Subject: System Web Security

Topic: Operating System Security

Difficulty: Medium

• Linux file security is quite simplistic in design, yet quite effective in controlling access to files and directories.
• Directories and the files which are stored in them are arranged in a hierarchical tree structure.
• Access can be controlled for both the files and the directories allowing a very flexible level of access.

File Security Model

• In Linux, every file and every directory are owned by a single user on that system.
• Each file and directory also has a security group associated with it that has access rights to the file or directory.
• If a user is not the directory or file owner nor assigned to the security group for the file, that user is classified as other and may still have certain rights to access the file.
• Each of the three file access categories, owner, group, and other, has a set of three access permissions associated with it.
• The access permissions are read, write, and execute.
• A user may belong to more than one group.
• Regardless of how many groups a user belongs to if permissions are granted on a file or directory to one of the user's groups they will have the granted level of access.

• You can check what groups a user belongs to with the groups command.

  \$ groupstclark
  
   tclark : authors users
  

• The groups command is called with one argument, the username you want to investigate.

• As you can see in the output above the output lists the username and all the groups they belong to.
• In this output tclark belongs to the groups authors and users.

Basic File Permissions

Permission Groups

Each file and directory has three user based permission groups:

• Owner - The Owner permissions apply only the owner of the file or directory, they will not impact the actions of other users.
• Group - The Group permissions apply only to the group that has been assigned to the file or directory, they will not affect the actions of other users.

• All users - The All Users permissions apply to all other users on the system, this is the permission group that you want to watch the most.

  Permission Types

  Each file or directory has three basic permission types:

• Read - The Read permission refers to a user's capability to read the contents of the file.

• Write - The Write permissions refer to a user's capability to write or modify a file or directory.

• Execute - The Execute permission affects a user's capability to execute a file or view the contents of a directory.

  Viewing the Permissions

  You can view the permissions by checking the file or directory permissions in your favorite GUI File Manager (which I will not cover here) or by reviewing the output of the $"ls -l"$ command while in the terminal and while working in the directory which contains the file or folder.

The permission in the command line is displayed as: _rwxrwxrwx 1 owner: group

1. User rights/Permissions

   1.1 The first character that I marked with an underscore is the special permission flag that can vary.

   1.2 The following set of three characters (rwx) is for the owner permissions.

   1.3 The second set of three characters (rwx) is for the Group permissions.

   1.4 The third set of three characters (rwx) is for the All Users permissions.

2. Following that grouping since the integer/number displays the number of hardlinks to the file.

3. The last piece is the Owner and Group assignment formatted as Owner: Group.

   Modifying the Permissions

   When in the command line, the permissions are edited by using the command chmod. You can assign the permissions explicitly or by using a binary reference as described below.

   Explicitly Defining Permissions

   To explicitly define permissions you will need to reference the Permission Group and Permission Types.

   The Permission Groups used are:

   • u - Owner
   • g - Group
   • o or a - All Users

   The potential Assignment Operators are + (plus) and - (minus); these are used to tell the system whether to add or remove the specific permissions.

   The Permission Types that are used are:

   • r - Read
   • w - Write
   • x – Execute