Tag Info

Hot answers tagged

71

The reason why this is permitted is related to what removing a file actually does. Conceptually, rm's job is to remove a name entry from a directory. The fact that the file may then become unreachable if that was the file's only name and that the inode and space occupied by the file can therefore be recovered at that point is almost incidental. The name of ...


31

You can. You just have to set the executable bit on the /a/b directory. That will prevent being able to see anything in b, but you can still do everything if you go directly to a/b/c. % mkdir -p a/b/c % chmod 711 a/b % sudo chown root a/b % ll a/b ls: cannot open directory a/b: Permission denied % touch a/b/c/this.txt % ls a/b/c this.txt Beware that ...


9

chmod a+x TEMPFILES As directories must have the eXecute bit because reasons[1]. (You may also want the sticky bit like is set on for example /tmp.) [1] "Note that read permission for a directory and execute permission for a directory mean different things. Read permission lets us read the directory, obtaining a list of all the filenames in the directory. ...


8

With those permissions, you can't reach your goal. In order to get to directory c, you must allow all other users to traverse directory b which is done by giving execute permission for that directory. With /a/b set to mode 711, you can achieve what you want since you are granting directory traversal but denying read and write. But do keep in mind that while ...


7

use ls -l -d /tmp/ and you will see that the permissions are set to drwxrwxrwt, i.e. d: a directory, rwx: read, write and execute permissions allowed for owner, group and others (in this order), t sticky bit, i.e. only file owners are allowed to delete files (not the group despite permissions). Let's leave the sticky bit aside for the moment and mention that ...


6

find will set its return code to non-zero if it saw an error. So you can do: if ! find ... then echo had an error >&2 fi | while ... (I'm not sure what you want to do with the find output). To collect all the error messages from find on stderr (file descriptor 2) you can redirect 2 to a file. Eg: if ! find ... 2>/tmp/errors then ...


6

You could use bindfs like: $ ls -ld dir drwxr-xr-t 2 stephane stephane 4096 Aug 12 12:28 dir/ That directory is owned by stephane, with group stephane (stephane being its only member). Also note the t that prevents users from renaming or removing entries that they don't own. $ sudo bindfs -u root -p u=rwD,g=r,dg=rwx,o=rD dir dir We bindfs dir over ...


6

umask 002 Files (and directories) after this will be created with 0664 permissions.


5

In order to remove a file, you just need to be able to write to the directory the file is in. If you don't like this, you could set the "sticky" bit via chmod +t dir if you are on a halfway recent OS (this feature was introduced around 1986 in SunOS). If you like to be more fine grained, you need a filesystem with a modern ACL implementaion like ZFS. The ...


4

Only the owner of a file, or the root user, can change the permissions of a file. You need either to change ownership of the file so it is owned by the deploy user, or run the script as root.


4

The reason is probably that / (containing /etc) is a read only filesystem, but has a symlink for /etc/shadow, /etc/passwd, and other dynamic files that lands on a read-write filesystem. This will allow you to edit the shadow and passwd files directly. The sed -i fails because its implementation doesn't actually update in place. Rather, it creates a ...


4

Linux, like most Unix-like systems (Apple OS/X being one of the rare exceptions), ignores permissions on symlinks when it comes to resolving their targets for instance. However ownership of symlinks, like other files, is relevant when it comes to the permission to rename or unlink their entries in directories that have the t bit set, such as /tmp. To be ...


4

It's history time, kids! Stevens, "APUE", chapter 4, section 10 quotes thusly: "The S_ISVTX bit has an interesting history ... if it was set ... a copy of the program's text was saved in the swap area ... this caused the program to load into memory faster the next time ... later versions of Unix referred to this as the saved-text bit, hence the constant ...


4

The command du will show you the disk space used by your files and directory. du -sh /home/* will show you the size of each subdirectory directly below the /home directory, afterwards depending on your preferences you might then: Either run the same command against one of these directories to manually step one level lower (for instance du -sh ...


4

I didn't know the problem was SELinux but I discovered that was the problem because I turned it off with setenforce 0 and then it worked. This is how it looked when I listed the files with ls -alZ -rwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 file1.pdf -rwxr-xr-x. apache apache unconfined_u:object_r:user_home_t:s0 file2.pdf so ...


3

Probably your NTFS volume is mounted with option noexec, which is the default enforced by permissions. See man ntfs-3g for details. You could selectively enable exec option by adding it to fstab. UUID=82440D36440D2F0B /media/federicop/Data ntfs-3g auto,users,permissions,exec 0 0 Run grep /media/federicop/Data /proc/mounts to know mount options actually ...


3

You can just use for loop to run chmod on all files/folder returned by find command. for i in `find /home/ -name ".*" -perm /g+w,o+w`; do chmod go-w $i; done This will run chmod go-w on all files/folder which were found with the find command. This is how it would look like a bash script. #!/bin/bash for i in `find /home/ -name ".*" -perm /g+w,o+w`; do ...


3

An easy solution in order to run a number of commands with sudo is the following: sudo bash -c 'command1;command2' For your situation this would work great: sudo bash -c 'ls -l >/directoryname/filename' This of course is only when you are using bash.


3

If you are trying to delete a directory foo/bar/, the permissions of bar isn't the relevant factor. Removing the name bar from directory foo is a modification of foo. So you need write permissions on foo. In your case, check the current directory's permissions with ls -ld . You might find this answer to "why is rm allowed to delete a file under ownership ...


2

No, there is not. If the user has permissions to write the directory that contains the symlink, then they will be able to do the following things: Remove all kinds of files from that directory Create all kinds of files in that directory Rename files within that directory Move files into the directory (assuming they also have write permission on the ...


2

When the Linux kernel detects a new device, it sends a message to udev. The job of udev is to make the new device accessible to user land. For many devices, all udev needs to do is to create entries in /dev. For block devices, this allows the device to be mounted. For character devices such as serial ports and sound ports, this allows dedicated applications ...


2

If a user can't access /a/b, then they can't access any file under /a/b/c. The permissions on /a/b/c are irrelevant since directory traversal stops at /a/b. If all you want is to prevent the directory /a/b from being listed, but you're fine with users accessing files in /a/b if they guess a file name, then you can make /a/b executable but not readable. On a ...


2

The chattr +a option will allow appending only. Files may be altered that way, but only by adding (i.e. appending lines) to them. You cannot delete existing files, but create new ones. This might fit your needs: sudo chattr -R +a /dir/to/apply/to from man chattr A file with the `a' attribute set can only be open in append mode for writing. Only the ...


2

Deleting a file requires write permission on the directory. This is because you are actually modifying the directory when you delete the file (You don't even need permissions on the file to delete it if you can write in the directory, you'll just receive a warning about deleting a write-protected file). You just need to give the group write permissions on ...


2

Log out and log back in. You probably added the group during your current session.


2

What you can do is open the file and pass the file descriptor to the other process over a unix-domain socket using the sendmsg system call with SCM_RIGHTS. You can also determine what user ID is running the remote process by reading the SO_PEERCRED socket option. So taken together this allows you to grant control to a specific process, but it's not as ...


2

Your home folder contains two directories you own, /home/sougata and /home/sougatapc. The 182 GB you look for are these subdirectories plus possibly in an hidden one. To display hidden directories, use ls -la /home. On the other hand, unless you had a file system corruption and some files and directories were recovered with fsck, your lost+found directory ...


2

use tmux or screen, so when the connection drops, you just reconnect to that session. opening up permissions on directories might break e.g. SSH that checks e.g. ~/.ssh/* permissions, hard to say without specifics on what is failing (check the logs for the webserver/database/system?). find /that/backup/dir -type d -ls > /root/backupdirlist; find ...


1

With the outdated ACL proposal from 1993 that was withdrawn in 1997, there is no way to do this as bar could always change the permissions in a way that could prevent foo from being able to control things. Note that this ACL proposal did never become a standard because users have been unhappy with it from the beginning. I recommend to use a more modern ...


1

You're right, sudo to a user with read but not write permission will run a command in a way that only has write access to files you give it permission for. sudo -u some_user cmdname Running arbitrary user-uploaded programs requires extreme security precautions. Local-root exploits are unfortunately not uncommon in Linux. Letting users run programs they ...



Only top voted, non community-wiki answers of a minimum length are eligible