1 Unix/Linux is a Multi-user systemIndex

Unix/Linux has always been a multi-user operating system. (Microsoft Windows didn’t become a multi-user operating system until the merge with Windows NT, somewhere around Windows XP?)

Processes belonging to different users have restrictions on how they can interact with each other and with the file system. Files belong to different users, and users can control how processes run by themselves and other users access their files.

The Unix multi-user system provides security among users and between the system and users. The Unix operating system can protect itself against programs run by ordinary users, so the rare Unix viruses and trojans only affect a single user on a system, not the whole system.

The super-user account root on a Unix system can bypass and over-ride all read/write and access permissions. The super-user can access and do anything to any inode. In this document, we discuss permissions as they apply to ordinary, non-root users.

2 Users: one user ID and multiple group IDsIndex

Each logged-in Unix user is assigned one unique numeric user ID and one or more numeric group IDs. (Group IDs may be shared with other users.) The unique user ID and each group ID are internally stored as numbers.

$ whoami
idallen

$ groups
idallen admin

$ groups root
root bin daemon sys adm disk wheel

$ id
uid=777(idallen) gid=777(idallen) groups=777(idallen),120(admin)

$ id root
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

3 File system inodes have one owner (user ID), only one groupIndex

File system inodes (e.g. files and directories) are owned by one user ID (the “owner”) and belong to only one group (the “group”). (Kernel extensions can expand this restriction.) The owner and group are stored in the inode as internal numbers; the password and group files are used to map the numbers to human-friendly names.

The ls command uses the password and group files to show you the name of the owner and name of the group for each file system inode (the third and fourth fields in the output below):

$ ls -ld / /dev/mem /etc/shadow /home/idallen /var/log/auth.log
drwxr-xr-x 26 root    root        4096 Oct 26 02:16 /
crw-r-----  1 root    kmem        1, 1 Oct 26 04:45 /dev/mem
-rw-r-----  1 root    shadow     46616 Oct 25 21:32 /etc/shadow
drwxr-x--x 44 idallen idallen     4096 Oct 27 19:59 /home/idallen
-rw-r-----  1 syslog  root    52902850 Oct 28 00:41 /var/log/auth.log

It is important to know that the owner and group are stored in each inode as numbers, not names. The password and group files are necessary to turn the stored numbers into human-friendly names.

$ tail -n 1 /etc/group
test:x:3234:

$ ls -l foo
-rw-r--r-- 1 root test 29 Oct 25 07:05 foo

$ sudo groupmod -n newtest test          # rename group "test" to "newtest"
$ tail -n 1 /etc/group
newtest:x:3234:

$ ls -l foo
-rw-r--r-- 1 root newtest 29 Oct 25 07:05 foo

$ sudo groupdel newtest                   # delete group "newtest"
$ ls -l foo
-rw-r--r-- 1 root 3234 29 Oct 25 07:05 foo

4 Summary: users and processes vs. file system inodesIndex

You, when you log in, and any process you run, have the permissions of one user ID and one or more groups simultaneously (many groups):

$ id
uid=777(idallen) gid=777(idallen) groups=777(idallen),4(admin)

In the Unix file system, each inode, whether it is a file inode, a directory inode, or some other kind of inode, can be “owned” by exactly one Unix user ID and be in exactly one Unix group (single group):

$ ls -l /etc/passwd
-rw-r--r-- 1 root root 2458 Nov 18 01:17 /etc/passwd

Processes (run by users) can have many groups; file system inodes can have only one group.

5 Permissions: Match login userid/groups to inode owner/groupIndex

When a process tries to read or write any kind of file system inode (a file, a directory, or some other file system object), the meshing of the user and group IDs of the process and the owner and group IDs set in the inode determine if the access succeeds.

What a process can do to a file system inode – what permissions it has on the inode – is determined by how the process user ID and any of its many groups mesh with the single owner/userid and single group ID of the inode in the file system.

$ ls -ld filename dirname symlink
-rw-r----- 1 user1 group1  123 Nov 12 14:14 filename
drwxr-x--x 1 user2 group2  123 Nov 12 14:14 dirname
lrwxrwxrwx 1 root  root    123 Nov 12 14:14 symlink -> target

$ ls -ld filename
-rw-r----x 1 user1 group1  123 Nov 12 14:14 filename

6 The three permissions: rwxIndex

In each of the above three sets of permissions – user, group, and other – three permissions can be controlled: Read permission, Write permission, and eXecute/search permission. Recall that these three sets of three permissions appear as the letters rwx in the output from ls -l:

$ ls -l /bin/ls
-rwxr-xr-x 1 root root 105840 Nov 19  2016 /bin/ls

The user ID and group ID(s) of the process are matched against the user ID and group ID of the inode to determine which of the three sets of permissions apply: user, group, or other. Once a set is chosen, the rwx permissions are used to limit what the process can do to that inode:

7 Execute/Search permission for directoriesIndex

For a directory, execute x permission is search or access permission and it means a process may “pass through” or “access” the directory to access the inode numbers and content of the items named in the directory.

If you have only r-- permissions on a directory (only read permissions), you can only see the names in the directory; you cannot “pass through” the directory to the inodes of the things named in the directory. You cannot find out the kind of things to which the names are attached (unless your brand of Linux caches that information in the directory), nor can you access the content of those things. You only have permission to see the names in the directory, not to use them. ls works, but not ls -l that requires access to the inodes of the items in the directory to find out what kinds of things they are and other information:

$ ls dir
x  y  z
$ ls -l dir
ls: cannot access dir/x: Permission denied
ls: cannot access dir/z: Permission denied
ls: cannot access dir/y: Permission denied

If you have only --x permissions on a directory (only search permissions), you can “pass through” the directory to the inodes of anything contained in the directory; but, you cannot read any of the names in the directory. You have permissions to use the names, not to see them. (Of course, the only way you can use a name that you can’t see is if you already know that the name is in the directory.)

$ cat dir/date
Tue Oct 25 11:07:42 EDT 2016
$ ls dir
ls: cannot access dir: Permission denied

A directory with -wx permissions lets a process enter or change names in it; but, without read permissions, the process cannot read the names back from the directory. (If the names are random and guaranteed unique, it’s a form of digital “drop box” where items can be created and written by any process but whose names cannot be snooped by other processes.)

A directory with only -w- permissions is useless, though you might think it would permit you to create new names or to rename existing names if you know them. The implementation is such that any action that requires write permission on a directory also requires search permission. (Consider that any action that writes a name in a directory also has to have access to the inode of the thing being named, and that inode access requires search permissions on the directory.) Similarly, having rw- permissions is the same as r-- permissions; without search permissions, write permissions don’t work.

You need search permission as well as write permission on a directory to be able to create, remove, or change names in the directory.

(You do not also need execute permission to write on a file. For a file, write permission is all you need to write on it.)

8 Names are separate from contentIndex

The permissions that govern access to the things listed a directory are stored in the inode for that directory. Without access permissions on a directory, you can’t access anything inside that directory.

The permissions for the actual items named in the directory are not kept in the directory. The permissions on the things are stored in the inodes for the items being named.

Because names are stored separately from the things they name, the permissions you may have to alter the names in the directory are not the same as the permissions you have to alter the contents the actual things being named.

Changing the permissions of a directory only affects what you can do to the name of the thing stored directory; it doesn’t directly affect what you can do to the actual content of the things named in the directory. You may be able to write the inode of the directory but unable to write the inodes of anything named in the directory, or vice-versa.

You may have a directory that you can modify (rwx) that contains names for things that you cannot even read (---). You can rename the things or remove their names from your directory; but, you cannot read the things or change them in any way.

You may have a directory that you cannot modify (r-x) that contains names for things that you have full permissions to modify (rw-). You have full permissions to modify the item named in the directory; but, you cannot remove its name from the directory or change its name (because you cannot write the directory where the name is kept).

Names of things are stored in directories; directories have separate permissions from the things being names.

$ ls -ld /
drwxr-xr-x 24 root root 4096 Nov 24 16:51 /

$ ls -ld /etc
drwxr-xr-x 180 root root 12288 Feb 29 13:38 /etc

$ ls -l /etc/passwd
-rw-r--r-- 1 root root 2209 Jan 19 20:39 /etc/passwd

$ id
uid=777(idallen) gid=777(idallen) groups=777(idallen),120(admin)

9 Changing Permissions using chmodIndex

The owner of an inode is the only one who can change the mode (permissions) of an inode. The owner can always change the mode of the inode, even if the inode has no permissions for the owner. (So the owner of an inode can always restore full permissions to access the inode.)

Only the user/owner of an inode can change its permissions, even if the inode has full permissions for other groups or other users. Nobody can change the mode except the owner of the inode.

Use the chmod (change mode) command to change the permissions (RTFM):

 chmod  mode  pathnames...

You must supply at least two arguments:

1. one permission (“mode”) argument (that may contain multiple permissions) and
2. one or more pathnames of inodes for which the access permissions are to be set or modified

Examples of setting or adding/removing permissions on a pathname:

chmod u=rwx,g=rx,o=wx path    # set inode to  rwxr-x-wx or 753 octal
chmod 753 path                # set to 753 or rwxr-x-wx symbolic
chmod u+r path      # add only owner read permission; leave wx unchanged
chmod go-wx path    # remove only group and other wx permissions; leave r unchanged

The mode argument can be either octal-numeric or symbolic, as shown above. For an explanation of octal-numeric modes, see octal permissions.

The chmod command follows symbolic links given on the command line and changes the target that the link points to. It never changes the permissions on the symlink itself.

10 File system damage to directoriesIndex

When a file system is damaged and a directory inode is lost, the only things that go missing are the names of the items in the directory.

Everything else about the items – the permissions, owner, group, modify time, size, etc. – is not lost; it is stored in the items’ inodes, separate from the lost directory inode. A damaged directory only loses names, not data. Permissions are not affected.

11 Hard links and permissionsIndex

When you create a hard link to a file, you create another name in a directory for the file’s unique inode number. Since the file permissions are stored with the file’s inode, not in the directory, all the names for a file lead to the same inode and thus to the same permissions.

Changing the permissions of a file using one of the hard-linked names changes the permissions for the inode and thus for all the names; all the names lead to the same unique inode and the same permissions.

Hard-linked names cannot have different owners, groups, or permissions; both names lead to the same inode.

Creating a name for an existing inode (ln), renaming (mv), or removing a name (a hard link) (rm) are all directory operations. The permissions on the directory inode apply, not the permissions on the inode of the thing to which you are making a link. You can create in your own directory a hard link to a file even if you have no permissions to read the file itself. You can remove or rename the name of a file in your directory if you have permission on the directory; you don’t need any permissions at all on the inode of the file itself.

Recent versions of the Linux kernel (since 3.6) have created a new kernel security option that, when enabled, prevents you from making a hard link to (new name for) a file that you do not own and cannot read or write. See the kernel sysctl option fs.protected_hardlinks or entry /proc/sys/fs/protected_hardlinks in the man page proc(5). This Linux course assumes that this option is not enabled, so that you can create a hard link to any file you can access in the current file system without restriction.

12 Permissions for using ls on the current directory: ls .Index

What permissions are needed to list the contents of the current directory (i.e. using ls that really means ls .)?

The current directory is only accessible using the name dot (“.”). To get a listing of the contents of the current directory, you must first have permission to use the name dot . in the current directory to get to the current directory. The name dot . is itself stored in the current directory. To use (“pass through to”) any name in a directory, you must have search permissions on the directory; so, you must have at least --x permission on the current directory to use the name dot . in the current directory.

Once you have used dot . to get to the inode that is the current directory, you must be able to read the names from the directory to generate a listing of its contents for ls. Reading the names in a directory requires at least read permission on the directory (r--).

Thus, to get a listing of the current directory, on the directory you must have both search permissions (to use the name dot .) and read permissions (to get a list of the names in the directory). Result – you need: r-x permissions to get the listing.

Without search permissions, you cannot use the name dot (“.”). Without read permissions, you cannot get a list of the names in the directory. You need both.

$ pwd
/home/idallen
$ mkdir new
$ ls -l new
total 0
$ ls -ld new
drwxrwxr-x 2 idallen idallen 4096 2016-02-29 05:21 new
$ touch new/{a,b,c}
$ cd new
$ ls
a  b  c
$ chmod u-x .                # remove search permission; leave read perms
$ ls
ls: cannot open directory .: Permission denied
$ ls ..
ls: cannot access ..: Permission denied
$ ls /home/idallen/new
a  b  c
$ chmod u+x .
chmod: cannot access '.': Permission denied
$ chmod u+x /home/idallen/new
$ ls
a  b  c

If you use the absolute pathname of the directory, you only need read permissions on a directory to see the names in it, because you are not needing to use the name dot . inside the directory to get to the directory. In other words: To see the names in a directory from inside the directory means the directory needs r-x permissions; to see the same thing using an absolute path to the directory needs only r-- permissions on the directory.

13 Long listings need search permissionsIndex

What permissions are set on directory dir, below?

$ unalias ls
$ ls dir
x  y  z
$ ls -l dir
ls: cannot access dir/x: Permission denied
ls: cannot access dir/z: Permission denied
ls: cannot access dir/y: Permission denied
total 0
-????????? ? ? ? ?                ? x
-????????? ? ? ? ?                ? y
-????????? ? ? ? ?                ? z

Answer: Read permissions but not search (eXecute) permissions.

The ls command without any options simply lists the names in the directory. This only requires read permissions on the directory to read the names. The simple ls with no options succeeded; the directory had read permissions.

With the -l option, ls -l must use each name in the directory to access the inode associated with that name to find out the permissions, owner, group, times, etc. for that inode. To use a name – to “search” or “pass through” a directory – requires search (eXecute) permissions on the directory, which were not enabled. For each name in the directory, the permission to access dir/name for the long listing was denied.

The directory had read permissions but no search permissions. We can see the names, but we are not allowed to use the names to find out anything about the objects being named.

NOTE: Careful observers will note that the ls -l command did know the file inode type of each of the files – the first character in each line of output is a dash, not a question mark. Modern Unix/Linux systems cache some of the inode information in the directory so that commands such as ls don’t have to make a disk access every time just to find out what kind of inode each name is.

14 Permission matching exercisesIndex

Given the following inode permissions on these things:

---x------    1 dar      staff         123 Apr  1  2016 dar1
----rwxrwx    1 dar      cst8207       512 Apr  1  2016 dar2
dr---wx-w-    1 dar      cst8207       512 Apr  1  2016 dar3
-r---wx-w-    1 les      cst8207       123 Apr  1  2016 les1
drwxrw-r-x    1 les      alumni        512 Apr  1  2016 les2
-rwxrw-r-x    1 pat      alumni        123 Apr  1  2016 pat1
d--x------    1 pat      staff         512 Apr  1  2016 pat2
-rw-r--r--    1 root     system        123 Apr  1  2016 root1
drwx----wx    1 root     system        512 Apr  1  2016 root2

And given these users and their user IDs and group IDs:

root - super user
dar  - in groups "alumni" and "cst8207"
les  - in groups "alumni" and "staff"
pat  - in groups "student" and "cst8207"
kai  - in groups "alumni" and "system"
tam  - in groups "system" and "staff"
dod  - in groups "nobody"

Answer these questions:

1. What type of inode is each thing above? (directory, file, other…)

2. For files, what permissions do each of the users have on each file inode?

   1. which set of permissions apply to each user?
   2. can the user read the file?
   3. can the user write the file?
   4. can the user execute the file?
   5. can the user rename the file? (trick question)

3. For directories, what permissions do each of the users have on each directory inode?

   1. which set of permissions apply to each user?
   2. can the user read the directory names?
   3. can write the directory (create new names, delete names, rename)?
   4. can search (pass through) the directory to the contained inodes?
   5. can the user rename the directory? (trick question)

15 Appendix: Programs with special privileges: setuid / setgidIndex

Normally when you execute a program, the program inherits your user ID and your group IDs from your shell and the program runs “as you” and has your permissions.

A very few program executable files are set up on Unix to execute using the user ID and/or group ID of the file inode of the program; they do not inherit from the person running the program. These program files are called either setuid (set user ID) or setgid (set group ID) programs. Typically, these are privileged programs that need to create or modify files in directories where ordinary users cannot write. They also may need special permissions to access network resources.

Setuid and setgid programs show up with the s bit set (instead of x) in the owner and/or group permissions field in the output of a ls -l listing:

$ ls -l /bin/su /bin/ping /bin/umount /bin/mount
-rwsr-xr-x root root 36832 Sep 12  2016 /bin/su
-rwsr-xr-x root root 35712 Nov  8  2016 /bin/ping
-rwsr-xr-x root root 69096 Mar 30  2016 /bin/umount
-rwsr-xr-x root root 94792 Mar 30  2016 /bin/mount

The above setuid programs (rws) do not take on the user ID of the person who runs them; the programs always run with the privileges of the root account that is the owner of the file inode.

$ ls -l /sbin/unix_chkpwd
-rwxr-sr-x  1 root shadow  35432 Feb  8  2016 unix_chkpwd

The above setgid program (r-s) does not take on the group ID of the person who runs it; the program always runs with the group privileges of the shadow group account that is the group of the file.

$ ls -l /usr/bin/at
-rwsr-sr-x 1 daemon daemon 51464 Jan 14  2016 /usr/bin/at

The above program is both setuid (rws) and setgid (r-s). It runs with the privileges of user ID daemon and group ID daemon.

Only the owner of an inode can change its mode (permissions), and that includes making its program file setuid or setgid.

A poorly written setuid file may be a security problem. With its elevated privileges, the setuid file may be exploited to damage the system. Looking for unusual setuid programs is part of a system security check.

16 Appendix: Resources and LinksIndex

• http://www.linux.com/learn/tutorials/885268-getting-to-know-linux-file-permissions

Author: 
| Ian! D. Allen, BA, MMath  -  idallen@idallen.ca  -  Ottawa, Ontario, Canada
| Home Page: http://idallen.com/   Contact Improv: http://contactimprov.ca/
| College professor (Free/Libre GNU+Linux) at: http://teaching.idallen.com/
| Defend digital freedom:  http://eff.org/  and have fun:  http://fools.ca/