In this demonstration,
we're going to go over configuring
SGID permissions and sticky bits.
In Linux, there are two main special permissions.
They are set user ID and set group ID.
Any subdirectories created in this directory
will automatically inherit the SGID permission.
Likewise, all new files and subdirectories
created in this directory will also inherit
the directory's group ID,
rather than the group ID of the user
who created the object.
This inherit is useful because it allows users
in a shared environment
to not have to change the group ID
every time they create a new object.
Also note, when you set the group ID permission,
it is not applied to
the existing objects in the directory,
nor is it applied to objects
that are moved from other locations
into that directory.
I will walk you through how to set
special permissions on files and directories,
as well as how to implement sticky bits,
which protects files from deletion
by anyone that's not the owner.
So let's get started.
The first thing we're going to do is set the GID
to automatically set group associations
for newly created files in the Crypto folder.
Now, let's check out the Crypto folder first
just to look at the information about the directory.
All right, we see the owner's root
and the group is root.
I'm currently logged in as the root user,
just so I'm able to execute commands more efficiently.
So, first thing I'm going to do is change the group
to the Crypto department.
So I can use the change group command
to the Crypto department
on the Crypto folder.
All right, we're going to list this out.
See that execute it?
So, next thing we need do is to change the GUID.
We're going to use the change mode command on that.
Change mode to group.
In the Crypto folder.
We're going to list this out again.
Now, if you look at the permission strings.
In the group field,
where the execution bit will usually be,
you'll see a S there.
That's the indication that the group UID is set
and now we're good to go.
So next, we're going to switch users
to make sure that when a new user
creates a folder or a file,
that it inherits the group ID
that's associated with the root folder,
which in this example will be the Crypto folder.
So we'll switch to a user that's currently
in the Crypto department.
Emusk.
We have them.
CD to the...
Crypto folder.
Next, we'll have them create a file.
Let's list an emusk file.
All right, now let's list out this directory.
Get more information.
Now we'll see when we create the new file,
that the group is associated
with the crypto department.
Now, for sake of argument, we can check.
Just make sure that this actually is something that works.
So we'll switch back to root really quick
and we'll remove the special permissions
just to see what happens when we don't do that.
Switch user back to...
Directory of the Crypto app.
Now we see once we switch back
and remove that special bit,
that now when we create a file,
it's no longer associated
with the group Crypto department.
It's associated with emusk.
So again now,
anyone that's not emusk,
cannot manipulate that file.
So we see what happens when we implement
the special privilege and when we take it away.
Next, what we want to do is implement the sticky bit.
This will protect files from deletion
by anyone other than the owner.
We'll switch back to root really quick.
We're going to use the change mode command,
but this time we're going to use the T.
That's going to be the modifier for this Crypto folder.
Now, one thing to note is
in most versions of Linux,
when you implement this sticky bit,
you can't do it on a file.
It will ignore it because previously,
it was used to let the system know
that we're going to use this file a lot,
so keep it stored memory.
With the new implementations of Linux,
they ignore that sticky bit.
So you have to apply to the directory.
We're going to switch users to it.
And now, we're going to attempt to remove
the file created by emusk.
Going to go to the crypto directory...
This thing is out there.
See the file created by emusk.
Try to remove it.
My file...
You'll see the operations are not permitted.
Try to remove the emusk file as well.
Plus...
File 1.
I see the same thing there.
Now, in order to see that the bid is set,
we use the list directory.
Crypto here.
And now you see the T in the others file.
That column represents the fact that,
that folder now has the sticky bit permission set
and that the only people that can delete
the file is the owners that created it.
So again, if we look at the permission strings
and look in the others field,
we'll see the T set.
Next, we're going to go over how to configure
the immutable flag on the read me file
that we're going to add to our Crypto folder.
Lets add this really quick.
Now remember, the immutable flag
makes sure that no one,
even the root,
can remove the file or directory
with that flag being set.
Now, let's list this out,
make sure it's here.
And so you can see that,
with the right flag set
and the owner field of the permission string,
that we should be able to delete this.
Now, we're going to change the attribute
and that's how you configure the immutable flag,
by changing attribute command.
Plus I.
We're going to use it on the read me file.
Okay, now in order to view the attributes,
we're going to do list attributes.
Going to pick the read me file.
Now you see the I is set.
That means that this file cannot be deleted
until we change the attribute
to remove the I from this.
So I'm the root user
and I'm going to try to remove the file.
And we see the operation is not permitted.
Even as a root, I cannot delete this.
Now we're going to remove the attribute,
to make sure we're able to delete it.
So again, we're going to do change attribute.
The I from the read me file.
Going to list the attribute, just to make sure
it has that part.
And we can see it's removed.
And now, we should be able to delete
the read me file.
And we can see now that the file is removed.
The last thing we're going to do is
set file access controllers.
What we want to do in this example,
is to allow people in the Intel department
to access the Crypto folder.
By default, only one group can be associated
with a directory.
So the set access control list allows us
to add multiple groups,
so they can have access
to certain files or directories.
So now, let's pull up the information
that's under the access control list.
It's simply sudo,
get file access controllers
for the Crypto folder.
And we see here's the information
for the access control list.
Generic information, such as the file name,
the owner, et cetera, et cetera.
Next, what we're going to do is,
we're going to set the access control list
with the set file access control list.
I'm going to use the R modifier,
which means recursive for one set on directory.
So that means it's going to apply to all
set directories and files.
I'm going to use the M option.
It means that we're modifying
the current existing access control list.
The group we're going to use is the Intel group
and we're going to give it read permissions as only.
That's what the R stands for
on the Crypto folder.
Okay, so now let's check out
these permissions now.
Now we see anyone in the Intel group
can now read any of the contents
of the Crypto folder.
All right, and that sums this demonstration up
and I'll see you in the next lesson.