:31,650 --> 00:05:33,510 To use the change attributes command, 134 00:05:33,510 --> 00:05:38,510 simply type chattr -R -v for the version 135 00:05:39,600 --> 00:05:41,400 plus or minus the attributes 136 00:05:41,400 --> 00:05:43,260 and the file or directory names. 137 00:05:43,260 --> 00:05:45,060 Now, you'll notice there's a few options here 138 00:05:45,060 --> 00:05:47,100 for the change attributes command. 139 00:05:47,100 --> 00:05:50,040 The option -R is going to recursively change the attributes 140 00:05:50,040 --> 00:05:52,350 of the directories and their contents. 141 00:05:52,350 --> 00:05:55,920 The option -v will set the version number of a file. 142 00:05:55,920 --> 00:06:00,270 The option +I will mark the file as read-only and immutable. 143 00:06:00,270 --> 00:06:02,250 The option -I will remove 144 00:06:02,250 --> 00:06:05,400 the read-only permission attribute of that file. 145 00:06:05,400 --> 00:06:06,840 For situations where the traditional 146 00:06:06,840 --> 00:06:09,240 file permission concepts are not sufficient, 147 00:06:09,240 --> 00:06:12,030 an access control list will enable you to assign permissions 148 00:06:12,030 --> 00:06:13,950 to individual users or groups, 149 00:06:13,950 --> 00:06:15,570 even if they do not correspond 150 00:06:15,570 --> 00:06:17,760 to the object's owner or group. 151 00:06:17,760 --> 00:06:20,160 For example, members of two department groups 152 00:06:20,160 --> 00:06:23,520 may need different levels of access to the same resource. 153 00:06:23,520 --> 00:06:25,590 Group one might need read, write, 154 00:06:25,590 --> 00:06:27,120 and execute to a directory, 155 00:06:27,120 --> 00:06:30,900 but group two only needs read and execute access. 156 00:06:30,900 --> 00:06:33,540 By using ACLs or access control lists, 157 00:06:33,540 --> 00:06:36,450 you can grant different levels of access to different users, 158 00:06:36,450 --> 00:06:38,520 groups, or even processes. 159 00:06:38,520 --> 00:06:41,040 ACLs enable a more granular level of control 160 00:06:41,040 --> 00:06:43,350 than to simply using file permissions. 161 00:06:43,350 --> 00:06:48,090 The get file ACL command or getfacl is very useful 162 00:06:48,090 --> 00:06:50,250 in instances where you need to retrieve the ACLs 163 00:06:50,250 --> 00:06:51,930 of files and directories. 164 00:06:51,930 --> 00:06:54,270 It's going to show you the metadata about the objects 165 00:06:54,270 --> 00:06:56,340 including its owner, its groups, 166 00:06:56,340 --> 00:06:59,700 any SUID or SGID or sticky bit flags that are set, 167 00:06:59,700 --> 00:07:01,920 the standard permissions associated with the object, 168 00:07:01,920 --> 00:07:05,160 and the individual permission entries for users and groups. 169 00:07:05,160 --> 00:07:08,370 The set file ACL command or setfacl 170 00:07:08,370 --> 00:07:09,570 is used to change your permissions 171 00:07:09,570 --> 00:07:12,570 associated with the ACL of a file or directory. 172 00:07:12,570 --> 00:07:15,240 The proper way to enter the setfacl command 173 00:07:15,240 --> 00:07:20,240 is by typing setfacl -bR -mx the ACL specifications 174 00:07:21,390 --> 00:07:23,250 and the file or directory name. 175 00:07:23,250 --> 00:07:24,510 It has several options, 176 00:07:24,510 --> 00:07:27,000 but we're just going to cover the most common ones here. 177 00:07:27,000 --> 00:07:30,450 The option -R is going to recursively set the ACL options 178 00:07:30,450 --> 00:07:32,580 for directories and their contents. 179 00:07:32,580 --> 00:07:36,540 The -s option is going to be able to set the ACL for an object 180 00:07:36,540 --> 00:07:38,910 and replace the existing ACL. 181 00:07:38,910 --> 00:07:43,050 The option -m is going to modify the existing ACL of an object. 182 00:07:43,050 --> 00:07:46,950 The option -x is going to remove entries from the ACL 183 00:07:46,950 --> 00:07:49,410 and the option -b is going to remove all entries 184 00:07:49,410 --> 00:07:51,540 except for the standard permissions. 185 00:07:51,540 --> 00:07:53,790 The ACL specification can be formatted 186 00:07:53,790 --> 00:07:54,960 when working with users 187 00:07:54,960 --> 00:07:59,190 by entering u colon and the username, colon permissions, 188 00:07:59,190 --> 00:08:00,690 or if you're working with groups, 189 00:08:00,690 --> 00:08:01,800 you can do this by entering 190 00:08:01,800 --> 00:08:05,010 g colon the group name colon permissions. 191 00:08:05,010 --> 00:08:05,970 As you can see, 192 00:08:05,970 --> 00:08:08,580 using ACLs is a way to get much more granular 193 00:08:08,580 --> 00:08:09,930 and give you a lot more control 194 00:08:09,930 --> 00:08:11,763 of a particular file or directory.