Zilolezo mu Linux (chown, chmod, SUID, GUID, Sticky bit, ACL, umask)

Moni nonse. Uku ndikumasulira kwa nkhani kuchokera m'buku la RedHat RHCSA RHCE 7 RedHat Enterprise Linux 7 EX200 ndi EX300.

Kankhani: Ndikukhulupirira kuti nkhaniyi idzakhala yothandiza osati kwa oyamba kumene, komanso ithandizanso olamulira odziwa zambiri kuwongolera chidziwitso chawo.

Ndiye tiyeni tizipita.

Kuti mupeze mafayilo mu Linux, zilolezo zimagwiritsidwa ntchito. Zilolezozi zimaperekedwa ku zinthu zitatu: mwiniwake wa fayilo, mwini gulu, ndi chinthu china (ndiko kuti, wina aliyense). M'nkhaniyi, muphunzira momwe mungagwiritsire ntchito zilolezo.

Nkhaniyi ikuyamba ndi kufotokoza mwachidule mfundo zazikuluzikulu, ndikutsatiridwa ndi zokambirana za zilolezo zapadera ndi Lists Control List (ACLs). Pamapeto pa nkhaniyi, timapereka zilolezo zokhazikika kudzera pa umask, komanso kuyang'anira mawonekedwe a ogwiritsa ntchito.

Kuwongolera umwini wafayilo

Musanakambirane za zilolezo, muyenera kudziwa udindo wa eni fayilo ndi chikwatu. Mwini wamafayilo ndi akalozera ndikofunikira pothana ndi zilolezo. Mu gawo ili, muphunzira kaye momwe mungawonere mwiniwake. Kenako mudzaphunzira momwe mungasinthire eni ake a gulu ndi wogwiritsa ntchito mafayilo ndi maupangiri.

Kuwonetsa mwini wake wa fayilo kapena chikwatu

Ku Linux, fayilo iliyonse ndi chikwatu chilichonse chili ndi eni ake awiri: wogwiritsa ntchito ndi eni gulu.

Eni akewa amayikidwa pamene fayilo kapena chikwatu chapangidwa. Wogwiritsa ntchito yemwe amapanga fayiloyo amakhala mwini wake wa fayiloyo, ndipo gulu loyambirira lomwe wogwiritsa ntchito yemweyo amakhala mwini wake wa fayiloyo. Kuti mudziwe ngati inu, monga wosuta, muli ndi chilolezo chofikira fayilo kapena chikwatu, chipolopolocho chimayang'ana umwini.

Izi zimachitika motere:

1. Chigobacho chimayang'ana kuti muwone ngati ndinu mwiniwake wa fayilo yomwe mukufuna kupeza. Ngati ndinu mwiniwake, mumalandira zilolezo ndipo chipolopolocho chimasiya kuyang'ana.
2. Ngati simuli eni ake a fayilo, chipolopolocho chidzayang'ana kuti muwone ngati ndinu membala wa gulu lomwe lili ndi zilolezo pafayiloyo. Ngati ndinu membala wa gululi, mupeza fayiloyo ndi zilolezo zomwe gululo lakhazikitsa, ndipo chipolopolocho chidzasiya kuyang'ana.
3. Ngati simuli wogwiritsa ntchito kapena eni ake a gulu, mumapatsidwa ufulu wa ogwiritsa ntchito ena (Zina).

Kuti muwone zomwe eni ake akugawira, mutha kugwiritsa ntchito lamulo ls -l. Lamuloli likuwonetsa wogwiritsa ntchito ndi mwini wake wa gululo. Pansipa mutha kuwona makonda a eni ake pazowongolera mu /home directory.

[root@server1 home]# ls -l
total 8
drwx------. 3  bob            bob            74     Feb   6   10:13 bob
drwx------. 3  caroline       caroline       74     Feb   6   10:13 caroline
drwx------. 3  fozia          fozia          74     Feb   6   10:13 fozia
drwx------. 3  lara           lara           74     Feb   6   10:13 lara
drwx------. 5  lisa           lisa           4096   Feb   6   10:12 lisa
drwx------. 14 user           user           4096   Feb   5   10:35 user

Kugwiritsa ntchito lamulo ls mukhoza kusonyeza mwiniwake wa mafayilo mu bukhu loperekedwa. Nthawi zina zingakhale zothandiza kupeza mndandanda wa mafayilo onse pamakina omwe ali ndi wogwiritsa ntchito kapena gulu ngati eni ake. Kwa ichi mungagwiritse ntchito kupeza. Kukangana kupeza-wogwiritsa angagwiritsidwe ntchito pazifukwa izi. Mwachitsanzo, lamulo lotsatirali limatchula mafayilo onse omwe ali ndi linda:

find / -user linda

Muthanso kugwiritsa ntchito kupeza kufufuza mafayilo omwe ali ndi gulu linalake monga eni ake.

Mwachitsanzo, lamulo lotsatirali limafufuza mafayilo onse a gululo owerenga:

find / -group users

Kusintha kwa eni ake

Kuti mugwiritse ntchito zilolezo zoyenera, chinthu choyamba choyenera kuganizira ndi umwini. Pali lamulo pa izi chown. Mafotokozedwe a lamuloli ndi osavuta kumva:

chown кто что

Mwachitsanzo, lamulo lotsatirali limasintha mwini wake wa /home/account directory kukhala linda wosuta:

chown linda /home/account

timu chown ili ndi zosankha zingapo, imodzi yomwe ili yothandiza kwambiri: -R. Mutha kulingalira zomwe zimachita chifukwa njirayi iliponso pamalamulo ena ambiri. Izi zimakulolani kuti mukhazikitse mwiniwake mobwerezabwereza, zomwe zimakulolani kuti muyike mwiniwake wa bukhuli ndi chirichonse chomwe chili pansipa. Lamulo lotsatirali likusintha umwini wa / home directory ndi chilichonse chomwe chili pansipa kwa wogwiritsa ntchito linda:

Tsopano eni ake akuwoneka motere:

[root@localhost ~]# ls -l /home
total 0
drwx------. 2 account account 62 Sep 25 21:41 account
drwx------. 2 lisa    lisa    62 Sep 25 21:42 lisa

Tiyeni tichite:

[root@localhost ~]# chown -R lisa /home/account
[root@localhost ~]#

Tsopano wogwiritsa ntchito lisa wakhala mwini wa chikwatu cha akaunti:

[root@localhost ~]# ls -l /home
total 0
drwx------. 2 lisa account 62 Sep 25 21:41 account
drwx------. 2 lisa lisa    62 Sep 25 21:42 lisa

Sinthani mwini gulu

Pali njira ziwiri zosinthira umwini wa gulu. Mutha kuchita izi pogwiritsa ntchito chown, koma pali lamulo lapadera lotchedwa chgrpizo zimagwira ntchito. Ngati mukufuna kugwiritsa ntchito lamulo chown, ntchito . kapena : pamaso pa gulu dzina.

Lamulo lotsatirali limasintha eni ake a /nyumba/akaunti gulu kukhala gulu la akaunti:

chown .account /home/account

mutha kugwiritsa ntchito chown kusintha mwiniwake wa wogwiritsa ntchito ndi/kapena gulu m'njira zingapo. Nazi zitsanzo:

• chown lisa myfile1 imayika wosuta lisa ngati mwini wa myfile1.
• chown lisa.sales myfile imayika wogwiritsa ntchito lisa kukhala mwini wa fayilo ya myfile, ndikuyikanso gulu logulitsa ngati eni ake a fayilo yomweyo.
• chown lisa:sales myfile chimodzimodzi ndi timu yapitayi.
• chown .sales myfile Imakhazikitsa gulu logulitsa kukhala eni ake a myfile popanda kusintha eni ake.
• chown :sales myfile chimodzimodzi ndi timu yapitayi.

Mutha kugwiritsa ntchito lamulo chgrpkusintha mwini gulu. Talingalirani chitsanzo chotsatirachi, pamene mungagwiritse ntchito chgrp Khazikitsani eni ake chikwatu cha akaunti kugulu lazogulitsa:

chgrp .sales /home/account

Monga ndi chown, mungagwiritse ntchito njira -R с chgrp, komanso kusintha mobwerezabwereza mwini wa gululo.

Kumvetsetsa Mwini Wosakhazikika

Mwina mwazindikira kuti wogwiritsa ntchito akapanga fayilo, umwini wokhazikika umagwiritsidwa ntchito.
Wogwiritsa ntchito yemwe amapanga fayiloyo amakhala mwini wake wa fayiloyo, ndipo gulu lalikulu la wosuta limakhala mwini wake wa fayiloyo. Ili ndilo gulu lomwe lalembedwa mu fayilo /etc/passwd monga gulu loyamba la wosuta. Komabe, ngati wogwiritsa ntchitoyo ndi membala wamagulu angapo, wogwiritsa ntchito amatha kusintha gulu loyambirira logwira ntchito.

Kuti muwonetse gulu loyambirira lomwe likugwira ntchito, wogwiritsa ntchito angagwiritse ntchito lamulo magulu:

[root@server1 ~]# groups lisa
lisa : lisa account sales

Ngati wogwiritsa ntchito linda wapano akufuna kusintha gulu loyambirira logwira ntchito, adzagwiritsa ntchito lamulo chatsopanokutsatiridwa ndi dzina la gulu lomwe akufuna kuti likhale gulu loyamba logwira ntchito. Pambuyo pogwiritsa ntchito lamulo chatsopano gulu loyambirira lidzakhala logwira ntchito mpaka wogwiritsa ntchito alowetsa lamulo Potulukira kapena sadzatuluka mu dongosolo.

Zotsatirazi zikuwonetsa momwe linda amagwiritsira ntchito lamuloli, ndikugulitsa ngati gulu loyambirira:

lisa@server1 ~]$ groups
lisa account sales
[lisa@server1 ~]$ newgrp sales
[lisa@server1 ~]$ groups
sales lisa account
[lisa@server1 ~]$ touch file1
[lisa@server1 ~]$ ls -l
total 0
-rw-r--r--. 1 lisa sales 0 Feb 6 10:06 file1

Mukasintha gulu loyamba lothandiza, mafayilo onse atsopano opangidwa ndi wogwiritsa ntchitowo adzakhala ndi gululo ngati eni ake a gulu. Kuti mubwerere ku zochunira zoyambira zamagulu, gwiritsani ntchito Potulukira.

Kuti athe kugwiritsa ntchito lamulo chatsopano, wogwiritsa ntchitoyo ayenera kukhala membala wa gulu lomwe akufuna kugwiritsa ntchito ngati gulu loyamba. Kuphatikiza apo, mawu achinsinsi a gulu angagwiritsidwe ntchito pagulu pogwiritsa ntchito lamulo magwire. Ngati wosuta agwiritsa ntchito lamulo chatsopanokoma si membala wa gulu lomwe mukufuna, chipolopolocho chimayambitsa mawu achinsinsi a gululo. Mukalowetsa mawu achinsinsi olondola a gulu, gulu latsopano lothandiza lidzakhazikitsidwa.

Kasamalidwe ka ufulu wachibadwidwe

Dongosolo la chilolezo cha Linux linapangidwa mu 1970s. Popeza kuti zosoŵa zamakompyuta zinali zochepa m’zaka zimenezo, dongosolo lachilolezo lofunikira linali lochepa. Dongosolo lachilolezoli limagwiritsa ntchito zilolezo zitatu zomwe zingagwiritsidwe ntchito pamafayilo ndi maulalo. Mugawoli, muphunzira momwe mungagwiritsire ntchito ndikusintha zilolezozi.

Kumvetsetsa Kuwerenga, Kulemba, ndi Kupereka Zilolezo

Zilolezo zazikulu zitatu zimakupatsani mwayi wowerenga, kulemba, ndikuchita mafayilo. Zotsatira za zilolezozi zimasiyana zikagwiritsidwa ntchito pamafayilo kapena maulalo. Mukagwiritsidwa ntchito ku fayilo, chilolezo chowerenga chimakupatsani ufulu wotsegula fayilo kuti muwerenge. Chifukwa chake, mutha kuwerenga zomwe zili mkati mwake, koma izi zikutanthauza kuti kompyuta yanu imatha kutsegula fayiloyo kuti muchitepo kanthu nayo.

Fayilo ya pulogalamu yomwe ikufunika kupita ku laibulale iyenera, mwachitsanzo, kukhala ndi mwayi wowerenga laibulaleyo. Izi zikutsatira kuti chilolezo chowerengera ndiye chilolezo chofunikira kwambiri chomwe mungafune kuti mugwiritse ntchito mafayilo.

Mukagwiritsidwa ntchito m'ndandanda, kuwerenga kumakupatsani mwayi wowonetsa zomwe zili mu bukhulo. Muyenera kudziwa kuti chilolezochi sichikulolani kuti muwerenge mafayilo omwe ali mu bukhuli. Dongosolo la chilolezo cha Linux silidziwa cholowa, ndipo njira yokhayo yowerengera fayilo ndikugwiritsa ntchito zilolezo zowerengera pafayiloyo.

Monga momwe mungaganizire, chilolezo cholembera, ngati chikugwiritsidwa ntchito pafayilo, chimalola kulemba ku fayilo. Mwanjira ina, imakupatsani mwayi wosintha zomwe zili m'mafayilo omwe alipo. Komabe, sikukulolani kupanga kapena kuchotsa mafayilo atsopano kapena kusintha zilolezo za fayilo. Kuti muchite izi, muyenera kupereka chilolezo cholembera ku chikwatu chomwe mukufuna kupanga fayilo. M'mayilo, chilolezochi chimakupatsaninso mwayi wopanga ndikuchotsa ma subdirectories atsopano.

Perekani chilolezo ndizomwe mukufunikira kuti mugwiritse ntchito fayilo. Sichidzakhazikitsidwa mwachisawawa, zomwe zimapangitsa Linux kukhala yotetezeka kwathunthu ku ma virus. Ndi munthu yekhayo amene ali ndi zilolezo zolembera pa chikwatu chomwe angalembetse chilolezocho.

Zotsatirazi zikufotokozera mwachidule kugwiritsa ntchito zilolezo zoyambira:

Kugwiritsa ntchito chmod

Lamuloli limagwiritsidwa ntchito kuyang'anira zilolezo. chmod... Kugwiritsa chmod mutha kukhazikitsa zilolezo kwa wogwiritsa ntchito (wogwiritsa), magulu (gulu) ndi ena (ena). Mutha kugwiritsa ntchito lamuloli m'njira ziwiri: wachibale komanso modem mtheradi. Mumtheradi, manambala atatu amagwiritsidwa ntchito kukhazikitsa zilolezo zoyambira.

Mukakhazikitsa zilolezo, werengerani mtengo womwe mukufuna. Ngati mukufuna kukhazikitsa kuwerenga / kulemba / kuchita kwa wosuta, werengani / perekani gulu, ndikuwerengera / kuchitira ena mu / somefile ndiye mumagwiritsa ntchito lamulo ili. chmod:

chmod 755 /somefile

Mukamagwiritsa ntchito chmod mwanjira iyi, zilolezo zonse zapano zimasinthidwa ndi zilolezo zomwe mwakhazikitsa.

Ngati mukufuna kusintha zilolezo zokhudzana ndi zilolezo zomwe zilipo, mutha kugwiritsa ntchito chmod munjira yofananira. Kugwiritsa chmod munjira yachibale mumagwira ntchito ndi zizindikiro zitatu kuwonetsa zomwe mukufuna kuchita:

1. Choyamba mumatchula yemwe mukufuna kusintha zilolezo. Kuti muchite izi, mutha kusankha pakati pa wogwiritsa (u), gulu (g) ndi ena (o).
2. Kenako mumagwiritsa ntchito mawu kuti muwonjezere kapena kuchotsa zilolezo pamachitidwe apano, kapena kuziyika mwamtheradi.
3. Pomaliza mumagwiritsa ntchito r, w и xkuti mufotokoze zilolezo zomwe mukufuna kukhazikitsa.

Mukasintha zilolezo mumayendedwe achibale, mutha kudumpha "ku" gawo kuti muwonjezere kapena kuchotsa chilolezo pazinthu zonse. Mwachitsanzo, lamulo ili likuwonjezera chilolezo kwa ogwiritsa ntchito onse:

chmod +x somefile

Mukamagwira ntchito molingana, mutha kugwiritsanso ntchito malamulo ovuta kwambiri. Mwachitsanzo, lamulo ili likuwonjezera chilolezo cholembera ku gulu ndikuchotsa chilolezo chowerenga kwa ena:

chmod g+w,o-r somefile

Mukamagwiritsa ntchito chmod -R o+rx /data mumayika chilolezo chopereka zilolezo zonse komanso mafayilo omwe ali mu /data directory. Kuti muyike chilolezo chopereka pazowongolera zokha osati mafayilo, gwiritsani ntchito chmod -R o+ rX /data.

Cholemba chachikulu X chimatsimikizira kuti mafayilo sapatsidwa chilolezo pokhapokha ngati fayiloyo yakhazikitsa kale chilolezo chazinthu zina. Izi zimapangitsa X kukhala njira yanzeru yothanirana ndi zilolezo; izi zipewa kuyika chilolezochi pamafayilo pomwe sichikufunika.

Ufulu wowonjezedwa

Kuphatikiza pa zilolezo zoyambira zomwe mwawerenga, Linux ilinso ndi zilolezo zapamwamba. Izi si zilolezo zomwe mumayika mwachisawawa, koma nthawi zina zimapereka zowonjezera zothandiza. Mu gawo ili, muphunzira zomwe iwo ali ndi momwe mungawakhazikitsire.

Kumvetsetsa SUID, GUID, ndi Sticky Bit Zowonjezera Zilolezo

Pali zilolezo zitatu zapamwamba. Choyamba mwa izi ndi chilolezo chokhazikitsa chizindikiritso cha ogwiritsa (SUID). Nthawi zina zapadera, mutha kugwiritsa ntchito chilolezochi pamafayilo omwe angathe kuchitidwa. Mwachikhazikitso, wogwiritsa ntchito yemwe amatha kuwongolera amayendetsa fayiloyo ndi zilolezo zawo.

Kwa ogwiritsa ntchito wamba, izi nthawi zambiri zimatanthawuza kuti kugwiritsa ntchito pulogalamuyi kumakhala kochepa. Komabe, nthawi zina, wogwiritsa ntchito amafunikira zilolezo zapadera, kuti agwire ntchito inayake.

Mwachitsanzo, taganizirani nthawi yomwe wogwiritsa ntchito ayenera kusintha mawu ake achinsinsi. Kuti achite izi, wogwiritsa ntchitoyo ayenera kulemba mawu ake achinsinsi ku fayilo /etc/shadow. Komabe, fayiloyi simalembedwa ndi osagwiritsa ntchito mizu:

root@hnl ~]# ls -l /etc/shadow
----------. 1 root root 1184 Apr 30 16:54 /etc/shadow

Chilolezo cha SUID chimapereka yankho ku vutoli. Pulogalamu ya /usr/bin/passwd imagwiritsa ntchito chilolezochi mwachisawawa. Izi zikutanthauza kuti posintha mawu achinsinsi, wogwiritsa ntchitoyo amakhala muzu kwakanthawi, zomwe zimamulola kuti alembe ku fayilo ya /etc/shadow. Mutha kuwona chilolezo cha SUID ndi ls -l momwe s m'malo omwe mumayembekezera kuwona x zilolezo zamwambo:

[root@hnl ~]# ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 32680 Jan 28 2010 /usr/bin/passwd

Chilolezo cha SUID chikhoza kuwoneka chothandiza (ndipo nthawi zina chimakhala), koma nthawi yomweyo chimakhala chowopsa. Ngati sichinagwiritsidwe bwino, mutha kupereka mwangozi zilolezo za mizu. Choncho, ndikupangira kugwiritsa ntchito kokha mosamala kwambiri.

Oyang'anira ambiri sadzasowa kugwiritsa ntchito; mudzaziwona m'mafayilo ena pomwe makina ogwiritsira ntchito ayenera kuyiyika mwachisawawa.

Chilolezo chachiwiri chapadera ndi chozindikiritsa gulu (SGID). Chilolezochi chili ndi zotsatira ziwiri. Ikagwiritsidwa ntchito ku fayilo yotheka, imapatsa wogwiritsa ntchito fayiloyo chilolezo cha eni ake gulu. Chifukwa chake SGID imatha kuchita zambiri kapena zochepa zomwezo monga SUID. Komabe, SGID sichigwiritsidwa ntchito pazifukwa izi.

Monga ndi chilolezo cha SUID, SGID imagwiritsidwa ntchito pamafayilo ena amtundu ngati makonda.

Mukagwiritsidwa ntchito ku bukhu, SGID ikhoza kukhala yothandiza chifukwa mungagwiritse ntchito kukhazikitsa eni ake a gulu la mafayilo ndi ma subdirectories opangidwa mu bukhuli. Mwachikhazikitso, wogwiritsa ntchito akapanga fayilo, gulu lawo loyamba logwira mtima limayikidwa ngati mwini gulu la fayiloyo.

Izi sizothandiza nthawi zonse, makamaka popeza ogwiritsa ntchito a Red Hat / CentOS ali ndi gulu lawo loyambirira lokhazikitsidwa ku gulu lomwe lili ndi dzina lofanana ndi wogwiritsa ntchito, ndipo omwe wogwiritsa ntchitoyo ndi membala yekhayo. Chifukwa chake, mwachisawawa, mafayilo omwe wogwiritsa ntchito amapanga adzagawidwa mochulukira.

Ingoganizirani momwe ogwiritsa ntchito linda ndi lori amagwira ntchito yowerengera ndalama ndipo ali mgulu nkhani. Mwachisawawa, ogwiritsa ntchitowa ndi mamembala a gulu lachinsinsi lomwe ndi mamembala okhawo. Komabe, onse ogwiritsa ntchito ndi mamembala a gulu la akaunti, komanso ngati gawo lachiwiri la gulu.

Zosasintha ndizoti aliyense wa ogwiritsa ntchitowa akapanga fayilo, gulu loyambirira limakhala eni ake. Chifukwa chake, mwachisawawa, linda sangathe kupeza mafayilo opangidwa ndi lori, ndi mosemphanitsa. Komabe, ngati mupanga chikwatu chamagulu omwe amagawana nawo (nenani / magulu / akaunti) ndikuwonetsetsa kuti chilolezo cha SGID chikugwiritsidwa ntchito pa bukhuli komanso kuti akaunti ya gulu yakhazikitsidwa ngati mwini wa gulu la bukhulo, mafayilo onse opangidwa mu bukhuli ndi zonse. m'magawo ake ang'onoang'ono, pezaninso akaunti yamagulu ngati eni ake agulu mwachisawawa.

Pachifukwa ichi, chilolezo cha SGID ndi chilolezo chothandiza kwambiri kuti muyike pamagulu amagulu a anthu.

Chilolezo cha SGID chikuwonetsedwa pazotuluka ls -l momwe s pamalo pomwe mungapeze chilolezo chochitira gulu:

[root@hnl data]# ls -ld account
drwxr-sr-x. 2 root account 4096 Apr 30 21:28 account

Chachitatu cha zilolezo zapadera ndi chomata pang'ono. Chilolezochi ndi chothandiza poteteza mafayilo kuti asafufutidwe mwangozi pamalo pomwe ogwiritsa ntchito angapo amatha kulemba chikwatu chomwechi. Ngati chomata chikugwiritsidwa ntchito, wosuta akhoza kungochotsa fayilo ngati ali eni ake a fayilo kapena chikwatu chomwe chili ndi fayiloyo. Pazifukwa izi, imagwiritsidwa ntchito ngati chilolezo chokhazikika pa /tmp directory ndipo ikhoza kukhala yothandizanso pamawu agulu agulu.

Popanda chomata pang'ono, ngati wosuta atha kupanga mafayilo mu bukhu, amathanso kufufuta mafayilo mu bukhuli. Pagulu la anthu izi zitha kukhala zokwiyitsa. Ingoganizirani ogwiritsa ntchito linda ndi lori, omwe onse ali ndi zilolezo zolembera ku /data/akaunti chikwatu ndikupeza zilolezo kudzera mwa umembala mu gulu la akaunti. Chifukwa chake, linda amatha kufufuta mafayilo opangidwa ndi lori, ndi mosemphanitsa.

Mukayika chomata, wogwiritsa ntchito amatha kufufuta mafayilo ngati chimodzi mwazinthu izi ndi zoona:

• Wogwiritsa ndiye mwini wa fayilo;
• Wogwiritsa ndi mwiniwake wa chikwatu chomwe fayilo ili.

Mukamagwiritsa ntchito ls -l, mutha kuwona zomata ngati t m'malo omwe nthawi zambiri mumawona chilolezo chochitira ena:

[root@hnl data]# ls -ld account/
drwxr-sr-t. 2 root account 4096 Apr 30 21:28 account/

Kugwiritsa ntchito maufulu owonjezera

Kuti mugwiritse ntchito SUID, SGID ndi zomata pang'ono mutha kugwiritsanso ntchito chmod. SUID ili ndi nambala ya 4, SGID ili ndi nambala ya 2, ndipo chomata chili ndi nambala ya 1.

Ngati mukufuna kugwiritsa ntchito zilolezozi, muyenera kuwonjezera mitsutso inayi chmod, omwe nambala yake yoyamba imatanthawuza zilolezo zapadera. Mzere wotsatirawu, mwachitsanzo, uwonjezera chilolezo cha SGID ku bukhu ndikuyika rwx kwa wosuta ndi rx kwa gulu ndi ena:

chmod 2755 /somedir

Izi sizothandiza ngati mukufuna kuwona zilolezo zomwe zakhazikitsidwa musanagwiritse ntchito chmod mumtheradi mode. (Mumakhala pachiwopsezo cholemba zilolezo ngati simutero.) Chifukwa chake ndikupangira kuti muthamangire munjira yachibale ngati mukufuna kugwiritsa ntchito zilolezo zapadera:

1. Kuti mugwiritse ntchito SUID chmod u+s.
2. Kuti mugwiritse ntchito SGID chmod g+s.
3. Kuti mugwiritse ntchito chomata chmod +t, kutsatiridwa ndi dzina la fayilo kapena chikwatu chomwe mukufuna kuyika zilolezo.

Gomelo likufotokozera mwachidule zonse zomwe muyenera kudziwa zokhudza kuyang'anira zilolezo zapadera.

Chitsanzo cha kugwira ntchito ndi ufulu wapadera

Muchitsanzo ichi, mumagwiritsa ntchito zilolezo zapadera kuti zikhale zosavuta kuti mamembala agawane mafayilo muzolemba zamagulu omwe amagawana nawo. Mumagawira kachidutswa ka ID ku ID ya gulu lokhazikika komanso chomata, ndipo mukuwona kuti zikakhazikitsidwa, mawonekedwe amawonjezedwa kuti zikhale zosavuta kuti mamembala agwire ntchito limodzi.

1. Tsegulani terminal pomwe ndinu wogwiritsa ntchito linda. Mutha kupanga wosuta ndi lamulo gwiritsani ntchito linda, onjezani mawu achinsinsi pa linda.
2. Pangani / data directory muzu ndi /data/sales subdirectory ndi lamulo mkdir -p /data/sales. Malizitsani cd /data/saleskupita ku zolembera zogulitsa. Malizitsani kukhudza linda1 и kukhudza linda2kupanga mafayilo awiri opanda kanthu a linda.
3. Pangani su-lisa kusintha wogwiritsa ntchito panopa kwa wogwiritsa ntchito lisa, yemwenso ali membala wa gulu la malonda.
4. Pangani cd /data/sales ndikuchita kuchokera mu bukhuli ls -l. Mudzawona mafayilo awiri omwe adapangidwa ndi wogwiritsa ntchito linda ndipo ali m'gulu la linda. Malizitsani rm -f linda*. Izi zichotsa mafayilo onse awiri.
5. Pangani kukhudza lisa1 и kukhudza lisa2kupanga mafayilo awiri omwe ali ndi lisa.
6. Pangani su - kukulitsa mwayi wanu kuti muzule.
7. Pangani chmod g+s,o+t /data/saleskukhazikitsa gulu lozindikiritsa (GUID) pang'ono komanso chomata mu bukhu logawana nawo gulu.
8. Pangani su-linda. Ndiye chitani kukhudza linda3 и kukhudza linda4. Tsopano muyenera kuwona kuti mafayilo awiri omwe mudapanga ndi a gulu lazogulitsa, lomwe ndi mwini gulu la /data/sales directory.
9. Pangani rm -rf lisa*. Chomatacho chimalepheretsa mafayilowa kuti achotsedwe m'malo mwa wogwiritsa ntchito linda, popeza sindinu eni mafayilowa. Zindikirani kuti ngati wogwiritsa ntchito linda ndiye mwini wake / data/sales directory, akhoza kuchotsa mafayilowa mulimonse!

Kuwongolera kwa ACL (setfacl, getfacl) mu Linux

Ngakhale zilolezo zomwe zafotokozedwa pamwambapa zikuwonjezera magwiridwe antchito momwe Linux imagwirira ntchito zilolezo, sizikulolani kuti mupereke zilolezo kwa ogwiritsa ntchito kapena gulu limodzi pafayilo yomweyo.

Mndandanda wa zowongolera zopezeka zimapereka izi. Kuphatikiza apo, amalola olamulira kukhazikitsa zilolezo zosasinthika m'njira yovuta, pomwe zilolezo zokhazikitsidwa zimatha kusiyanasiyana kuchokera ku bukhu kupita ku bukhu.

Kumvetsetsa ACLs

Ngakhale subsystem ya ACL imawonjezera magwiridwe antchito ku seva yanu, ili ndi vuto limodzi: sizinthu zonse zomwe zimathandizira. Choncho, mukhoza kutaya ACL zoikamo pamene inu kukopera kapena kusuntha owona, ndi zosunga zobwezeretsera mapulogalamu anu angalephere kumbuyo ACL zoikamo.

The phula utility sichigwirizana ndi ACLs. Kuonetsetsa kuti ACL zoikamo sanataye polenga zosunga zobwezeretsera, ntchito nyenyezi m'malo mwa phula. nyenyezi amagwira ntchito ndi njira zomwezo monga phula; imangowonjezera chithandizo cha zoikamo za ACL.

Mukhozanso kusunga ACLs ndi getfacl, yomwe ikhoza kubwezeretsedwanso pogwiritsa ntchito lamulo la setfacl. Kuti mupange zosunga zobwezeretsera, gwiritsani ntchito getfacl -R /directory> file.acls. Kuti mubwezeretse zosintha kuchokera ku fayilo yosunga zobwezeretsera, gwiritsani ntchito setfacl --restore=file.acl.

Kupanda chithandizo ndi zida zina sikuyenera kukhala vuto. Ma ACL nthawi zambiri amagwiritsidwa ntchito pazikwatu ngati njira yosinthira m'malo mwa mafayilo.
Chifukwa chake, sipadzakhala ambiri aiwo, koma ochepa okha, omwe amagwiritsidwa ntchito m'malo anzeru pamafayilo. Chifukwa chake, kubwezeretsa ma ACL oyambirira omwe mudagwira nawo ntchito ndikosavuta, ngakhale pulogalamu yanu yosunga zobwezeretsera siyigwirizana nawo.

Kukonzekera fayilo ya ACLs

Musanayambe ntchito ndi ACLs, mungafunike kukonzekera wapamwamba dongosolo kuthandiza ACLs. Chifukwa metadata yamafayilo iyenera kukulitsidwa, sinthawi zonse kumathandizira ma ACL mu fayilo yamafayilo. Ngati inu kupeza "ntchito si anathandiza" uthenga pamene khwekhwe ACLs kwa wapamwamba dongosolo, wanu wapamwamba dongosolo mwina kugwirizana ACLs.

Kuti mukonze izi muyenera kuwonjezera njira acl phiri mu /etc/fstab kotero kuti mafayilo apangidwe ndi chithandizo cha ACL mwachisawawa.

Kusintha ndikuwona makonda a ACL ndi setfacl ndi getfacl

Kukhazikitsa ACL muyenera lamulo zochita. Kuti muwone zokonda za ACL zomwe mukufuna getfacl. Gulu ls -l sichiwonetsa ma ACL omwe alipo; zimangowonetsa + pambuyo pa mndandanda wa chilolezo, zomwe zikuwonetsa kuti ma ACL amagwiranso ntchito ku fayilo.

Musanakhazikitse ma ACL, nthawi zonse ndi bwino kuwonetsa zokonda za ACL ndi getfacl. Muchitsanzo chomwe chili pansipa, mutha kuwona zilolezo zomwe zilipo, monga zikuwonetsedwa ndi ls -l, komanso monga zikuwonetsedwa ndi getfacl. Ngati muyang'anitsitsa mokwanira, mudzawona kuti zomwe zikuwonetsedwa ndizofanana ndendende.

[root@server1 /]# ls -ld /dir
drwxr-xr-x. 2 root root 6 Feb 6 11:28 /dir
[root@server1 /]# getfacl /dir
getfacl: Removing leading '/' from absolute path names
# file: dir
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

Chifukwa chotsatira lamulo getfacl pansipa mutha kuwona kuti zilolezo zikuwonetsedwa pazinthu zitatu zosiyana: wogwiritsa ntchito, gulu ndi zina. Tsopano tiyeni tiwonjezere ACL kuti tiwerenge ndikupereka zilolezo ku gulu lazogulitsa. lamula izi setfacl -mg: malonda:rx /dir. Mu timuyi -m zikusonyeza kuti zoikamo panopa ACL ayenera kusinthidwa. Pambuyo pake g:zogulitsa:rx amauza lamulo kuti akhazikitse kuwerenga-kuchita ACL (rx) kwa gulu (g) malonda. Pansipa mukhoza kuwona momwe lamulo likuwonekera, komanso zotsatira za getfacl lamulo mutatha kusintha makonda a ACL.

[root@server1 /]# setfacl -m g:sales:rx /dir
[root@server1 /]# getfacl /dir
getfacl: Removing leading '/' from absolute path names
# file: dir
# owner: root
# group: root
user::rwx
group::r-x
group:sales:r-x
mask::r-x
other::r-x

Tsopano popeza mwamvetsetsa momwe mungakhazikitsire gulu la ACL, ndizosavuta kumvetsetsa ma ACL kwa ogwiritsa ntchito ndi ogwiritsa ntchito ena. Mwachitsanzo, lamulo setfacl -mu:linda:rwx /data amapereka zilolezo kwa wosuta linda mu / data directory popanda kumupanga iye mwini kapena kusintha ntchito ya eni ake.

timu zochita ili ndi zambiri komanso zosankha. Njira imodzi ndiyofunikira kwambiri, parameter -R. Ngati ntchito, njira imapangitsa ACL kukhala owona onse ndi subdirectories kuti panopa mu kalozera kumene inu anapereka ACL. Ndibwino kuti nthawi zonse mugwiritse ntchito njirayi posintha ma ACL pamakanema omwe alipo.

Kugwira ntchito ndi Default ACLs

Ubwino umodzi wogwiritsa ntchito ma ACL ndikuti mutha kupatsa zilolezo kwa ogwiritsa ntchito angapo kapena magulu pamndandanda. Phindu lina ndikuti mutha kuloleza cholowa pogwira ntchito ndi ma ACL osasintha.

Pokhazikitsa ACL yokhazikika, mumazindikira zilolezo zomwe zidzakhazikitsidwe kwa zinthu zonse zatsopano zomwe zapangidwa m'ndandanda. Dziwani kuti ACL yosasinthika sisintha zilolezo pamafayilo omwe alipo ndi ma subdirectories. Kuti muwasinthe, muyenera kuwonjezeranso ACL yabwinobwino!

Izi ndizofunikira kudziwa. Ngati mukufuna kugwiritsa ntchito ACL kuti sintha owerenga angapo kapena magulu kupeza chikwatu chomwecho, muyenera kukhazikitsa ACL kawiri. Kugwiritsa ntchito koyamba setfacl -R -mkusintha ACL kwa owona panopa. Ndiye ntchito setfacl -md:kusamalira zinthu zonse zatsopano zomwe zidzapangidwanso.

Kukhazikitsa ACL kusakhulupirika inu muyenera kuwonjezera njira d pambuyo posankha -m (kulamula ndikofunikira!). Choncho ntchito setfacl -md:g:sales:rx /datangati mukufuna kugulitsa gulu kuti muwerenge ndikuchita chilichonse chomwe chapangidwa mu /data directory.

Mukamagwiritsa ntchito ma ACL osasintha, zitha kukhala zothandiza kukhazikitsa ma ACL kwa ena. Izi nthawi zambiri sizikhala zomveka chifukwa mutha kusinthanso zilolezo za ena ogwiritsa ntchito chmod. Komabe, zomwe simungathe kuchita nazo chmod, ndikutchula ufulu womwe uyenera kuperekedwa kwa ogwiritsa ntchito ena pa fayilo iliyonse yatsopano yomwe yapangidwa. Ngati mukufuna kuletsa ena kupeza zilolezo pa chilichonse chomwe chapangidwa mu /data mwachitsanzo kugwiritsa ntchito setfacl -md:o::- /data.

Ma ACL ndi zilolezo zabwinobwino sizimaphatikizidwa bwino nthawi zonse. Mavuto angabwere ngati mutagwiritsa ntchito ACL yosasintha ku bukhu, ndiye kuti zinthuzo zikuwonjezedwa ku bukhuli, ndiyeno yesetsani kusintha zilolezo zovomerezeka. Zosintha zomwe zikugwirizana ndi zilolezo zanthawi zonse siziwoneka bwino muzowonera za ACL. Kuti mupewe mavuto, ikani zilolezo zanthawi zonse, kenako ikani ma ACL osasintha (ndipo yesetsani kuti musawasinthe pambuyo pake).

Chitsanzo cha kuyang'anira maufulu owonjezera pogwiritsa ntchito ma ACL

Muchitsanzo ichi, mupitiliza ndi /data/account ndi /data/sales directories omwe mudapanga kale. M'zitsanzo zam'mbuyomu, mudawonetsetsa kuti gulu logulitsa lili ndi zilolezo pa /data/zogulitsa ndipo gulu la akaunti lili ndi zilolezo pa /data/account.

Choyamba, onetsetsani kuti gulu la akaunti likulandira zilolezo zowerengera pa /data/zogulitsa zogulitsa ndipo gulu lazogulitsa limapeza zilolezo zowerengedwa pa /data/account directory.

Kenako mumakhazikitsa ma ACL osasinthika kuti muwonetsetse kuti mafayilo onse atsopano ali ndi zilolezo zolondola zokhazikitsidwa pazinthu zonse zatsopano.

1. Tsegulani potherapo.
2. Pangani setfacl -mg:akaunti:rx /data/sales и setfacl -mg: sales:rx /data/account.
3. Pangani getfaclkuonetsetsa kuti zilolezo zakhazikitsidwa momwe mukufunira.
4. Pangani setfacl -md:g:akaunti:rwx,g:zogulitsa:rx /data/zogulitsakuti muyike ACL yosasinthika ya bukhu la malonda.
5. Onjezani ACL yosasinthika pa /data/account directory pogwiritsa ntchito setfacl -md:g:sales:rwx,g:account:rx /data/account.
6. Onetsetsani kuti makonda a ACL akugwira ntchito powonjezera fayilo yatsopano ku /data/sales. Malizitsani touch /data/sales/newfile ndi kuchitira getfacl /data/sales/newfile kuti muwone zilolezo zamakono.

Kukhazikitsa zilolezo zokhazikika ndi umask

Pamwambapa, mwaphunzira momwe mungagwiritsire ntchito ma ACL osasintha. Ngati simukugwiritsa ntchito ACL, pali njira yachipolopolo yomwe imatsimikizira zilolezo zomwe mungapeze: umask (maski obwerera). Mugawoli, muphunzira momwe mungasinthire zilolezo zosasinthika ndi umask.

Mwina mwazindikira kuti mukapanga fayilo yatsopano, zilolezo zina zokhazikika zimayikidwa. Zilolezo izi zimatsimikiziridwa ndi zoikamo umask. Kukonzekera kwa chipolopolochi kumagwira ntchito kwa onse ogwiritsa ntchito pa logon. Mu parameter umask chiwerengero cha chiwerengero chimagwiritsidwa ntchito, chomwe chimachotsedwa pazilolezo zazikulu zomwe zingathe kukhazikitsidwa pa fayilo; Kukhazikitsa kwakukulu kwamafayilo ndi 666 ndipo pazowongolera ndi 777.

Komabe, pali zina zomwe zimagwira ntchito pa lamuloli. Mutha kupeza chiwongolero chonse cha zokonda umask mu tebulo ili m'munsimu.

Pa manambala omwe amagwiritsidwa ntchito mu umask, monga momwe zilili ndi zifukwa zowerengera manambala a lamulo chmod, manambala oyamba amatanthauza zilolezo za wogwiritsa ntchito, nambala yachiwiri imanena za zilolezo za gulu, ndipo yomaliza imanena za zilolezo zokhazikitsidwa kwa ena. Tanthauzo umask 022 yokhazikika imapereka 644 pamafayilo onse atsopano ndi 755 pamakanema atsopano opangidwa pa seva yanu.

Kufotokozera mwachidule kwa manambala onse umask ndi zotsatira zake mu tebulo ili m'munsimu.

Njira yosavuta yowonera momwe mawonekedwe a umask amagwirira ntchito ndi motere: yambani ndi zilolezo zosasinthika za fayilo zomwe zakhazikitsidwa ku 666 ndikuchotsani umask kuti mupeze zilolezo zogwira mtima. Chitani zomwezo pa bukhuli ndi zilolezo zake zosasinthika za 777.

Pali njira ziwiri zosinthira umask: kwa ogwiritsa ntchito onse komanso kwa ogwiritsa ntchito payekha. Ngati mukufuna kuyika umask kwa ogwiritsa ntchito onse, muyenera kuonetsetsa kuti umask imaganiziridwa poyambitsa mafayilo a chilengedwe cha zipolopolo, monga momwe tafotokozera mu /etc/profile. Njira yolondola ndiyo kupanga chipolopolo chotchedwa umask.sh mu bukhu la /etc/profile.d ndipo tchulani umask womwe mukufuna kugwiritsa ntchito mu chipolopolocho. Ngati umask wasinthidwa mu fayiloyi, umagwiritsidwa ntchito kwa ogwiritsa ntchito onse atatha kulowa mu seva.

Njira ina yokhazikitsira umask kudzera / etc / mbiri ndi mafayilo okhudzana, kumene ikugwiritsidwa ntchito kwa ogwiritsa ntchito onse omwe amalowa, ndikusintha makonzedwe a umask mu fayilo yotchedwa .profile yomwe imapangidwa m'ndandanda wa kunyumba kwa aliyense.

Zokonda zomwe zili mufayiloyi zimagwira ntchito kwa wogwiritsa ntchito payekha; chifukwa chake iyi ndi njira yabwino ngati mukufuna zambiri. Ineyo pandekha ndimakonda gawoli kuti ndisinthe umask wosasinthika kwa wogwiritsa ntchito mizu kukhala 027 pomwe ogwiritsa ntchito wamba akuyenda ndi umask wosasintha wa 022.

Kugwira ntchito ndi mawonekedwe owonjezera ogwiritsa ntchito

Ili ndiye gawo lomaliza la zilolezo za Linux.

Mukamagwira ntchito ndi zilolezo, nthawi zonse pamakhala ubale pakati pa wogwiritsa ntchito kapena gulu ndi zilolezo zomwe ogwiritsa ntchito kapena gulu ali nazo pafayilo kapena chikwatu. Njira ina yotetezera mafayilo pa seva ya Linux ndikugwira ntchito ndi mawonekedwe.
Makhalidwe amachita ntchito yawo mosasamala kanthu kuti wogwiritsa ntchito akupeza fayilo.

Monga ndi ma ACL, mawonekedwe a fayilo angafunike kuphatikiza kusankha Phiri.

Iyi ndi njira wosuta_xattr. Ngati mupeza uthenga wa "operation not support" mukamagwira ntchito ndi mawonekedwe owonjezera, onetsetsani kuti mwakhazikitsa parameter. Phiri mu fayilo /etc/fstab.

Makhalidwe ambiri amalembedwa. Zina mwazinthu zilipo koma sizinakwaniritsidwebe. Osazigwiritsa ntchito; sangakubweretsereni kalikonse.

M'munsimu muli makhalidwe othandiza kwambiri omwe mungagwiritse ntchito:

A Izi zimatsimikizira kuti nthawi yofikira mafayilo sikusintha.
Kawirikawiri, nthawi iliyonse fayilo ikatsegulidwa, nthawi yofikira fayilo iyenera kulembedwa mu metadata ya fayilo. Izi zimasokoneza magwiridwe antchito; kotero kuti mafayilo omwe amapezeka pafupipafupi, mawonekedwe A angagwiritsidwe ntchito kuletsa mbali imeneyi.

a Izi zimakupatsani mwayi wowonjezera koma osachotsa fayilo.

c Ngati mukugwiritsa ntchito fayilo yomwe imathandizira kuponderezana kwa voliyumu, mawonekedwe a fayiloyi amatsimikizira kuti fayiloyo imapanikizidwa injini ikayatsidwa.

D Izi zimatsimikizira kuti zosintha zamafayilo zimalembedwa ku disk nthawi yomweyo m'malo mosungidwa poyamba. Ichi ndi chikhumbo chothandiza pamafayilo ofunikira kuti muwonetsetse kuti satayika pakati pa cache ya fayilo ndi hard drive.

d Izi zimatsimikizira kuti fayiloyo siisungidwa mu zosunga zobwezeretsera pomwe zida zotayira zimagwiritsidwa ntchito.

I Chizindikirochi chimathandizira kulondolera m'ndandanda wazomwe zayatsidwa. Izi zimapereka mwayi wamafayilo mwachangu pamafayilo akale ngati Ext3 omwe sagwiritsa ntchito nkhokwe ya B-tree kuti apeze mafayilo mwachangu.

i Izi zimapangitsa fayilo kukhala yosasinthika. Chifukwa chake, palibe zosintha zomwe zingapangidwe ku fayilo, zomwe ndizothandiza pamafayilo omwe amafunikira chitetezo chowonjezera.

j Izi zimatsimikizira kuti, pa fayilo ya ext3, fayiloyo imalembedwa koyamba ku magazini kenako ndikuyika ma data pa hard disk.

s Lembani midadada yomwe fayilo idasungidwa ku 0s mutachotsa fayilo. Izi zimatsimikizira kuti fayilo silingabwezeretsedwenso ikachotsedwa.

u Izi zimasunga zambiri zakufufutidwa. Izi zimakuthandizani kuti mukhale ndi chida chomwe chimagwira ntchito ndi chidziwitsochi kuti mupulumutse mafayilo ochotsedwa.

Ngati mukufuna kugwiritsa ntchito mawonekedwe, mutha kugwiritsa ntchito lamulo macheza. Mwachitsanzo, ntchito chattr +s somefilekugwiritsa ntchito mawonekedwe ku somefile. Mukufuna kuchotsa chikhalidwe? Ndiye ntchito chattr -s somefilendipo chidzachotsedwa. Kuti muwone mwachidule zonse zomwe zikugwiritsidwa ntchito pano, gwiritsani ntchito lamulo Lsattr.

Chidule

M'nkhaniyi, mwaphunzira momwe mungagwiritsire ntchito zilolezo. Mumawerenga za zilolezo zitatu zoyambira, zilolezo zapamwamba, komanso momwe mungagwiritsire ntchito ma ACL pamafayilo. Munaphunziranso momwe mungagwiritsire ntchito umask kuti mugwiritse ntchito zilolezo zosasinthika. Pamapeto pa nkhaniyi, mwaphunzira momwe mungagwiritsire ntchito mawonekedwe owonjezera ogwiritsa ntchito kuti mugwiritse ntchito gawo lina la chitetezo cha fayilo.

Ngati munakonda kumasulira uku, chonde lembani za izo mu ndemanga. Padzakhala zolimbikitsa zambiri zomasulira matembenuzidwe othandiza.

Anakonza zolakwika za typos ndi galamala m'nkhaniyi. Anachepetsa ndime zina zazikulu kukhala zazing'ono kuti ziwerengedwe bwino.

M'malo mwa "Ndiye yekhayo amene ali ndi ufulu woyang'anira ku bukhuli angagwiritse ntchito chilolezo chochita." yokhazikika ku "Ndiyekhayo amene ali ndi zilolezo zolembera pa chikwatu chomwe angagwiritse ntchito chilolezo.", zomwe zingakhale zolondola.

Zikomo chifukwa cha ndemanga berez.

M'malo:
Ngati simuli mwini wa wogwiritsa ntchito, chipolopolocho chidzayang'ana kuti muwone ngati ndinu membala wa gulu, lomwe limadziwikanso kuti gulu la fayilo.

Pa:
Ngati simuli eni ake a fayilo, chipolopolocho chidzayang'ana kuti muwone ngati ndinu membala wa gulu lomwe lili ndi zilolezo pafayiloyo. Ngati ndinu membala wa gululi, mupeza fayiloyo ndi zilolezo zomwe gululo lakhazikitsa, ndipo chipolopolocho chidzasiya kuyang'ana.

Zikomo chifukwa cha ndemanga yanu CryptoPirate

Source: www.habr.com