{"id":55251,"date":"2020-01-16T00:00:00","date_gmt":"2020-01-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/fajlovye-razresheniya-v-linux"},"modified":"2020-02-18T14:03:21","modified_gmt":"2020-02-18T11:03:21","slug":"fajlovye-razresheniya-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","title":{"rendered":"Souborov\u00e1 opr\u00e1vn\u011bn\u00ed v Linuxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ahoj v\u0161ichni. Aktivn\u011b se zapojujeme do pr\u00e1ce a u\u017e v lednu p\u0159ipravujeme mnoho siln\u00fdch spu\u0161t\u011bn\u00ed. Mezi nimi zahajujeme nov\u00fd b\u011bh obl\u00edben\u00e9ho kurzu. <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/rbVT\/\">\u201eLinuxov\u00fd administr\u00e1tor\u201c<\/a><\/noindex>V p\u0159edve\u010der spu\u0161t\u011bn\u00ed tradi\u010dn\u011b sd\u00edl\u00edme p\u0159eklad u\u017eite\u010dn\u00e9ho materi\u00e1lu.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Souborov\u00e1 opr\u00e1vn\u011bn\u00ed v Linuxu\" src=\"\/wp-content\/uploads\/2020\/01\/451acace5e0a9088355acb800d789db9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<blockquote><p><i>Souborov\u00e1 opr\u00e1vn\u011bn\u00ed nab\u00edzej\u00ed bezpe\u010dnou alternativu ke spu\u0161t\u011bn\u00fdm SUID soubor\u016fm, ale na prvn\u00ed pohled se mohou zd\u00e1t trochu matouc\u00ed.<\/i><\/p><\/blockquote>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nV\u0161ichni v\u00edme, \u017ee bin\u00e1rn\u00ed soubory <noindex><a rel=\"nofollow\" href=\"http:\/\/en.wikipedia.org\/wiki\/Setuid#Security\">SUID<\/a><\/noindex> Komit\u011b IETF (Internet Engineering Task Force), kter\u00e1 se zab\u00fdv\u00e1 rozvojem protokol\u016f a architektury internetu, <noindex><a rel=\"nofollow\" href=\"http:\/\/en.wikipedia.org\/wiki\/Setuid#Security\">jsou \u0161patn\u00fdm \u0159e\u0161en\u00edm z hlediska bezpe\u010dnosti.<\/a><\/noindex>Na\u0161t\u011bst\u00ed, pokud va\u0161e aplikace vy\u017eaduje ur\u010dit\u00e1 omezen\u00e1 opr\u00e1vn\u011bn\u00ed, existuje efektivn\u011bj\u0161\u00ed zp\u016fsob, zvan\u00fd <noindex><a rel=\"nofollow\" href=\"http:\/\/www.linuxjournal.com\/article\/5737\">souborov\u00e1 opr\u00e1vn\u011bn\u00ed.<\/a><\/noindex>.<\/p>\n<p>U\u0161et\u0159\u00edm v\u00e1m \u010das, pokud se chcete vyhnout podrobn\u00e9mu \u010dten\u00ed v\u00fd\u0161e uveden\u00e9ho \u010dl\u00e1nku: v podstat\u011b souborov\u00e1 opr\u00e1vn\u011bn\u00ed umo\u017e\u0148uj\u00ed proces\u016fm, kter\u00e9 b\u011b\u017e\u00ed pod u\u017eivatelsk\u00fdm jm\u00e9nem root, a tedy maj\u00ed pr\u00e1vo cokoli d\u011blat, uchovat si ur\u010dit\u00e9 mo\u017enosti, omezen\u00e9 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.kernel.org\/doc\/man-pages\/online\/pages\/man7\/capabilities.7.html\">t\u00edmto seznamem,<\/a><\/noindex>kdy\u017e se zbav\u00ed opr\u00e1vn\u011bn\u00ed a spust\u00ed se jako neprivilegovan\u00fd u\u017eivatel. To znamen\u00e1, \u017ee pokud se \u00fato\u010dn\u00edkovi poda\u0159\u00ed kompromitovat proces pomoc\u00ed p\u0159ete\u010den\u00ed vyrovn\u00e1vac\u00ed pam\u011bti nebo jin\u00e9ho zneu\u017eit\u00ed, nebude schopen vyu\u017e\u00edt nic jin\u00e9ho ne\u017e ur\u010dit\u00e9 minim\u00e1ln\u00ed opr\u00e1vn\u011bn\u00ed, kter\u00e1 jsou opravdu pot\u0159ebn\u00e1 pro proces.<\/p>\n<p>Opr\u00e1vn\u011bn\u00ed jsou skv\u011bl\u00e1 pro slu\u017eby, kter\u00e9 obvykle b\u011b\u017e\u00ed pod u\u017eivatelsk\u00fdm jm\u00e9nem root, ale co p\u0159\u00edkazov\u00e9 \u0159\u00e1dky? Na\u0161t\u011bst\u00ed je to tak\u00e9 podporov\u00e1no, pokud m\u00e1te nainstalov\u00e1ny spr\u00e1vn\u00e9 n\u00e1stroje. Pokud pou\u017e\u00edv\u00e1te Ubuntu, budete pot\u0159ebovat bal\u00ed\u010dek <code>libcap2-bin.<\/code>Tak\u00e9 budete pot\u0159ebovat modern\u00ed j\u00e1dro (od verze<b> 2.6.24<\/b>).<\/p>\n<p>Tyto funkce umo\u017e\u0148uj\u00ed spojen\u00ed opr\u00e1vn\u011bn\u00ed se spustiteln\u00fdmi soubory podobn\u011b jako nastaven\u00ed bitu SUID, ale pouze pro ur\u010dit\u00fd soubor opr\u00e1vn\u011bn\u00ed. N\u00e1stroj <code>setcap<\/code> se pou\u017e\u00edv\u00e1 k p\u0159id\u00e1n\u00ed a odebr\u00e1n\u00ed opr\u00e1vn\u011bn\u00ed ze souboru.<\/p>\n<p>Prvn\u00edm krokem je vybrat po\u017eadovan\u00e1 opr\u00e1vn\u011bn\u00ed. Pro tento \u010dl\u00e1nek p\u0159edpokl\u00e1d\u00e1m, \u017ee existuje diagnostick\u00fd n\u00e1stroj s\u00edt\u011b zvan\u00fd <code>tracewalk,<\/code>kter\u00fd by m\u011bl um\u011bt pou\u017e\u00edvat <noindex><a rel=\"nofollow\" href=\"http:\/\/man7.org\/linux\/man-pages\/man7\/raw.7.html\">neza\u0159azen\u00e9 sokety.<\/a><\/noindex>Obvykle pro to vy\u017eaduje, aby aplikace b\u011b\u017eela pod u\u017eivatelsk\u00fdm jm\u00e9nem root, ale p\u0159i prohl\u00ed\u017een\u00ed. <noindex><a rel=\"nofollow\" href=\"http:\/\/www.kernel.org\/doc\/man-pages\/online\/pages\/man7\/capabilities.7.html\">seznamu <\/a><\/noindex>zjist\u00ed se, \u017ee je pot\u0159eba pouze opr\u00e1vn\u011bn\u00ed <code>CAP_NET_RAW<\/code>.<\/p>\n<p>P\u0159edpokl\u00e1d\u00e1me, \u017ee se nach\u00e1z\u00edte v adres\u00e1\u0159i, kde se nach\u00e1z\u00ed bin\u00e1rn\u00ed soubor <code>tracewalk,<\/code>, m\u016f\u017eete toto opr\u00e1vn\u011bn\u00ed p\u0159idat n\u00e1sleduj\u00edc\u00edm zp\u016fsobem:<\/p>\n<pre><code class=\"bash\">sudo setcap cap_net_raw=eip tracewalk<\/code><\/pre>\n<p>\nProzat\u00edm ignorujte sufix <code>=eip<\/code> pro opr\u00e1vn\u011bn\u00ed, o tom si pov\u00edme za p\u00e1r sekund. V\u0161imn\u011bte si, \u017ee n\u00e1zev opr\u00e1vn\u011bn\u00ed je psan\u00fd mal\u00fdmi p\u00edsmeny. Nyn\u00ed m\u016f\u017eete zkontrolovat, zda m\u00e1te opr\u00e1vn\u011bn\u00ed spr\u00e1vn\u011b nastaven\u00e1 pomoc\u00ed:<\/p>\n<pre><code class=\"bash\">setcap -v cap_new_raw=eip tracewalk<\/code><\/pre>\n<p>\nNebo m\u016f\u017eete vypsat seznam v\u0161ech opr\u00e1vn\u011bn\u00ed nastaven\u00fdch pro dan\u00fd spustiteln\u00fd soubor:<\/p>\n<pre><code class=\"bash\">getcap tracewalk\n<\/code><\/pre>\n<p>\nPro informaci, m\u016f\u017eete tak\u00e9 odstranit v\u0161echna opr\u00e1vn\u011bn\u00ed ze spustiteln\u00e9ho souboru pomoc\u00ed:<\/p>\n<pre><code class=\"bash\">setcap -r tracewalk<\/code><\/pre>\n<p>\nV t\u00e9to f\u00e1zi byste m\u011bli b\u00fdt schopni spustit spustiteln\u00fd soubor jako neprivilegovan\u00fd u\u017eivatel, a m\u011bl by b\u00fdt schopen pracovat s syrov\u00fdmi sokety, ale nem\u011bl by m\u00edt \u017e\u00e1dn\u00e1 jin\u00e1 privileg\u00eda, kter\u00fdmi disponuje u\u017eivatel root.<\/p>\n<p>Tak\u017ee, co znamen\u00e1 tento podivn\u00fd sufix <code>=eip<\/code>? \u0417\u0434\u0435\u0441\u044c \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u0438\u043a\u0430 \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0440\u043e\u0434\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0438\u043c\u0435\u0435\u0442 \u0442\u0440\u0438 \u043d\u0430\u0431\u043e\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u2014 <i>efektivn\u00ed, d\u011bdi\u010dn\u00e9 a povolen\u00e9 (effective, inheritable a permitted)<\/i>:<\/p>\n<ul>\n<li><b>Efektivn\u00ed (Effective)<\/b> opr\u00e1vn\u011bn\u00ed jsou ta, kter\u00e1 ur\u010duj\u00ed, co m\u016f\u017ee proces skute\u010dn\u011b d\u011blat. Nap\u0159\u00edklad nem\u016f\u017ee pracovat s nevyu\u017eit\u00fdmi sokety, pokud <code>CAP_NET_RAW<\/code> nen\u00ed v efektivn\u00edm setu.<\/li>\n<li><b>Povolen\u00e9 (Permitted)<\/b> opr\u00e1vn\u011bn\u00ed jsou ta, kter\u00e1 proces m\u016f\u017ee m\u00edt, pokud je po\u017eaduje prost\u0159ednictv\u00edm p\u0159\u00edslu\u0161n\u00e9ho vol\u00e1n\u00ed. Neumo\u017e\u0148uj\u00ed procesu ve skute\u010dnosti nic d\u011blat, pokud nebyl speci\u00e1ln\u011b naps\u00e1n pro po\u017eadavek na konkr\u00e9tn\u00ed opr\u00e1vn\u011bn\u00ed. To umo\u017e\u0148uje ps\u00e1t procesy pro p\u0159id\u00e1n\u00ed zvl\u00e1\u0161tn\u011b d\u016fle\u017eit\u00fdch opr\u00e1vn\u011bn\u00ed do efektivn\u00edho setu pouze po dobu, kdy jsou skute\u010dn\u011b pot\u0159eba.<\/li>\n<li><b>D\u011bdi\u010dn\u00e9 (Inheritable)<\/b> opr\u00e1vn\u011bn\u00ed jsou ta, kter\u00e1 mohou b\u00fdt zd\u011bd\u011bna v dostupn\u00e9m setu potomkov\u00e9ho procesu. B\u011bhem operace <code>fork()<\/code> nebo <code>clone()<\/code> dce\u0159in\u00e9mu procesu je v\u017edy d\u00e1na kopie opr\u00e1vn\u011bn\u00ed rodi\u010dovsk\u00e9ho procesu, proto\u017ee v tu chv\u00edli st\u00e1le vykon\u00e1v\u00e1 ten sam\u00fd spustiteln\u00fd soubor. D\u011bdi\u010dn\u00fd set se pou\u017e\u00edv\u00e1, kdy\u017e <code>exec()<\/code> (nebo ekvivalent) je vol\u00e1n pro nahrazen\u00ed spustiteln\u00e9ho souboru jin\u00fdm. V t\u00e9to f\u00e1zi je dostupn\u00fd set procesu maskov\u00e1n d\u011bdi\u010dn\u00fdm setem pro z\u00edsk\u00e1n\u00ed dostupn\u00e9ho setu, kter\u00fd bude pou\u017eit pro nov\u00fd proces.<\/li>\n<\/ul>\n<p>\nTakto n\u00e1stroj <code>setcap<\/code> n\u00e1m umo\u017e\u0148uje nez\u00e1visle p\u0159id\u00e1vat opr\u00e1vn\u011bn\u00ed t\u011bchto t\u0159\u00ed sad pro dan\u00fd spustiteln\u00fd soubor. V\u0161imn\u011bte si, \u017ee hodnota skupin se m\u00edrn\u011b odli\u0161n\u011b vykl\u00e1d\u00e1 pro p\u0159\u00edstupov\u00e1 pr\u00e1va k soubor\u016fm:<\/p>\n<ul>\n<li><b>Dostupn\u00e9 <\/b>souborov\u00e1 opr\u00e1vn\u011bn\u00ed jsou ta, kter\u00e1 jsou v\u017edy dostupn\u00e1 pro spustiteln\u00fd soubor, i kdy\u017e rodi\u010dovsk\u00fd proces, kter\u00fd jej vyvolal, je nem\u011bl. D\u0159\u00edve se jim \u0159\u00edkalo \u201edonucovac\u00ed\u201c opr\u00e1vn\u011bn\u00ed.<\/li>\n<li><b>D\u011bd\u011bn\u00e1 <\/b>souborov\u00e1 opr\u00e1vn\u011bn\u00ed ur\u010duj\u00ed dal\u0161\u00ed masku, kter\u00e1 tak\u00e9 m\u016f\u017ee b\u00fdt pou\u017eita k odstran\u011bn\u00ed opr\u00e1vn\u011bn\u00ed ze sady vyvol\u00e1vaj\u00edc\u00edho procesu. Pou\u017e\u00edvaj\u00ed se nav\u00edc k d\u011bd\u011bn\u00e9 sad\u011b vyvol\u00e1vaj\u00edc\u00edho procesu, tak\u017ee opr\u00e1vn\u011bn\u00ed je d\u011bd\u011bno pouze v p\u0159\u00edpad\u011b, \u017ee existuje v obou sad\u00e1ch.<\/li>\n<li><b>Efektivn\u00ed <\/b>souborov\u00e1 opr\u00e1vn\u011bn\u00ed p\u0159edstavuj\u00ed ve skute\u010dnosti pouze jeden bit, nikoli sadu, a pokud je nastaven, znamen\u00e1 to, \u017ee cel\u00fd dostupn\u00fd souborov\u00fd set je tak\u00e9 zkop\u00edrov\u00e1n do efektivn\u00edho setu nov\u00e9ho procesu. Toto m\u016f\u017ee b\u00fdt pou\u017eito k p\u0159id\u00e1n\u00ed opr\u00e1vn\u011bn\u00ed k proces\u016fm, kter\u00e9 nebyly speci\u00e1ln\u011b navr\u017eeny pro jejich po\u017eadavek. Proto\u017ee jde o jeden bit, pokud jej nastav\u00edte na jak\u00e9koli opr\u00e1vn\u011bn\u00ed, mus\u00ed b\u00fdt nastaven pro v\u0161echna opr\u00e1vn\u011bn\u00ed. M\u016f\u017eete o n\u011bm uva\u017eovat jako o bity legace, proto\u017ee se pou\u017e\u00edv\u00e1 k povolen\u00ed pou\u017e\u00edv\u00e1n\u00ed opr\u00e1vn\u011bn\u00ed pro aplikace, kter\u00e9 je nepodporuj\u00ed.<\/li>\n<\/ul>\n<p>\nP\u0159i zad\u00e1v\u00e1n\u00ed opr\u00e1vn\u011bn\u00ed p\u0159es <code>setcap<\/code> t\u0159i p\u00edsmena <code>e<\/code>, <code>i<\/code> a <code>p<\/code> se vztahuj\u00ed k <i>efektivn\u00edm, d\u011bd\u011bn\u00fdm a dostupn\u00fdm<\/i> sad\u00e1m resp. Tak\u017ee star\u0161\u00ed specifikace:<\/p>\n<pre><code class=\"bash\">sudo setcap cap_net_raw=eip tracewalk<\/code><\/pre>\n<p>\n\u2026 uv\u00e1d\u00ed, \u017ee opr\u00e1vn\u011bn\u00ed <code>CAP_NET_RAW<\/code> mus\u00ed b\u00fdt p\u0159id\u00e1no k dostupn\u00fdm a d\u011bd\u011bn\u00fdm sad\u00e1m a \u017ee by m\u011bl b\u00fdt tak\u00e9 nastaven efektivn\u00ed bit. To nahrad\u00ed jak\u00e1koliv d\u0159\u00edve nastaven\u00e1 opr\u00e1vn\u011bn\u00ed v souboru. Abyste nastavili v\u00edce opr\u00e1vn\u011bn\u00ed najednou, pou\u017eijte seznam odd\u011blen\u00fd \u010d\u00e1rkami:<\/p>\n<pre><code class=\"bash\">sudo setcap cap_net_admin,cap_net_raw=eip tracewalk<\/code><\/pre>\n<p>\n<noindex><a rel=\"nofollow\" href=\"http:\/\/www.kernel.org\/doc\/man-pages\/online\/pages\/man7\/capabilities.7.html\">Pr\u016fvodce opr\u00e1vn\u011bn\u00edmi<\/a><\/noindex> diskutuje o v\u0161em podrobn\u011bji, ale douf\u00e1m, \u017ee tento p\u0159\u00edsp\u011bvek trochu objasnil, co se d\u011bje. Zb\u00fdv\u00e1 zm\u00ednit jen p\u00e1r upozorn\u011bn\u00ed a trik\u016f.<\/p>\n<p>Za prv\u00e9, souborov\u00e1 opr\u00e1vn\u011bn\u00ed nefunguj\u00ed se symlinky \u2014 mus\u00edte je aplikovat na samotn\u00fd bin\u00e1rn\u00ed soubor (tedy na c\u00edl symlinku).<\/p>\n<p>Za druh\u00e9, nepracuj\u00ed s interpretovan\u00fdmi skripty. Nap\u0159\u00edklad pokud m\u00e1te skript v Pythonu, kter\u00e9mu chcete p\u0159id\u011blit opr\u00e1vn\u011bn\u00ed, mus\u00edte je p\u0159i\u0159adit samotn\u00e9mu interpretu Pythonu. To je z\u0159ejm\u00fd bezpe\u010dnostn\u00ed probl\u00e9m, proto\u017ee v\u0161echna skripty spou\u0161t\u011bn\u00e9 s t\u00edmto interpretem budou m\u00edt dan\u00e9 opr\u00e1vn\u011bn\u00ed, i kdy\u017e je to st\u00e1le v\u00fdrazn\u011b lep\u0161\u00ed ne\u017e pou\u017eit\u00ed SUID. Nejb\u011b\u017en\u011bj\u0161\u00ed obchvat se zd\u00e1 b\u00fdt naps\u00e1n\u00ed samostatn\u00e9ho spustiteln\u00e9ho souboru v C nebo jeho ekvivalentu, kter\u00fd m\u016f\u017ee vykon\u00e1vat pot\u0159ebn\u00e9 operace a volat jej ze skriptu. Toto je podobn\u00e9 p\u0159\u00edstupu, kter\u00fd pou\u017e\u00edv\u00e1 Wireshark, kter\u00fd vyu\u017e\u00edv\u00e1 bin\u00e1rn\u00ed soubor. <code>\/usr\/bin\/dumpcap<\/code> k prov\u00e1d\u011bn\u00ed privilegovan\u00fdch operac\u00ed:<\/p>\n<pre><code class=\"bash\">$ getcap \/usr\/bin\/dumpcap \n\/usr\/bin\/dumpcap = cap_net_admin,cap_net_raw+eip<\/code><\/pre>\n<p>\nZa t\u0159et\u00ed, souborov\u00e1 opr\u00e1vn\u011bn\u00ed jsou deaktivov\u00e1na, pokud pou\u017e\u00edv\u00e1te prom\u011bnnou prost\u0159ed\u00ed <code>LD_LIBRARY_PATH<\/code> z pochopiteln\u00fdch bezpe\u010dnostn\u00edch d\u016fvod\u016f.<i>(1)<\/i>To sam\u00e9 plat\u00ed tak\u00e9 pro <code>LD_PRELOAD<\/code>, jak v\u00edme.<\/p>\n<p><i>1. Jeliko\u017e \u00fato\u010dn\u00edk m\u016f\u017ee o\u010dividn\u011b nahradit jednu z standardn\u00edch knihoven a pou\u017e\u00edvat <code>LD_LIBRARY_PATH<\/code>, aby p\u0159inutil svou knihovnu b\u00fdt vol\u00e1na p\u0159ed syst\u00e9movou, a tud\u00ed\u017e m\u00edt sv\u016fj vlastn\u00ed libovoln\u00fd k\u00f3d prov\u00e1d\u011bn\u00fd se stejn\u00fdmi privilegii jako volaj\u00edc\u00ed aplikace. <br \/>\n<\/i><\/p>\n<p><i><b>T\u00edmto je v\u0161e. Podrobnosti o programu kurzu se dozv\u00edte na <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/rbVT\/\">webin\u00e1\u0159i, kter\u00fd prob\u011bhne 24. ledna.<\/a><\/noindex><\/b><\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/483934\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445, \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043d\u0430\u0431\u043e\u0440 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043f\u043e\u0442\u043e\u043a \u043f\u043e\u043b\u044e\u0431\u0438\u0432\u0448\u0435\u0433\u043e\u0441\u044f \u0432\u0441\u0435\u043c \u043a\u0443\u0440\u0441\u0430 \u00ab\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Linux\u00bb. \u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u0434\u0435\u043b\u0438\u043c\u0441\u044f \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u043e\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430. \u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c SUID, \u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0442\u0430\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u0432\u0437\u0433\u043b\u044f\u0434. \u0412\u0441\u0435 \u043c\u044b \u0437\u043d\u0430\u0435\u043c, \u0447\u0442\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":55252,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-15T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:03:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Souborov\u00e1 opr\u00e1vn\u011bn\u00ed v Linuxu | ProHoster","description":"Ahoj v\u0161em. Aktivn\u011b se zapojujeme do pr\u00e1ce a u\u017e v lednu chyst\u00e1me mnoho siln\u00fdch spu\u0161t\u011bn\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 Linux | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55251","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:47:37","updated":"2022-09-30 13:42:26","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=55251"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/55252"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=55251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=55251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=55251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}