1
00:00:00,080 --> 00:00:01,170
In this demonstration,

2
00:00:01,170 --> 00:00:02,580
we're going to go over configuring

3
00:00:02,580 --> 00:00:05,013
SGID permissions and sticky bits.

4
00:00:05,910 --> 00:00:09,060
In Linux, there are two main special permissions.

5
00:00:09,060 --> 00:00:12,243
They are set user ID and set group ID.

6
00:00:13,200 --> 00:00:15,330
Any subdirectories created in this directory

7
00:00:15,330 --> 00:00:18,363
will automatically inherit the SGID permission.

8
00:00:20,160 --> 00:00:22,620
Likewise, all new files and subdirectories

9
00:00:22,620 --> 00:00:24,690
created in this directory will also inherit

10
00:00:24,690 --> 00:00:27,180
the directory's group ID,

11
00:00:27,180 --> 00:00:29,010
rather than the group ID of the user

12
00:00:29,010 --> 00:00:30,960
who created the object.

13
00:00:30,960 --> 00:00:33,960
This inherit is useful because it allows users

14
00:00:33,960 --> 00:00:35,100
in a shared environment

15
00:00:35,100 --> 00:00:37,170
to not have to change the group ID

16
00:00:37,170 --> 00:00:38,970
every time they create a new object.

17
00:00:39,960 --> 00:00:42,600
Also note, when you set the group ID permission,

18
00:00:42,600 --> 00:00:43,470
it is not applied to

19
00:00:43,470 --> 00:00:45,360
the existing objects in the directory,

20
00:00:45,360 --> 00:00:46,800
nor is it applied to objects

21
00:00:46,800 --> 00:00:48,480
that are moved from other locations

22
00:00:48,480 --> 00:00:49,740
into that directory.

23
00:00:49,740 --> 00:00:51,090
I will walk you through how to set

24
00:00:51,090 --> 00:00:53,370
special permissions on files and directories,

25
00:00:53,370 --> 00:00:55,560
as well as how to implement sticky bits,

26
00:00:55,560 --> 00:00:57,030
which protects files from deletion

27
00:00:57,030 --> 00:00:59,280
by anyone that's not the owner.

28
00:00:59,280 --> 00:01:00,240
So let's get started.

29
00:01:00,240 --> 00:01:01,710
The first thing we're going to do is set the GID

30
00:01:01,710 --> 00:01:03,810
to automatically set group associations

31
00:01:03,810 --> 00:01:06,060
for newly created files in the Crypto folder.

32
00:01:06,930 --> 00:01:08,520
Now, let's check out the Crypto folder first

33
00:01:08,520 --> 00:01:11,063
just to look at the information about the directory.

34
00:01:16,290 --> 00:01:17,490
All right, we see the owner's root

35
00:01:17,490 --> 00:01:19,110
and the group is root.

36
00:01:19,110 --> 00:01:21,180
I'm currently logged in as the root user,

37
00:01:21,180 --> 00:01:25,140
just so I'm able to execute commands more efficiently.

38
00:01:25,140 --> 00:01:27,120
So, first thing I'm going to do is change the group

39
00:01:27,120 --> 00:01:29,340
to the Crypto department.

40
00:01:29,340 --> 00:01:31,190
So I can use the change group command

41
00:01:32,760 --> 00:01:35,770
to the Crypto department

42
00:01:37,080 --> 00:01:40,410
on the Crypto folder.

43
00:01:40,410 --> 00:01:42,753
All right, we're going to list this out.

44
00:01:43,770 --> 00:01:44,853
See that execute it?

45
00:01:45,690 --> 00:01:48,090
So, next thing we need do is to change the GUID.

46
00:01:50,640 --> 00:01:52,823
We're going to use the change mode command on that.

47
00:01:55,470 --> 00:01:57,833
Change mode to group.

48
00:02:00,215 --> 00:02:01,965
In the Crypto folder.

49
00:02:04,090 --> 00:02:05,853
We're going to list this out again.

50
00:02:07,560 --> 00:02:10,289
Now, if you look at the permission strings.

51
00:02:10,289 --> 00:02:11,280
In the group field,

52
00:02:11,280 --> 00:02:13,620
where the execution bit will usually be,

53
00:02:13,620 --> 00:02:15,240
you'll see a S there.

54
00:02:15,240 --> 00:02:18,330
That's the indication that the group UID is set

55
00:02:18,330 --> 00:02:20,250
and now we're good to go.

56
00:02:20,250 --> 00:02:21,930
So next, we're going to switch users

57
00:02:21,930 --> 00:02:24,180
to make sure that when a new user

58
00:02:24,180 --> 00:02:26,310
creates a folder or a file,

59
00:02:26,310 --> 00:02:28,440
that it inherits the group ID

60
00:02:28,440 --> 00:02:30,180
that's associated with the root folder,

61
00:02:30,180 --> 00:02:32,520
which in this example will be the Crypto folder.

62
00:02:32,520 --> 00:02:34,170
So we'll switch to a user that's currently

63
00:02:34,170 --> 00:02:35,420
in the Crypto department.

64
00:02:36,960 --> 00:02:37,833
Emusk.

65
00:02:41,754 --> 00:02:43,470
We have them.

66
00:02:43,470 --> 00:02:44,690
CD to the...

67
00:02:46,140 --> 00:02:48,063
Crypto folder.

68
00:02:49,200 --> 00:02:51,000
Next, we'll have them create a file.

69
00:02:54,600 --> 00:02:56,430
Let's list an emusk file.

70
00:02:59,940 --> 00:03:02,003
All right, now let's list out this directory.

71
00:03:03,090 --> 00:03:04,140
Get more information.

72
00:03:08,580 --> 00:03:11,610
Now we'll see when we create the new file,

73
00:03:11,610 --> 00:03:12,900
that the group is associated

74
00:03:12,900 --> 00:03:14,610
with the crypto department.

75
00:03:14,610 --> 00:03:16,350
Now, for sake of argument, we can check.

76
00:03:16,350 --> 00:03:19,710
Just make sure that this actually is something that works.

77
00:03:19,710 --> 00:03:21,960
So we'll switch back to root really quick

78
00:03:21,960 --> 00:03:26,640
and we'll remove the special permissions

79
00:03:26,640 --> 00:03:29,703
just to see what happens when we don't do that.

80
00:03:33,090 --> 00:03:34,460
Switch user back to...

81
00:03:38,790 --> 00:03:40,190
Directory of the Crypto app.

82
00:03:46,500 --> 00:03:48,420
Now we see once we switch back

83
00:03:48,420 --> 00:03:50,400
and remove that special bit,

84
00:03:50,400 --> 00:03:52,230
that now when we create a file,

85
00:03:52,230 --> 00:03:53,280
it's no longer associated

86
00:03:53,280 --> 00:03:55,380
with the group Crypto department.

87
00:03:55,380 --> 00:03:57,420
It's associated with emusk.

88
00:03:57,420 --> 00:03:58,650
So again now,

89
00:03:58,650 --> 00:03:59,670
anyone that's not emusk,

90
00:03:59,670 --> 00:04:02,280
cannot manipulate that file.

91
00:04:02,280 --> 00:04:04,470
So we see what happens when we implement

92
00:04:04,470 --> 00:04:06,903
the special privilege and when we take it away.

93
00:04:07,800 --> 00:04:10,380
Next, what we want to do is implement the sticky bit.

94
00:04:10,380 --> 00:04:11,850
This will protect files from deletion

95
00:04:11,850 --> 00:04:14,160
by anyone other than the owner.

96
00:04:14,160 --> 00:04:16,110
We'll switch back to root really quick.

97
00:04:18,450 --> 00:04:20,550
We're going to use the change mode command,

98
00:04:20,550 --> 00:04:24,390
but this time we're going to use the T.

99
00:04:24,390 --> 00:04:29,133
That's going to be the modifier for this Crypto folder.

100
00:04:30,180 --> 00:04:32,550
Now, one thing to note is

101
00:04:32,550 --> 00:04:34,410
in most versions of Linux,

102
00:04:34,410 --> 00:04:36,480
when you implement this sticky bit,

103
00:04:36,480 --> 00:04:38,160
you can't do it on a file.

104
00:04:38,160 --> 00:04:39,960
It will ignore it because previously,

105
00:04:39,960 --> 00:04:42,690
it was used to let the system know

106
00:04:42,690 --> 00:04:44,850
that we're going to use this file a lot,

107
00:04:44,850 --> 00:04:46,680
so keep it stored memory.

108
00:04:46,680 --> 00:04:48,810
With the new implementations of Linux,

109
00:04:48,810 --> 00:04:50,130
they ignore that sticky bit.

110
00:04:50,130 --> 00:04:52,540
So you have to apply to the directory.

111
00:04:52,540 --> 00:04:54,083
We're going to switch users to it.

112
00:04:57,630 --> 00:04:59,730
And now, we're going to attempt to remove

113
00:04:59,730 --> 00:05:01,143
the file created by emusk.

114
00:05:02,280 --> 00:05:04,000
Going to go to the crypto directory...

115
00:05:05,220 --> 00:05:06,787
This thing is out there.

116
00:05:08,024 --> 00:05:09,720
See the file created by emusk.

117
00:05:09,720 --> 00:05:10,593
Try to remove it.

118
00:05:12,493 --> 00:05:13,326
My file...

119
00:05:18,570 --> 00:05:20,513
You'll see the operations are not permitted.

120
00:05:24,720 --> 00:05:26,583
Try to remove the emusk file as well.

121
00:05:28,500 --> 00:05:29,333
Plus...

122
00:05:31,082 --> 00:05:31,915
File 1.

123
00:05:33,030 --> 00:05:34,500
I see the same thing there.

124
00:05:34,500 --> 00:05:38,850
Now, in order to see that the bid is set,

125
00:05:38,850 --> 00:05:40,150
we use the list directory.

126
00:05:41,940 --> 00:05:43,230
Crypto here.

127
00:05:43,230 --> 00:05:46,320
And now you see the T in the others file.

128
00:05:46,320 --> 00:05:47,970
That column represents the fact that,

129
00:05:47,970 --> 00:05:51,120
that folder now has the sticky bit permission set

130
00:05:51,120 --> 00:05:52,950
and that the only people that can delete

131
00:05:52,950 --> 00:05:54,933
the file is the owners that created it.

132
00:05:55,830 --> 00:05:57,510
So again, if we look at the permission strings

133
00:05:57,510 --> 00:05:59,010
and look in the others field,

134
00:05:59,010 --> 00:06:00,393
we'll see the T set.

135
00:06:01,230 --> 00:06:02,850
Next, we're going to go over how to configure

136
00:06:02,850 --> 00:06:05,610
the immutable flag on the read me file

137
00:06:05,610 --> 00:06:07,710
that we're going to add to our Crypto folder.

138
00:06:07,710 --> 00:06:09,060
Lets add this really quick.

139
00:06:12,270 --> 00:06:14,220
Now remember, the immutable flag

140
00:06:14,220 --> 00:06:15,540
makes sure that no one,

141
00:06:15,540 --> 00:06:16,620
even the root,

142
00:06:16,620 --> 00:06:19,620
can remove the file or directory

143
00:06:19,620 --> 00:06:21,003
with that flag being set.

144
00:06:22,020 --> 00:06:22,853
Now, let's list this out,

145
00:06:22,853 --> 00:06:24,150
make sure it's here.

146
00:06:24,150 --> 00:06:25,620
And so you can see that,

147
00:06:25,620 --> 00:06:27,090
with the right flag set

148
00:06:27,090 --> 00:06:29,490
and the owner field of the permission string,

149
00:06:29,490 --> 00:06:31,830
that we should be able to delete this.

150
00:06:31,830 --> 00:06:33,680
Now, we're going to change the attribute

151
00:06:35,400 --> 00:06:38,820
and that's how you configure the immutable flag,

152
00:06:38,820 --> 00:06:40,440
by changing attribute command.

153
00:06:40,440 --> 00:06:41,850
Plus I.

154
00:06:41,850 --> 00:06:45,030
We're going to use it on the read me file.

155
00:06:48,300 --> 00:06:51,280
Okay, now in order to view the attributes,

156
00:06:51,280 --> 00:06:54,243
we're going to do list attributes.

157
00:06:55,110 --> 00:06:56,973
Going to pick the read me file.

158
00:06:58,500 --> 00:07:00,900
Now you see the I is set.

159
00:07:00,900 --> 00:07:03,450
That means that this file cannot be deleted

160
00:07:03,450 --> 00:07:05,070
until we change the attribute

161
00:07:05,070 --> 00:07:08,310
to remove the I from this.

162
00:07:08,310 --> 00:07:09,600
So I'm the root user

163
00:07:09,600 --> 00:07:11,493
and I'm going to try to remove the file.

164
00:07:17,877 --> 00:07:20,550
And we see the operation is not permitted.

165
00:07:20,550 --> 00:07:23,220
Even as a root, I cannot delete this.

166
00:07:23,220 --> 00:07:25,260
Now we're going to remove the attribute,

167
00:07:25,260 --> 00:07:27,090
to make sure we're able to delete it.

168
00:07:27,090 --> 00:07:30,123
So again, we're going to do change attribute.

169
00:07:34,140 --> 00:07:37,653
The I from the read me file.

170
00:07:40,560 --> 00:07:43,671
Going to list the attribute, just to make sure

171
00:07:43,671 --> 00:07:45,088
it has that part.

172
00:07:45,972 --> 00:07:47,700
And we can see it's removed.

173
00:07:47,700 --> 00:07:50,320
And now, we should be able to delete

174
00:07:51,210 --> 00:07:52,443
the read me file.

175
00:07:54,300 --> 00:07:57,873
And we can see now that the file is removed.

176
00:08:00,060 --> 00:08:01,020
The last thing we're going to do is

177
00:08:01,020 --> 00:08:03,300
set file access controllers.

178
00:08:03,300 --> 00:08:05,370
What we want to do in this example,

179
00:08:05,370 --> 00:08:07,440
is to allow people in the Intel department

180
00:08:07,440 --> 00:08:09,870
to access the Crypto folder.

181
00:08:09,870 --> 00:08:12,180
By default, only one group can be associated

182
00:08:12,180 --> 00:08:13,560
with a directory.

183
00:08:13,560 --> 00:08:15,900
So the set access control list allows us

184
00:08:15,900 --> 00:08:17,070
to add multiple groups,

185
00:08:17,070 --> 00:08:18,240
so they can have access

186
00:08:18,240 --> 00:08:20,460
to certain files or directories.

187
00:08:20,460 --> 00:08:21,870
So now, let's pull up the information

188
00:08:21,870 --> 00:08:23,550
that's under the access control list.

189
00:08:23,550 --> 00:08:25,440
It's simply sudo,

190
00:08:25,440 --> 00:08:27,120
get file access controllers

191
00:08:27,120 --> 00:08:28,503
for the Crypto folder.

192
00:08:30,870 --> 00:08:32,010
And we see here's the information

193
00:08:32,010 --> 00:08:33,570
for the access control list.

194
00:08:33,570 --> 00:08:35,580
Generic information, such as the file name,

195
00:08:35,580 --> 00:08:37,860
the owner, et cetera, et cetera.

196
00:08:37,860 --> 00:08:39,660
Next, what we're going to do is,

197
00:08:39,660 --> 00:08:43,650
we're going to set the access control list

198
00:08:43,650 --> 00:08:45,550
with the set file access control list.

199
00:08:46,470 --> 00:08:49,200
I'm going to use the R modifier,

200
00:08:49,200 --> 00:08:51,423
which means recursive for one set on directory.

201
00:08:51,423 --> 00:08:52,890
So that means it's going to apply to all

202
00:08:52,890 --> 00:08:54,930
set directories and files.

203
00:08:54,930 --> 00:08:56,640
I'm going to use the M option.

204
00:08:56,640 --> 00:08:57,630
It means that we're modifying

205
00:08:57,630 --> 00:09:00,300
the current existing access control list.

206
00:09:00,300 --> 00:09:02,430
The group we're going to use is the Intel group

207
00:09:03,330 --> 00:09:06,750
and we're going to give it read permissions as only.

208
00:09:06,750 --> 00:09:08,250
That's what the R stands for

209
00:09:08,250 --> 00:09:09,573
on the Crypto folder.

210
00:09:11,670 --> 00:09:13,350
Okay, so now let's check out

211
00:09:13,350 --> 00:09:14,913
these permissions now.

212
00:09:17,670 --> 00:09:19,980
Now we see anyone in the Intel group

213
00:09:19,980 --> 00:09:22,170
can now read any of the contents

214
00:09:22,170 --> 00:09:23,253
of the Crypto folder.

215
00:09:24,480 --> 00:09:27,150
All right, and that sums this demonstration up

216
00:09:27,150 --> 00:09:29,103
and I'll see you in the next lesson.