diff options
Diffstat (limited to 'doc/perm.texi')
| -rw-r--r-- | doc/perm.texi | 141 |
1 files changed, 57 insertions, 84 deletions
diff --git a/doc/perm.texi b/doc/perm.texi index 41b24f6d..ee43938a 100644 --- a/doc/perm.texi +++ b/doc/perm.texi @@ -46,9 +46,9 @@ everyone else. Files are given an owner and group when they are created. Usually the owner is the current user and the group is the group of the directory the file is in, but this varies with the operating system, the -file system the file is created on, and the way the file is created. You -can change the owner and group of a file by using the @command{chown} and -@command{chgrp} commands. +filesystem the file is created on, and the way the file is created. You +can change the owner and group of a file by using the @code{chown} and +@code{chgrp} commands. In addition to the three sets of three permissions listed above, a file's permissions have three special components, which affect only @@ -57,11 +57,11 @@ executable files (programs) and, on some systems, directories: @enumerate @item @cindex setuid -Set the process's effective user ID to that of the file upon execution +set the process's effective user ID to that of the file upon execution (called the @dfn{setuid bit}). No effect on directories. @item @cindex setgid -Set the process's effective group ID to that of the file upon execution +set the process's effective group ID to that of the file upon execution (called the @dfn{setgid bit}). For directories on some systems, put files created in the directory into the same group as the directory, no matter what group the user who creates them is in. @@ -69,48 +69,13 @@ matter what group the user who creates them is in. @cindex sticky @cindex swap space, saving text image in @cindex text image, saving in swap space -@cindex restricted deletion flag -prevent users from removing or renaming a file in a directory -unless they own the file or the directory; this is called the -@dfn{restricted deletion flag} for the directory. -For regular files on some systems, save the program's text image on the -swap device so it will load more quickly when run; this is called the -@dfn{sticky bit}. +@cindex append-only directories +save the program's text image on the swap device so it will load more +quickly when run (called the @dfn{sticky bit}). For directories on some +systems, prevent users from removing files that they do not own in the +directory; this is called making the directory @dfn{append-only}. @end enumerate -In addition to the permissions listed above, there may be file attributes -specific to the file system, e.g: access control lists (ACLs), whether a -file is compressed, whether a file can be modified (immutability), whether -a file can be dumped. These are usually set using programs -specific to the file system. For example: -@c should probably say a lot more about ACLs... someday - -@table @asis -@item ext2 -On @acronym{GNU} and @acronym{GNU}/Linux the file permissions -(``attributes'') specific to -the ext2 file system are set using @command{chattr}. - -@item FFS -On FreeBSD the file permissions (``flags'') specific to the FFS -file system are set using @command{chrflags}. -@end table - -Although a file's permission ``bits'' allow an operation on that file, -that operation may still fail, because: - -@itemize -@item -the file-system-specific permissions do not permit it; - -@item -the file system is mounted as read-only. -@end itemize - -For example, if the immutable attribute is set on a file, -it cannot be modified, regardless of the fact that you -may have just run @code{chmod a+w FILE}. - @node Symbolic Modes @section Symbolic Modes @@ -124,13 +89,9 @@ their previous values, and perhaps on the current @code{umask} as well The format of symbolic modes is: @example -@r{[}ugoa@dots{}@r{][}+-=@r{]}@var{perms}@dots{}@r{[},@dots{}@r{]} +@r{[}ugoa@dots{}@r{][[}+-=@r{][}rwxXstugo@dots{}@r{]}@dots{}@r{][},@dots{}@r{]} @end example -@noindent -where @var{perms} is either zero or more letters from the set -@samp{rwxXst}, or a single letter from the set @samp{ugo}. - The following sections describe the operators and other details of symbolic modes. @@ -157,7 +118,7 @@ format: @noindent The spaces between the three parts above are shown for readability only; -symbolic modes cannot contain spaces. +symbolic modes can not contain spaces. The @var{users} part tells which users' access to the file is changed. It consists of one or more of the following letters (or it can be empty; @@ -199,7 +160,7 @@ have for the file. @end table The @var{permissions} part tells what kind of access to the file should -be changed; it is normally zero or more of the following letters. As with the +be changed; it is zero or more of the following letters. As with the @var{users} part, the order does not matter when more than one letter is given. Omitting the @var{permissions} part is useful only with the @samp{=} operation, where it gives the specified @var{users} no access @@ -224,7 +185,7 @@ but not to execute it, use: a=rw @end example -To remove write permission for all users other than the file's +To remove write permission for from all users other than the file's owner, use: @example @@ -248,7 +209,7 @@ go= Another way to specify the same thing is: @example -og-rwx +og-rxw @end example @node Copying Permissions @@ -256,17 +217,17 @@ og-rwx @cindex copying existing permissions @cindex permissions, copying existing -You can base a file's permissions on its existing permissions. To do -this, instead of using a series of @samp{r}, @samp{w}, or @samp{x} -letters after the -operator, you use the letter @samp{u}, @samp{g}, or @samp{o}. For -example, the mode +You can base part of a file's permissions on part of its existing +permissions. To do this, instead of using @samp{r}, @samp{w}, or +@samp{x} after the operator, you use the letter @samp{u}, @samp{g}, or +@samp{o}. For example, the mode @example o+g @end example @noindent +@c FIXME describe the ls -l notation for showing permissions. adds the permissions for users who are in a file's group to the permissions that other users have for the file. Thus, if the file started out as mode 664 (@samp{rw-rw-r--}), the above mode would change @@ -291,34 +252,45 @@ To change a file's permission to set the group ID on execution, use @samp{g} in the @var{users} part of the symbolic mode and @samp{s} in the @var{permissions} part. -To change a file's permission to set the restricted deletion flag or sticky bit, -omit the @var{users} part of the symbolic mode (or use @samp{a}) and put +To change a file's permission to stay permanently on the swap device, +use @samp{o} in the @var{users} part of the symbolic mode and @samp{t} in the @var{permissions} part. -For example, to add set-user-ID permission to a program, +For example, to add set user ID permission to a program, you can use the mode: @example u+s @end example -To remove both set-user-ID and set-group-ID permission from +To remove both set user ID and set group ID permission from it, you can use the mode: @example ug-s @end example -To set the restricted deletion flag or sticky bit, you can use +To cause a program to be saved on the swap device, you can use the mode: @example -+t +o+t @end example -The combination @samp{o+s} has no effect. On @acronym{GNU} systems -the combinations @samp{u+t} and @samp{g+t} have no effect, and -@samp{o+t} acts like plain @samp{+t}. +Remember that the special permissions only affect files that are +executable, plus, on some systems, directories (on which they have +different meanings; @pxref{Mode Structure}). Using @samp{a} +in the @var{users} part of a symbolic mode does not cause the special +permissions to be affected; thus, + +@example +a+s +@end example + +@noindent +has @emph{no effect}. You must use @samp{u}, @samp{g}, and @samp{o} +explicitly to affect the special permissions. Also, the +combinations @samp{u+t}, @samp{g+t}, and @samp{o+s} have no effect. The @samp{=} operator is not very useful with special permissions; for example, the mode: @@ -328,7 +300,7 @@ o=t @end example @noindent -does set the restricted deletion flag or sticky bit, but it also +does cause the file to be saved on the swap device, but it also removes all read, write, and execute permissions that users not in the file's group might have had for it. @@ -338,7 +310,9 @@ file's group might have had for it. @cindex conditional executability There is one more special type of symbolic permission: if you use @samp{X} instead of @samp{x}, execute permission is affected only if the -file is a directory or already had execute permission. +file already had execute permission or is a directory. It affects +directories' execute permission even if they did not initially have any +execute permissions set. For example, this mode: @@ -347,8 +321,8 @@ a+X @end example @noindent -gives all users permission to search directories, or to execute files if -anyone could execute them before. +gives all users permission to execute files (or search directories) if +anyone could before. @node Multiple Changes @subsection Making Multiple Changes @@ -371,7 +345,7 @@ og+rX-w gives users other than the owner of the file read permission and, if it is a directory or if someone already had execute permission to it, gives them execute permission; and it also denies them write -permission to the file. It does not affect the permission that the +permission to it file. It does not affect the permission that the owner of the file has for it. The above mode is equivalent to the two modes: @@ -459,23 +433,22 @@ the file to all users. @cindex numeric modes @cindex file permissions, numeric @cindex octal numbers for file modes -As an +File permissions are stored internally as 16 bit integers. As an alternative to giving a symbolic mode, you can give an octal (base 8) -number that represents the new mode. +number that corresponds to the internal representation of the new mode. This number is always interpreted in octal; you do not have to add a leading 0, as you do in C. Mode 0055 is the same as mode 55. A numeric mode is usually shorter than the corresponding symbolic -mode, but it is limited in that it cannot take into account a file's +mode, but it is limited in that it can not take into account a file's previous permissions; it can only set them absolutely. -The permissions granted to the user, -to other users in the file's group, -and to other users not in the file's group each require three +The permissions granted to the user, to other users in the file's group, +and to other users not in the file's group are each stored as three bits, which are represented as one octal digit. The three special -permissions also require one bit each, and they are as a group -represented as another octal digit. Here is how the bits are arranged, -starting with the lowest valued bit: +permissions are also each stored as one bit, and they are as a group +represented as another octal digit. Here is how the bits are arranged +in the 16 bit integer, starting with the lowest valued bit: @example Value in Corresponding @@ -497,7 +470,7 @@ Mode Permission 400 Read Special permissions: -1000 Restricted deletion flag or sticky bit +1000 Save text image on swap device 2000 Set group ID on execution 4000 Set user ID on execution @end example @@ -505,4 +478,4 @@ Mode Permission For example, numeric mode 4755 corresponds to symbolic mode @samp{u=rwxs,go=rx}, and numeric mode 664 corresponds to symbolic mode @samp{ug=rw,o=r}. Numeric mode 0 corresponds to symbolic mode -@samp{a=}. +@samp{ugo=}. |