Permissions

• chmod - change file mode bits
• chown - change file owner and group

Understanding the security permissions

$ ls -alh
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwxrwxrwx 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

# type  user  group  other  user    group
# -     rwx   rwx     rwx   ubuntu  ubuntu
# d     rwx   rwx     rwx   ubuntu  ubuntu

User, group and others

• user – The user permissions apply only the owner of the file or directory, they will not impact the actions of other users.
• group – The group permissions apply only to the group that has been assigned to the file or directory, they will not effect the actions of other users.
• others – The others permissions apply to all other users on the system, this is the permission group that you want to watch the most.

Read, Write and Execute

• r stands for read
• w stands for write
• x stands for execute
• - it is a file
• d it is a directory

Changing security permissions with chmod

The ugoa notations

A combination of the letters ugoa controls which users access to the file will be changed: the user who owns it (u), other users in the file’s group (g), other users not in the file’s group (o), or all users (a). If none of these are given, the effect is as if (a) were given, but bits that are set in the umask are not affected.

1. Removing every permission and start clean

$ chmod 000 shared/
$ ls -lh
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
d--------- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

1. Add read, write and execute (rwx) to user

$ chmod u+rwx shared/
$ ls -lh
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwx------ 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

1. Add read and write (rw) to group

$ chmod g+rw shared/
$ ls -lh
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwxrw---- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

1. Add read (r) to others

$ chmod o+r shared/
$ ls -lh
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwxrw-r-- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

1. Remove execute (x) from user

$ chmod u-x shared/
$ ls -lh
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drw-rw-r-- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

1. Remove (w) from group

$ chmod g-w shared/
$ ls -l
-rwxrwxrwx 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drw-r--r-- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

1. Combinations

chmod +x script.sh             # makes script executable by all similar to: chmod a+x script.sh
chmod u=rwx,g=rx,o=rx shared/  # change permissions for user group and others at the same time

The octal notations

Using the octal notations table instead of r, w and x. Each digit octal notation can be used of either of the group u,g,o.

Examples:

chmod 777 shared/  # u=rwx,g=rwx,o=rwx
chmod 744 shared/  # u=rwx,g=r,o=r
chmod 755 shared/  # u=rwx,g=rx,o=rx

1. change recursively

$ tree tmp/test/
tmp/test/
├── bar
│   └── metasyntactic-vars
├── buz
│   └── metasyntactic-vars
└── foo
    ├── metasyntactic-vars
    └── shared

# for me recursively changing permissions using ugoa notation did not work
# chmod -R u=rw,g=r,o=r shared/  # change permissions for user group and others at the same time
chmod -R 644 shared/  # change permissions for user group and others at the same time

Changing ownership with chown

Command chown changes the user and/or group ownership of each given file. If only an owner (a user name or numeric user ID) is given, that user is made the owner of each given file, and the files’ group is not changed. If the owner is followed by a colon and a group name (or numeric group ID), with no spaces between them, the group ownership of the files is changed as well. If a colon but no group name follows the user name, that user is made the owner of the files and the group of the files is changed to that user’s login group. If the colon and group are given, but the owner is omitted, only the group of the files is changed; in this case, chown performs the same function as chgrp. If only a colon is given, or if the entire operand is empty, neither the owner nor the group is changed

chown root /foo           # Change the owner of /u to "root".
chown root:staff /bar     # Likewise, but also change its group to "staff".
chown -hR root /buz       # Change the owner of /u and subfiles to "root".

$ sudo ls -hlR
drwxr--r-- 2 root   staff  4.0K Jul  2 13:56 bar
drwxr--r-- 2 root   staff  4.0K Jul  2 09:29 buz
drwxr--r-- 3 root   ubuntu 4.0K Jul  2 18:05 foo
./bar:
-rwxr--r-- 1 ubuntu ubuntu 16 Jul  2 13:56 metasyntactic-vars
./buz:
-rwxr--r-- 1 root   staff  16 Jul  2 09:29 metasyntactic-vars
./foo:
-rwxr--r-- 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwxr--r-- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared
./foo/shared:

# changing back
sudo chown -R ubuntu:ubuntu ../
ubuntu@raspberrypi-01:~/tmp/test$ ls -lhR

drwxr--r-- 2 ubuntu ubuntu 4.0K Jul  2 13:56 bar
drwxr--r-- 2 ubuntu ubuntu 4.0K Jul  2 09:29 buz
drwxr--r-- 3 ubuntu ubuntu 4.0K Jul  2 18:05 foo
./bar:
-rwxr--r-- 1 ubuntu ubuntu 16 Jul  2 13:56 metasyntactic-vars
./buz:
total 4.0K
-rwxr--r-- 1 ubuntu ubuntu 16 Jul  2 09:29 metasyntactic-vars
./foo:
-rwxr--r-- 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwxr--r-- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared
./foo/shared:

Linux Filesystem

A simple description of the UNIX system, also applicable to Linux, is this:

“On a UNIX system, everything is a file; if something is not a file, it is a process.”

This statement is true because there are special files that are more than just files (named pipes and sockets, for instance), but to keep things simple, saying that everything is a file is an acceptable generalization. A Linux system, just like UNIX, makes no difference between a file and a directory, since a directory is just a file containing names of other files. Programs, services, texts, images, and so forth, are all files. Input and output devices, and generally all devices, are considered to be files, according to the system.

In order to manage all those files in an orderly fashion, we like to think of them in an ordered tree-like structure on the hard disk, as we know from MS-DOS (Disk Operating System) for instance. The large branches contain more branches, and the branches at the end contain the tree’s leaves or normal files. For now, we will use this image of the tree, but we will find out later why this is not a fully accurate image.

File Types

The -l option to ls displays the file type, using the first character of each input line:

$ ls -l
total 8.0K
-rwxr--r-- 1 ubuntu ubuntu   16 Jul  2 09:29 metasyntactic-vars
drwxr--r-- 2 ubuntu ubuntu 4.0K Jul  2 18:05 shared

• regular files contain normal data, for example, text files, executable files, or programs.
• Directories: files that are lists of other files.
• Special files: the mechanism used for input and output. Most special files are in /dev
• Links: a system to make a file or directory visible in multiple parts of the system’s file tree
• (Domain) sockets: a special file type, similar to TCP/IP sockets, providing inter-process networking protected by the file system’s access control.
• Named pipes: act more or less like sockets and form a way for processes to communicate with each other, without using network socket semantics.

Partition layout and types

There are two kinds of major partitions on a Linux system:

• data partition: normal Linux system data, including the root partition containing all the data to start up and run the system; and
• swap partition: expansion of the computer’s physical memory, extra memory on the hard disk.

Mount points

All partitions are attached to the system via a mount point. The mount point defines the place of a particular data set in the file system. Usually, all partitions are connected through the root partition. On this partition, which is indicated with the slash (/), directories are created.

$ df -h  /dev/mmcblk0*   # h human-readable
Filesystem      Size  Used Avail Use% Mounted on
udev            1.9G     0  1.9G   0% /dev
/dev/mmcblk0p1  253M   99M  154M  39% /boot/firmware
/dev/mmcblk0p2   15G  3.5G   11G  26% /
/dev/sda2       1.8T  633G  1.1T  37% /mnt/sgt2t
$ du -sh /mnt/sgt2t/     # s display only a total for each argument
633G    /mnt/sgt2t/

During system startup, all the partitions are thus mounted, as described in the file /etc/fstab

cat /etc/fstab
LABEL=writable    /     ext4    defaults    0 0
LABEL=system-boot       /boot/firmware  vfat    defaults        0       1
# mount seagate 2T drive
UUID=98db3b27-e3fa-4cfe-906f-bcbd4db335b7 /mnt/sgt2t ext4    errors=remount-ro,auto,exec,rw,user 0       0

Subdirectories of the root directory

Linux file system starts with /, the root directory. All other directories are ‘children’ of this directory.

/bin -> usr/bin     # contains binaries (applications os programs you can run)
/boot               # !! contains files required for starting your system
/dev                # !! contains device files
/etc                # a place for system-wide configuration files
/home               # Home directories of the common users, eg /home/ubuntu this is accessible to only
                    # the user and system admin
/lib -> usr/lib     # libraries necessary for some application to run
/lost+found         # contains recovered bits of corrupted files
/media              # is where external storage will be automatically mounted when you plug it in and try to access it
/mnt                # a place to manually mount storage devices or partitions
/opt                # a place to install system-wide third party software
/proc               # !! contains information about your computer, such as information about your CPU
/root               # !! is the home directory of the superuser (also known as the “Administrator”) of the system
/run                # !! System processes use it to store temporary data
/sbin -> usr/sbin   # superuser binaries (applications os programs you can run)
/snap               # a place for snap applications
/srv                # server data (http, sftp)
/sys                # contains information from devices connected to the machine
/tmp                # contains temporary files
/usr                # contains system-wide shared data
/var                # Contains variable data like system logging files,
                    # mail and printer spool directories, and transient and temporary files

The file system in reality

For most users and for most common system administration tasks, it is enough to accept that files and directories are ordered in a tree-like structure. The computer, however, doesn’t understand a thing about trees or tree-structures.

Every partition has its own file system. By imagining all those file systems together, we can form an idea of the tree-structure of the entire system, but it is not as simple as that. In a file system, a file is represented by an inode, a kind of serial number containing information about the actual data that makes up the file: to whom this file belongs, and where is it located on the hard disk.

Every partition has its own set of inodes; throughout a system with multiple partitions, files with the same inode number can exist.

At the time a new file is created, it gets a free inode. In that inode is the following information:

• Owner and group owner of the file.
• File type (regular, directory, …)
• Permissions on the file
• Date and time of creation, last read, and change.
• Date and time this information has been changed in the inode.
• The Number of links to this file.
• File size
• An address defining the actual location of the file data.

The only information not included in an inode is the file name and directory. These are stored in the special directory files. By comparing file names and inode numbers, the system can make up a tree-structure that the user understands. Users can display inode numbers using the -i option to ls. The inodes have their own separate space on the disk.

df -i /dev/sda2
Filesystem        Inodes IUsed     IFree IUse% Mounted on
/dev/sda2      122085376 30050 122055326    1% /mnt/sgt2t

Sources:

• https://tldp.org/LDP/intro-linux/html/sect_03_01.html
• https://www.linux.com/training-tutorials/linux-filesystem-explained/
• https://www.tldp.org/LDP/Linux-Filesystem-Hierarchy/html/the-root-directory.html

Pipes

In order to understand why pipes let’s look at the UNIX philosophy:

1. Make each program do one thing well. To do a new job, build afresh rather than complicate old programs by adding new “features”.
2. Expect the output of every program to become the input to another, as yet unknown, program. Don’t clutter output with extraneous information. Avoid stringently columnar or binary input formats. Don’t insist on interactive input.

Pipes

In Linux, the pipe command lets you send the output of one command to another. Piping, as the term suggests, can redirect the standard output, input, or error of one process to another for further processing.

The syntax for the pipe or unnamed pipe command is the | character between any two commands:

# syntax
# command-1 | command-2 | command-3
$ echo -e "alfa\nbeta\ngama"
alfa
beta
gama
$ echo -e "alfa\nbeta\ngama" | grep -n beta
2:beta
$ echo -e "alfa\nbeta\ngama" | grep -n beta | tr a-z A-Z
2:BETA
BETA

In the above commands, we first print the first 3 letters of the Greek alphabet, we then extract gamma and it’s line number, and last make the word uppercase. We used 2 pipes.

Named Pipes

One of the key differences between regular pipes and named pipes is that named pipes have a presence in the file system and a name :). That is, they show up like files. But unlike most files, they never appear to have contents. Even if you write a lot of data to a named pipe, the file appears to be empty.

A named pipe transfers messages one by one first in first out. A named pipe can be created with mkfifo command.

{% tabs %} {% tab title=“Bash” %}

$ mkfifo my-named-pipe
$ ls -al my-named-pipe
prw-r--r--  1 ionut.ilie  staff  0 Oct  4 20:23 my-named-pipe
# let's write 5 numbers in a pipe
for i in {1..5}; do echo "number $i" > my-named-pipe ; done
# it maight apear as stuck but it actualy waits for a consumer
# move about command in bg or open a new terminal and
# start a consumer for the pipe
tail -f my-named-pipe

{% endtab %}

{% tab title=“Bash-2” %}

# start a consumer for the pipe
$ tail -f my-named-pipe
number 1
number 2
number 3
number 4
number 5

{% endtab %} {% endtabs %}

User Env

.profile

.profile is the first file it is loaded by the shell when a user opens one. If this is missing it might be .bash_profile. if you have a .bash_profile and you create a .profile then profile is loaded first

You can easily lock a user by adding a exit statement in the .profile file :)

PATH

The execution flow of a particular application is given by it’s location in the PATH env variable. Lets say i inherit a default PATH env from the default machine configuration that has some outdated binary and i want to use the new version. i can change this without the help of sysadmin by adding the location of the new binary in front of the old one in the PATH env var

packer@host01:~$ echo $PATH
/root/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
packer@host01:~$ PATH=/home/packer/bin/:$PATH
packer@host01:~$ echo $PATH
/home/packer/bin/:/root/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

LD_LIBRARY_PATH

Same as PATH but for libraries.

Root Env

Login Flow

User Shell