In this lesson, we're going to be learning
about special permissions and attributes.
In most circumstances and most of the time,
our standard read, write, and execute permissions
are good enough for our account users.
However, sometimes these normal permissions are inadequate,
and we need special permissions to be utilized
in order to maximize our less privileged user permissions.
With special permissions,
less privileged users are allowed to execute a file
by assuming the privileges of the file's owner or group.
There are two main special permissions that can be used.
These are known as the set user ID or SUID
and the set group ID or SGID.
Now, a set user ID or SUID is when a user's allowed
to have similar permissions as the owner of the file.
Certain executable files and commands,
like the password command,
require access to additional resources.
Instead of granting those permissions individually,
the password command is configured
so that any user can execute it as the root user,
who's the owner of that command,
and this gives them permission
to have additional resources needed
to change their own password on the system.
In the set group ID or SGID,
a user is allowed to have similar permissions
as the group owner of the files and directories.
Any subdirectories created in this directory
will automatically inherit
the set group ID permissions as well.
This inheritance is really useful
because users in a shared environment
don't need to change their group
when they create objects in that directory.
But if you need additional permissions set,
you can always do that using the chmod command
to set those permissions.
To give a file or directory the special set user ID
and set group ID permissions,
you can always use the chmod command
in either symbolic mode or absolute mode.
If you need to determine
if a file or directory is using set user ID,
you can enter the command ls -la.
This is going to list out all the files or directories
in the given directory.
When you do this,
the execute permission for the owner will appear as S
if the set user ID is used,
and the execute permission for the group will appear as S
if the set group ID is being used.
Now, you can also configure the set user ID on a file
using either symbolic or absolute mode as I said earlier.
When you're using the symbolic mode,
you're going to type chmod u+s and the filename.
Using absolute mode,
You're going to type chmod 4# # # and then the filename.
This is going to have the last three bits
set to the standard permissions that you want to set
like 777 or 742 or something like that.
For the set group ID,
you can do this symbolically or absolute as well.
To set the group ID on a directory symbolically,
you're going to enter chmod g+s and the directory name.
Using the absolute mode,
you're going to enter chmod 2 # # #
and then the directory name,
where the three numbers there
are the permissions for that group.
If you need to remove the set user ID or the set group ID,
you can do this by using the minus operator
in the symbolic mode,
or setting the first permission bit to zero
if you're using absolute mode.
Another special permission we have
is known as the sticky bit.
Now, a sticky bit is a special permission bit
that provides protection for files in a directory.
It ensures that only the owner of a file or directory
or the root user can actually delete that file or directory.
Without the sticky bit, any user with write
and execute permissions on an object can delete the object.
But when you add that sticky bit,
this is going to ensure that these users
don't have the privilege to delete things,
but they still have the rest of the privileges
that come with writing and executing files or directories.
To set this permission using symbolic mode,
simply enter chmod +t and the directory name.
To set the sticky bit using absolute mode,
you can do this by using chmod 1 # # # directory name.
Remember, files can have one or more attributes set on them
that define how the system interacts with these files.
These attributes go beyond the typical permissions
and enable you to go more granular
and customize what the system is and is not allowed to do
with a given file.
This includes allowing the file
to be open for writing in an append mode,
setting the file to be automatically compressed,
saving the file if it's deleted so it can be recovered,
and making the file immutable, which means unchangeable.
Now, the immutable flag is an attribute for a file
or directory that prevents it from being modified
even by the root user.
In other words, no one can delete, rename,
or write to an immutable file.
Setting the immutable flag is really useful
for files that are highly sensitive and important.
These files should be the ones
that are not likely to change anytime soon.
And therefore, they're going to be made immutable.
When viewing file attributes, the lowercase i character
indicates an immutable flag is set on a particular file.
If you want to use the list attributes command,
which is lsattr, you can then be able to list out
the attributes for a file or directory.
To use this command, simply enter lsattr the options
and the file or directory name.
There are several attributes that can be used
with the list attributes command.
The option -R is going to recursively list the attributes
of all the directories and their contents.
The option -a lists all the files in the directory.
The option -d will list directories like files
and so it'll list them showing their contents
instead of actually showing the directories.
The option -v is going to list the version number of the files.
The change attributes command or chattr
is used to change the attributes of a file or directory.
To use the change attributes command,
simply type chattr -R -v for the version
plus or minus the attributes
and the file or directory names.
Now, you'll notice there's a few options here
for the change attributes command.
The option -R is going to recursively change the attributes
of the directories and their contents.
The option -v will set the version number of a file.
The option +I will mark the file as read-only and immutable.
The option -I will remove
the read-only permission attribute of that file.
For situations where the traditional
file permission concepts are not sufficient,
an access control list will enable you to assign permissions
to individual users or groups,
even if they do not correspond
to the object's owner or group.
For example, members of two department groups
may need different levels of access to the same resource.
Group one might need read, write,
and execute to a directory,
but group two only needs read and execute access.
By using ACLs or access control lists,
you can grant different levels of access to different users,
groups, or even processes.
ACLs enable a more granular level of control
than to simply using file permissions.
The get file ACL command or getfacl is very useful
in instances where you need to retrieve the ACLs
of files and directories.
It's going to show you the metadata about the objects
including its owner, its groups,
any SUID or SGID or sticky bit flags that are set,
the standard permissions associated with the object,
and the individual permission entries for users and groups.
The set file ACL command or setfacl
is used to change your permissions
associated with the ACL of a file or directory.
The proper way to enter the setfacl command
is by typing setfacl -bR -mx the ACL specifications
and the file or directory name.
It has several options,
but we're just going to cover the most common ones here.
The option -R is going to recursively set the ACL options
for directories and their contents.
The -s option is going to be able to set the ACL for an object
and replace the existing ACL.
The option -m is going to modify the existing ACL of an object.
The option -x is going to remove entries from the ACL
and the option -b is going to remove all entries
except for the standard permissions.
The ACL specification can be formatted
when working with users
by entering u colon and the username, colon permissions,
or if you're working with groups,
you can do this by entering
g colon the group name colon permissions.
As you can see,
using ACLs is a way to get much more granular
and give you a lot more control
of a particular file or directory.