LPI Linux Certification in a Nutshell (31 page)

When new files are created, the protection bits are set
according to the user’s
default setting. That default is established using the
umask
command, probably in a
startup script. This command accepts only one argument, which is a
three-digit octal string that masks the user, group, and other
permission bits for newly created files and directories. Without a
value,
umask
reports the current value:

$
umask
0022

When provided with an integer,
umask
sets
the value for the current shell:

$
umask 2
$
umask
0002

A
umask
of 22 can be rewritten as 022, or
as 000010010 in binary.

The process of creating the initial mode for newly created files
begins with a raw initial mode string, as defined in
Table 7-4
.

The special bits are always turned off and are not masked by the
umask
. When a file is created, the
umask
is subtracted from 666; for directories, it
is subtracted from 777. This calculation yields the effective
protection mode for the file or directory. For example, a
umask
of 22 (022) is applied to a new file,
masking the write permission for group and other user classes:

110 110 110
- 000 010 010
-------------
110 100 100

This is the same as mode 644, or
rw-r--r--
.

Using the same mask on a directory yields a similar
result:

111 111 111
- 000 010 010
-------------
111 101 101

This is the same as mode 755, or
rwxr-xr-x
, which is appropriate for
directories. A umask of 002 or 022 is typical, although if you wish to
ensure maximum privacy, a umask of 077 blocks all access except for
the superuser. To set a custom umask, enter the
umask
command in a startup script, such as
~/.bash_profile
. Here’s an example of the
umask
in action:

$
umask 27
$
touch afile
$
mkdir adir
$
ls -ld adir afile
drwxr-x---   2 jdean    jdean        1024 Jan  2 20:31 adir
-rw-r-----   1 jdean    jdean           0 Jan  2 20:31 afile

In this case, the
umask
of 27 makes the
file
afile
read-only to members of the group and
disallows access to the file to all others.

As you can see in the output of the previous example,
ls
adds an extra letter at the beginning of the
mode string for the
adir
directory. This symbol
indicates the type of file being listed and is not part of the access
mode. The letter
d
indicates a
directory, a
-
indicates a file,
the letter
l
indicates a symbolic
link, a
b
indicates a block device
(such as a disk), and a
c
indicates
a character device (such as a terminal).

Access modes can be changed with the
chmod
command, which accepts either
octal
or
symbolic
access
mode specifications. Octal bits, as shown in the previous section, are
specified explicitly. However, some people prefer to use symbolic
forms because they usually modify an existing mode instead of
completely replacing it. Symbolic mode specifications have three
parts, made up of individual characters, as shown in
Table 7-5
.

The individual user class characters and permissions characters
may be grouped to form compound expressions, such as
ug
for user and group combined or
rw
for read and write. Here are some
examples of symbolic mode specifications:

The
chmod
command is used to modify the
mode.

• The workgroup is to be called
  sales
  and
  has members
  jdoe
  ,
  bsmith
  ,
  and
  jbrown
  .
  

• The directory is
  /home/sales
  .
  

• Only the creators of files in
  /home/sales
  should be able to delete them.
  

• Members shouldn’t worry about file ownership, and all group
  members require full access to files.
  

• Nonmembers should have no access to any of the files.
  

1. Create the new group:
   

   #
   groupadd sales
   

2. Add the existing users to the group:
   

   #
   usermod –a -G sales jdoe
   #
   usermod –a -G sales bsmith
   #
   usermod –a -G sales jbrown
   

3. Create a directory for the group:
   

   #
   mkdir /home/sales
   

4. Set the ownership of the new directory:
   

   #
   chgrp sales /home/sales
   

5. Protect the directory from others:
   

   #
   chmod 770 /home/sales
   

6. Set the SGID bit to ensure that the
   sales
   group will own all new files. Also set the sticky bit to protect
   files from deletion by nonowners:
   

   #
   chmod g+s,o+t /home/sales
   

7. Test it:
   

   #
   su - jdoe
   $
   cd /home/sales
   $
   touch afile
   $
   ls -l afile
   -rw-rw-r--   1 jdoe     sales      0 Jan  3 02:44 afile
   $
   exit
   #
   su - bsmith
   #
   cd /home/sales
   #
   rm afile
   rm: cannot unlink 'afile': Operation not permitted
   

On the Exam

For the exam, you should be prepared to answer questions on file
and directory permissions in both
symbolic and numeric (octal) forms. You should also be
able to translate between the two forms given an example.

-c

Like verbose mode, but report only changes.

-R

Use recursive mode, descending through directory
hierarchies under
files
and
making modifications throughout.

-v

Use verbose behavior, reporting actions for all
files
.

Note that historically BSD systems have used the
user
.
group
syntax, but SysV-based systems have used
user
:
group
(
:
instead of
.
). Older versions of GNU
chown
accepted only the
BSD syntax, but recent versions support
both.

-c

Like verbose mode, but report only changes.

-R

Use recursive mode, descending through directory
hierarchies under
files
and
making modifications throughout.

-v

Use verbose behavior, reporting actions for all
files
.