{"id":55251,"date":"2020-01-16T00:00:00","date_gmt":"2020-01-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/fajlovye-razresheniya-v-linux"},"modified":"2020-02-18T14:03:21","modified_gmt":"2020-02-18T11:03:21","slug":"fajlovye-razresheniya-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","title":{"rendered":"Pr\u00e1va s\u00faborov v Linuxe","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ahojte v\u0161etci. Akt\u00edvne sa zap\u00e1jame do pr\u00e1ce a u\u017e v janu\u00e1ri pripravujeme ve\u013ea siln\u00fdch spusten\u00ed. Medzi in\u00fdmi, bol vyhl\u00e1sen\u00fd n\u00e1bor na nov\u00fd beh ob\u013e\u00faben\u00e9ho kurzu <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/rbVT\/\">\u201eAdministr\u00e1tor Linuxu\u201c<\/a><\/noindex>. Pred spusten\u00edm tradi\u010dne zdie\u013eame preklad u\u017eito\u010dn\u00e9ho materi\u00e1lu.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Pr\u00e1va s\u00faborov v Linuxe\" src=\"\/wp-content\/uploads\/2020\/01\/451acace5e0a9088355acb800d789db9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<blockquote><p><i>Pr\u00e1va s\u00faborov poskytuj\u00fa bezpe\u010dnej\u0161iu alternat\u00edvu k vykonate\u013en\u00fdm s\u00faborom SUID, ale m\u00f4\u017eu sa na prv\u00fd poh\u013ead zda\u0165 trochu zlo\u017eit\u00e9.<\/i><\/p><\/blockquote>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nV\u0161etci vieme, \u017ee bin\u00e1rne s\u00fabory <noindex><a rel=\"nofollow\" href=\"http:\/\/en.wikipedia.org\/wiki\/Setuid#Security\">SUID<\/a><\/noindex> s\u00fa <noindex><a rel=\"nofollow\" href=\"http:\/\/en.wikipedia.org\/wiki\/Setuid#Security\">z h\u013eadiska bezpe\u010dnosti zl\u00fdm rie\u0161en\u00edm<\/a><\/noindex>. Na\u0161\u0165astie, ak va\u0161a aplik\u00e1cia vy\u017eaduje ur\u010dit\u00e9 obmedzen\u00e9 opr\u00e1vnenia, existuje efekt\u00edvnej\u0161\u00ed sp\u00f4sob, ktor\u00fd sa naz\u00fdva <noindex><a rel=\"nofollow\" href=\"http:\/\/www.linuxjournal.com\/article\/5737\">pr\u00e1va s\u00faborov<\/a><\/noindex>.<\/p>\n<p>U\u0161etr\u00edm v\u00e1m \u010das, ak sa chcete vyhn\u00fa\u0165 podrobn\u00e9mu pre\u010d\u00edtaniu vy\u0161\u0161ie uveden\u00e9ho \u010dl\u00e1nku: v podstate, pr\u00e1va s\u00faborov umo\u017e\u0148uj\u00fa procesom, ktor\u00e9 s\u00fa sp\u00fa\u0161\u0165an\u00e9 menom pou\u017e\u00edvate\u013ea root a t\u00fdm p\u00e1dom maj\u00fa pr\u00e1vo robi\u0165 \u010doko\u013evek, zachova\u0165 ur\u010dit\u00e9 mo\u017enosti, obmedzen\u00e9 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.kernel.org\/doc\/man-pages\/online\/pages\/man7\/capabilities.7.html\">t\u00fdmto zoznamom<\/a><\/noindex>, ke\u010f zru\u0161ia opr\u00e1vnenia a sp\u00fa\u0161\u0165aj\u00fa sa ako neprivilegovan\u00fd pou\u017e\u00edvate\u013e. To znamen\u00e1, \u017ee ak sa \u00fato\u010dn\u00edkovi podar\u00ed skompromitova\u0165 proces pomocou prete\u010denia vyrovn\u00e1vacej pam\u00e4te alebo in\u00e9ho exploitu, nebude m\u00f4c\u0165 vyu\u017e\u00edva\u0165 ni\u010d okrem ur\u010dit\u00fdch minim\u00e1lnych pr\u00e1vomoc\u00ed, ktor\u00e9 skuto\u010dne potrebuj\u00fa proces.<\/p>\n<p>Opr\u00e1vnenia s\u00fa skvel\u00e9 pre slu\u017eby, ktor\u00e9 sa zvy\u010dajne v\u017edy sp\u00fa\u0161\u0165aj\u00fa menom pou\u017e\u00edvate\u013ea root, ale \u010do z pr\u00edkazov? Na\u0161\u0165astie, to je tie\u017e podporovan\u00e9, ak m\u00e1te nain\u0161talovan\u00e9 spr\u00e1vne n\u00e1stroje. Ak pou\u017e\u00edvate Ubuntu, budete potrebova\u0165 napr\u00edklad bal\u00edk <code>libcap2-bin<\/code>. Taktie\u017e budete musie\u0165 ma\u0165 nain\u0161talovan\u00e9 nie archaick\u00e9 jadro (od verzie<b> 2.6.24<\/b>).<\/p>\n<p>Tieto funkcie umo\u017e\u0148uj\u00fa viaza\u0165 opr\u00e1vnenia s vykon\u00e1vac\u00edmi s\u00fabormi podobne ako nastavenie SUID bitu, ale iba pre ur\u010dit\u00fa mno\u017einu opr\u00e1vnen\u00ed. N\u00e1stroj <code>setcap<\/code> sa pou\u017e\u00edva na prid\u00e1vanie a odoberanie opr\u00e1vnen\u00ed zo s\u00faboru.<\/p>\n<p>Prv\u00fd krok \u2014 vybra\u0165 po\u017eadovan\u00e9 opr\u00e1vnenia. Pre tento \u010dl\u00e1nok predpoklad\u00e1m, \u017ee existuje diagnostick\u00fd n\u00e1stroj siete, zn\u00e1my ako <code>tracewalk<\/code>, ktor\u00fd by mal ma\u0165 mo\u017enos\u0165 pou\u017e\u00edva\u0165 <noindex><a rel=\"nofollow\" href=\"http:\/\/man7.org\/linux\/man-pages\/man7\/raw.7.html\">neopracovan\u00e9 sokety<\/a><\/noindex>. Obvykle je potrebn\u00e9, aby aplik\u00e1cia be\u017eala menom pou\u017e\u00edvate\u013ea root, ale po prezret\u00ed <noindex><a rel=\"nofollow\" href=\"http:\/\/www.kernel.org\/doc\/man-pages\/online\/pages\/man7\/capabilities.7.html\">zoznamu <\/a><\/noindex>zistilo sa, \u017ee je potrebn\u00e9 iba povolenie <code>CAP_NET_RAW<\/code>.<\/p>\n<p>Predpokladajme, \u017ee sa nach\u00e1dzate v adres\u00e1ri, kde je bin\u00e1rny s\u00fabor <code>tracewalk<\/code>, m\u00f4\u017eete prida\u0165 toto povolenie nasleduj\u00facim sp\u00f4sobom:<\/p>\n<pre><code class=\"bash\">sudo setcap cap_net_raw=eip tracewalk<\/code><\/pre>\n<p>\nZatia\u013e ignorujte pr\u00edponu <code>=eip<\/code> pre povolenie, o tom v\u00e1m poviem o p\u00e1r sek\u00fand. V\u0161imnite si, \u017ee n\u00e1zov povolenia je mal\u00fdmi p\u00edsmenami. Teraz m\u00f4\u017eete skontrolova\u0165, \u010di ste spr\u00e1vne nastavili povolenia, pomocou:<\/p>\n<pre><code class=\"bash\">setcap -v cap_new_raw=eip tracewalk<\/code><\/pre>\n<p>\nAlebo m\u00f4\u017eete z\u00edska\u0165 zoznam v\u0161etk\u00fdch povolen\u00ed nastaven\u00fdch pre dan\u00fd spustite\u013en\u00fd s\u00fabor:<\/p>\n<pre><code class=\"bash\">getcap tracewalk\n<\/code><\/pre>\n<p>\nPre inform\u00e1ciu, m\u00f4\u017eete tie\u017e odstr\u00e1ni\u0165 v\u0161etky povolenia zo spustite\u013en\u00e9ho s\u00faboru pomocou:<\/p>\n<pre><code class=\"bash\">setcap -r tracewalk<\/code><\/pre>\n<p>\nV tomto \u0161t\u00e1diu by ste mali ma\u0165 mo\u017enos\u0165 spusti\u0165 spustite\u013en\u00fd s\u00fabor ako neopr\u00e1vnen\u00fd pou\u017e\u00edvate\u013e, a mal by ma\u0165 mo\u017enos\u0165 pracova\u0165 s surov\u00fdmi soketmi, ale nemal by ma\u0165 \u017eiadne \u010fal\u0161ie privil\u00e9gia, ktor\u00e9 m\u00e1 root pou\u017e\u00edvate\u013e.<\/p>\n<p>Tak\u017ee, \u010do znamen\u00e1 tento podivn\u00fd sufix <code>=eip<\/code>? \u0417\u0434\u0435\u0441\u044c \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u0438\u043a\u0430 \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0440\u043e\u0434\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0438\u043c\u0435\u0435\u0442 \u0442\u0440\u0438 \u043d\u0430\u0431\u043e\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u2014 <i>efekt\u00edvne, dedi\u010dn\u00e9 a dostupn\u00e9 (effective, inheritable a permitted)<\/i>:<\/p>\n<ul>\n<li><b>Efekt\u00edvne (Effective)<\/b> povolenia \u2013 to s\u00fa tie, ktor\u00e9 ur\u010duj\u00fa, \u010do proces m\u00f4\u017ee skuto\u010dne robi\u0165. Napr\u00edklad nem\u00f4\u017ee sa zaobera\u0165 surov\u00fdmi soketmi, ak <code>CAP_NET_RAW<\/code> nie je v efekt\u00edvnom s\u00fabore.<\/li>\n<li><b>Dostupn\u00e9 (Permitted)<\/b> povolenia \u2013 to s\u00fa tie, ktor\u00e9 m\u00e1 proces povolen\u00e9, ak ich po\u017eaduje pomocou pr\u00edslu\u0161n\u00e9ho volania. Nedovo\u013euj\u00fa procesu skuto\u010dne ni\u010d robi\u0165, pokia\u013e nebol \u0161peci\u00e1lne naprogramovan\u00fd na po\u017eiadanie uveden\u00e9ho povolenia. To umo\u017e\u0148uje p\u00edsa\u0165 procesy na pridanie obzvl\u00e1\u0161\u0165 d\u00f4le\u017eit\u00fdch povolen\u00ed do efekt\u00edvneho s\u00faboru len na dobu, kedy s\u00fa skuto\u010dne potrebn\u00e9.<\/li>\n<li><b>Dedi\u010dn\u00e9 (Inheritable)<\/b> povolenia \u2013 to s\u00fa tie, ktor\u00e9 m\u00f4\u017eu by\u0165 zdeden\u00e9 v dostupnom s\u00fabore vytvoren\u00e9ho dc\u00e9rskeho procesu. Po\u010das oper\u00e1cie <code>fork()<\/code> alebo <code>clone()<\/code> dc\u00e9rskemu procesu je v\u017edy dan\u00e1 k\u00f3pia povolen\u00ed rodi\u010dovsk\u00e9ho procesu, preto\u017ee v tomto okamihu st\u00e1le vykon\u00e1va ten ist\u00fd spustite\u013en\u00fd s\u00fabor. Dedi\u010dn\u00e1 s\u00faprava sa pou\u017e\u00edva, ke\u010f <code>exec()<\/code> (alebo ekvivalent) je volan\u00fd na nahradenie spustite\u013en\u00e9ho s\u00faboru in\u00fdm. V tomto \u0161t\u00e1diu je dostupn\u00e1 s\u00faprava procesu maskovan\u00e1 dedi\u010dnou s\u00fapravou pre z\u00edskanie dostupnej s\u00fapravy, ktor\u00e1 sa bude pou\u017e\u00edva\u0165 pre nov\u00fd proces.<\/li>\n<\/ul>\n<p>\nTak\u017ee, n\u00e1stroj <code>setcap<\/code> n\u00e1m umo\u017e\u0148uje nez\u00e1visle prid\u00e1va\u0165 opr\u00e1vnenia t\u00fdchto troch s\u00faborov pre dan\u00fd spustite\u013en\u00fd s\u00fabor. V\u0161imnite si, \u017ee hodnota skup\u00edn sa interpretuje trochu inak pre pr\u00edstupov\u00e9 pr\u00e1va k s\u00faborom:<\/p>\n<ul>\n<li><b>Dostupn\u00e9 <\/b>s\u00faborov\u00e9 opr\u00e1vnenia s\u00fa tie, ktor\u00e9 s\u00fa v\u017edy k dispoz\u00edcii pre spustite\u013en\u00fd s\u00fabor, aj ke\u010f rodi\u010dovsk\u00fd proces, ktor\u00fd ho vyvolal, ich nemal. Predt\u00fdm sa naz\u00fdvali \u201en\u00faten\u00e9\u201c opr\u00e1vnenia.<\/li>\n<li><b>Dedi\u010dn\u00e9 <\/b>s\u00faborov\u00e9 opr\u00e1vnenia ur\u010duj\u00fa \u010fal\u0161iu masku, ktor\u00e1 sa m\u00f4\u017ee tie\u017e pou\u017ei\u0165 na odobratie opr\u00e1vnen\u00ed zo sady vyvol\u00e1vaj\u00faceho procesu. Pou\u017e\u00edvaj\u00fa sa navy\u0161e k dedi\u010dnej sade vyvol\u00e1vaj\u00faceho procesu, tak\u017ee opr\u00e1vnenie sa ded\u00ed iba vtedy, ak existuje v oboch sad\u00e1ch.<\/li>\n<li><b>Efekt\u00edvne <\/b>s\u00faborov\u00e9 opr\u00e1vnenia s\u00fa v skuto\u010dnosti len jedn\u00fdm bitom, nie sadou, a ak je nastaven\u00fd, znamen\u00e1 to, \u017ee cel\u00e1 dostupn\u00e1 sada sa tie\u017e kop\u00edruje do efekt\u00edvnej sady nov\u00e9ho procesu. Toto m\u00f4\u017ee by\u0165 pou\u017eit\u00e9 na pridanie opr\u00e1vnen\u00ed k procesom, ktor\u00e9 neboli \u0161peci\u00e1lne nap\u00edsan\u00e9 na ich po\u017eiadanie. Ke\u010f\u017ee ide o jeden bit, ak ho nastav\u00edte pre ak\u00e9ko\u013evek opr\u00e1vnenie, mus\u00ed by\u0165 nastaven\u00fd pre v\u0161etky opr\u00e1vnenia. M\u00f4\u017eete si na to myslie\u0165 ako na leg\u00e1t bit, preto\u017ee sa pou\u017e\u00edva na povolenie pou\u017eitia opr\u00e1vnen\u00ed pre aplik\u00e1cie, ktor\u00e9 ich nepodporuj\u00fa.<\/li>\n<\/ul>\n<p>\nPri ur\u010den\u00ed opr\u00e1vnen\u00ed prostredn\u00edctvom <code>setcap<\/code> troch p\u00edsmen <code>e<\/code>, <code>i<\/code> a <code>p<\/code> sa t\u00fdkaj\u00fa <i>efekt\u00edvneho, dedi\u010dn\u00e9ho a dostupn\u00e9ho<\/i> s\u00faborov. Tak\u017ee sk\u00f4r \u0161pecifik\u00e1cia:<\/p>\n<pre><code class=\"bash\">sudo setcap cap_net_raw=eip tracewalk<\/code><\/pre>\n<p>\n\u2026 nazna\u010duje, \u017ee opr\u00e1vnenie <code>CAP_NET_RAW<\/code> m\u00e1 by\u0165 pridan\u00e9 k dostupn\u00fdm a dedi\u010dn\u00fdm s\u00faborom a \u017ee nastaven\u00fd mus\u00ed by\u0165 aj efekt\u00edvny bit. To nahrad\u00ed ak\u00e9ko\u013evek predt\u00fdm nastaven\u00e9 opr\u00e1vnenia v s\u00fabore. Ak chcete nastavi\u0165 viacero opr\u00e1vnen\u00ed naraz, pou\u017eite zoznam oddelen\u00fd \u010diarkou:<\/p>\n<pre><code class=\"bash\">sudo setcap cap_net_admin,cap_net_raw=eip tracewalk<\/code><\/pre>\n<p>\n<noindex><a rel=\"nofollow\" href=\"http:\/\/www.kernel.org\/doc\/man-pages\/online\/pages\/man7\/capabilities.7.html\">Pr\u00edru\u010dka k opr\u00e1vneniam<\/a><\/noindex> sa podrobnej\u0161ie zaober\u00e1 v\u0161etk\u00fdm t\u00fdmto, ale d\u00fafam, \u017ee tento pr\u00edspevok trochu objasnil, \u010do sa deje. Zost\u00e1va spomen\u00fa\u0165 len nieko\u013eko upozornen\u00ed a trikov.<\/p>\n<p>Po prv\u00e9, s\u00faborov\u00e9 schopnosti nefunguj\u00fa so symbolick\u00fdmi odkazmi \u2014 mus\u00edte ich aplikova\u0165 na samotn\u00fd bin\u00e1rny s\u00fabor (t.j. na cie\u013e symbolick\u00e9ho odkazu).<\/p>\n<p>Po druh\u00e9, nepracuj\u00fa s interpretovan\u00fdmi skriptami. Napr\u00edklad, ak m\u00e1te skript Python, ktor\u00e9mu chcete priradi\u0165 povolenia, mus\u00edte ich priradi\u0165 samotn\u00e9mu interpretu Python. Je zrejm\u00e9, \u017ee to predstavuje potenci\u00e1lny bezpe\u010dnostn\u00fd probl\u00e9m, preto\u017ee v\u0161etky skripty vykon\u00e1van\u00e9 s t\u00fdmto interpretom bud\u00fa ma\u0165 priraden\u00e9 uveden\u00e9 povolenia, hoci je to st\u00e1le v\u00fdrazne lep\u0161ie ako zabezpe\u010di\u0165 SUID. Najbe\u017enej\u0161\u00edm obch\u00e1dzac\u00edm rie\u0161en\u00edm je zjavne nap\u00edsa\u0165 samostatn\u00fd spustite\u013en\u00fd s\u00fabor v C alebo jeho anal\u00f3gu, ktor\u00fd m\u00f4\u017ee vykon\u00e1va\u0165 potrebn\u00e9 oper\u00e1cie a vyvola\u0165 ho z skriptu. To je podobn\u00e9 pr\u00edstupu, ktor\u00fd pou\u017e\u00edva Wireshark, ktor\u00fd vyu\u017e\u00edva bin\u00e1rny s\u00fabor. <code>\/usr\/bin\/dumpcap<\/code> na vykon\u00e1vanie privilegovan\u00fdch oper\u00e1ci\u00ed:<\/p>\n<pre><code class=\"bash\">$ getcap \/usr\/bin\/dumpcap \n\/usr\/bin\/dumpcap = cap_net_admin,cap_net_raw+eip<\/code><\/pre>\n<p>\nPo tretie, povolenia s\u00faborov sa deaktivuj\u00fa, ak pou\u017e\u00edvate premenn\u00fa prostredia <code>LD_LIBRARY_PATH<\/code> z pochopite\u013en\u00fdch bezpe\u010dnostn\u00fdch d\u00f4vodov<i>(1)<\/i>. To ist\u00e9 plat\u00ed aj pre <code>LD_PRELOAD<\/code>, pokia\u013e viem.<\/p>\n<p><i>1. Preto\u017ee \u00fato\u010dn\u00edk m\u00f4\u017ee zjavne podv\u00e1dza\u0165 jednu zo \u0161tandardn\u00fdch kni\u017en\u00edc a pou\u017e\u00edva\u0165 <code>LD_LIBRARY_PATH<\/code>, aby don\u00fatil svoju kni\u017enicu by\u0165 vyvolan\u00e1 pred syst\u00e9movou, a teda ma\u0165 svoj vlastn\u00fd \u013eubovo\u013en\u00fd k\u00f3d vykon\u00e1van\u00fd s t\u00fdmi ist\u00fdmi privil\u00e9giami ako vyvol\u00e1vaj\u00faca aplik\u00e1cia. <br \/>\n<\/i><\/p>\n<p><i><b>Na tomto mieste je v\u0161etko. Podrobnosti o kurze sa bud\u00fa da\u0165 z\u00edska\u0165 na <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/rbVT\/\">webin\u00e1ri, ktor\u00fd sa uskuto\u010dn\u00ed 24. janu\u00e1ra.<\/a><\/noindex><\/b><\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/483934\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445, \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043d\u0430\u0431\u043e\u0440 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043f\u043e\u0442\u043e\u043a \u043f\u043e\u043b\u044e\u0431\u0438\u0432\u0448\u0435\u0433\u043e\u0441\u044f \u0432\u0441\u0435\u043c \u043a\u0443\u0440\u0441\u0430 \u00ab\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Linux\u00bb. \u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u0434\u0435\u043b\u0438\u043c\u0441\u044f \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u043e\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430. \u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c SUID, \u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0442\u0430\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u0432\u0437\u0433\u043b\u044f\u0434. \u0412\u0441\u0435 \u043c\u044b \u0437\u043d\u0430\u0435\u043c, \u0447\u0442\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":55252,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-15T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:03:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Povolenia s\u00faborov v Linuxe | ProHoster","description":"Ahojte v\u0161etci. Akt\u00edvne sa zap\u00e1jame do pr\u00e1ce a u\u017e v janu\u00e1ri pripravujeme ve\u013ea siln\u00fdch spusten\u00ed.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 Linux | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u041c\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u043b\u0438\u0432\u0430\u0435\u043c\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u0443\u0436\u0435 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043c\u043d\u043e\u0433\u043e \u043c\u043e\u0449\u043d\u044b\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/fajlovye-razresheniya-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55251","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:47:37","updated":"2022-09-30 13:42:26","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/55251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=55251"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/55251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/55252"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=55251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=55251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=55251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}