Linux 文件系统权限记序

Linux 文件系统权限记序

用到程序:

chmod setfacl getfacl stat chattr lsattr
 chmod:设置文件权限
setfacl:设置访问控制列表(access control list)
 getfacl:查看访问控制列表
stat:显示inode内容(a|m|c)time内容
chattr:设置第二扩展文件的列表文件属性系统
lsattr:查看第二扩展文件的列表文件属性系统
setuid:使文件拥有和文件属主相同的x权限
setgid:使文件夹拥有和文件属组相同的x权限
sticky:使文件不可册除

Test:

1. [root@nagios test]# touch setuid setgid sticky
2. [root@nagios test]# chown -R nagios.nagios ./
3. [root@nagios test]# chmod u+s setuid && chmod g+s setgid && chmod o+t sticky
4. [root@nagios test]# ll
5. total 0
6. -rw-r-Sr-- 1 nagios nagios 0 Mar 2800:41 setgid
7. -rwSr--r-- 1 nagios nagios 0 Mar 2800:41 setuid
8. -rw-r--r-T 1 nagios nagios 0 Mar 2800:41 sticky
9. [root@nagios test]# su hello
10. [hello@nagios test]$ pwd
11. /root/test
12. [hello@nagios test]$ echo hello >> setuid
13. bash: setuid: Permission denied
14. [hello@nagios test]$ sh setuid
15. hello
16. [nagios@nagios test]$ exit
17. exit
18. [root@nagios test]# chmod o+w sticky
19. [root@nagios test]# su hello
20. [hello@nagios test]$ ll sticky
21. -rw-rw-rwT 1 nagios nagios 0 Mar 2800:45 sticky
22. [hello@nagios test]$ rm sticky
23. rm: cannot remove `sticky': Permission denied
24. [hello@nagios test]$ stat sticky
25. File: `sticky'
26. Size: 0 Blocks: 0 IO Block: 4096 regular empty file
27. Device: fd00h/64768d Inode: 134198 Links: 1
28. Access: (1666/-rw-rw-rwT) Uid: ( 500/ nagios) Gid: ( 500/ nagios)
29. Access: 2013-03-2800:45:37.875928997 +0800
30. Modify: 2013-03-2800:45:37.875928997 +0800
31. Change: 2013-03-2800:46:28.050580800 +0800

#setfacl and getfacl

查看是否支持ACL

1. [root@nagios heelo]# tune2fs -l /dev/sda1 | grep option
2. Default mount options: user_xattr acl

test:

1. [root@nagios test]# touch setfacl
2. [root@nagios test]# setfacl -m user::r,user:hello:rw setfacl
3. [root@nagios test]# chown nagios.nagios setfacl
4. [root@nagios test]# ll setfacl
5. -r--rw-r--+ 1 nagios nagios 0 Mar 2800:52 setfacl
6. [root@nagios test]# su nagios
7. [nagios@nagios test]$ echo hello >> setfacl
8. bash: setfacl: Permission denied
9. [nagios@nagios test]$ exit
10. exit
11. [root@nagios test]# su hello
12. [hello@nagios test]$ echo hello >> setfacl
13. [hello@nagios test]$ cat setfacl
14. hello
15. [hello@nagios test]$ getfacl setfacl
16. # file: setfacl
17. # owner: nagios
18. # group: nagios
19. user::r--
20. user:hello:rw-
21. group::r--
22. mask::rw-
23. other::r--

#chattr and lsattr

test:

1. [root@nagios test]# mkdir chattr
2. [root@nagios test]# chattr +i chattr/
3. [root@nagios test]# touch chattr/hello
4. touch: cannot touch `chattr/hello': Permission denied
5. [root@nagios test]# chattr -i +a chattr/
6. [root@nagios test]# touch chattr/hello && echo hello >>chattr/hello && cat chattr/hello
7. hello
8. [root@nagios test]# rm chattr/hello
9. rm: remove regular file `chattr/hello'? y
10. rm: cannot remove `chattr/hello': Operation not permitted

《完》