O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 5] 5.2 Using File Permissions
% ls -l *.c
-rw-r--r-- 1 kevin okisrc 28092 Aug 9 9:52 cdrom.c
-rw-r--r-- 1 kevin okisrc 5496 Aug 9 9:52 cfs_subr.c
-rw-r--r-- 1 kevin okisrc 5752 Aug 9 9:52 cfs_vfsops.c
-rw-r--r-- 1 kevin okisrc 11998 Aug 9 9:53 cfs_vnodeops.c
-rw-r--r-- 1 kevin okisrc 3031 Aug 9 9:53 load_unld.c
-rw-r--r-- 1 kevin okisrc 1928 Aug 9 9:54 Unix_rw.c
-rw-r--r-- 1 kevin okisrc 153 Aug 9 9:54 vers.c
%
To change the permissions of a file so it can be read or modified by anybody in your group, but can't be read or written by
anybody else in the system, type the command:
% chmod 660 memberlist
% ls -l memberlist
-rw-rw---- 1 kevin okisrc 153 Aug 10 8:32 memberlist
%
5.2.5 Access Control Lists[17]
[17] This section is largely based on Æleen Frisch's Essential System Administration, Second Edition (O'Reilly &
Associates, 1995), Chapter 6, and is used here with permission.
Some versions of UNIX support Access Control Lists, or ACLS. These are normally provided as an extension to standard UNIX
file permission modes. With ACLS, you can specify additional access rights to each file and directory for many individual users
rather than lumping them all into the category "other." You can also set different permissions for members of different groups.
We think they are a wonderful feature, and something we will see more of in future years. Unfortunately, every vendor has
implemented them differently, and this makes describing them somewhat complex.
ACLS offer a further refinement to the standard UNIX file permissions capabilities. ACLS enable you to specify file access for
completely arbitrary subsets of users and/or groups. Both AIX and HP-UX provide access control lists. Solaris and Linux are
supposed to have them in future releases. Also, the Open Software Foundation's Distributed Computing Environment has a form
of ACLS.
For many purposes, ACLS are superior to the UNIX group mechanism for small collaborative projects. If Hana wants to give
Miria - and only Miria - access to a particular file, Hana can modify the file's ACL to give Miria access. Without ACLS, Hana
would have to go to the system administrator, have a new group created that contains both Hana and Miria (and only Hana and
Miria) as group members, and then change the group of the file to the newly created group.
NOTE: Because ACLS are not standard across UNIX versions, you should not expect them to work in a network
filesystem environment. In particular, Sun plans to support ACLS through the use of private extensions to the NFS3
filesystem, rather than building ACLS into the specification. Therefore, be sure that anything you export via NFS is
adequately protected by the default UNIX file permissions and ownership settings.
5.2.5.1 AIX Access Control Lists
An AIX ACL contains these fields (the text in italics to the right describes the line contents):
attributes: Special modes like SUID.
base permissions Normal UNIX file modes:
owner(chavez): rw- User access.
group(chem): rw- Group access.
others: r-- Other access.
extended permissions More specific permissions entries:
enabled Whether they're used or not.
specify r-- u:harvey Permissions for user harvey.
deny -w- g:organic Permissions for group organic.
permit rw- u:hill, g:bio Permissions for user hill when in group
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch05_02.htm (5 of 9) [2002-04-12 10:44:09]