devutils/ATFQ/book ATFQ git

Part II · Your system

15. Permissions

hub

Who you are to the system, and what decides whether you may read, write or run something.

On your machine

alice@laptopexample
$ atfq permissions
  User      alice (uid 1000, gid 1000)
  Groups    alice, wheel, docker, 4242
  Admin     member of wheel: the group sudo usually trusts
  Umask     0022: new files 644 (rw-r--r--), new folders 755

  Modules   capability, landlock, yama, apparmor
  AppArmor  enabled · profiles: 2 enforce, 1 complain

An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.

Commands

id
your user, your groups 15.3
ls -l file
owner, group and rights of a file 15.1
namei -l /path/to/file
rights of every folder on the way to a file
sudo -l
what sudo lets you run 15.3
getfacl file
extra users and groups allowed (ACL) 15.4
getenforce
SELinux mode, on Fedora and RHEL 15.5

Paths

/etc/passwd
accounts: uid, home folder, shell
/etc/group
groups and their members
/etc/sudoers.d/
who may use sudo, and for what

Cards

  1. 15.1rwx, octal and umaskEvery file has an owner, a group, and three sets of rights: for the owner, for the group, for everyone else.
  2. 15.2setuid, setgid and sticky bitsetuid (s in the owner's x spot): the program runs with its owner's rights, not yours. That's how passwd can update /etc/shadow.
  3. 15.3sudo and groupssudo runs one command as root, if /etc/sudoers (or a file in /etc/sudoers.d/) allows it.
  4. 15.4ACLs and capabilitiesAn ACL gives rights to more people than owner, group and others: "bob may read this file too".
  5. 15.5SELinux and AppArmorBoth add a second set of rules on top of rwx: even a process running as root can only do what its policy allows.