Hot answers tagged

48

source or the equivalent but standard dot . do not execute the script, but read the commands from script file, then execute them, line by line, in current shell environment. There's nothing against the use of execution bit, because the shell only need read permission to read the content of file. The execution bit is only required when you run the script. ...


19

Bash is an interpreter; it accepts input and does whatever it wants to. It doesn't need to heed the executable bit. In fact, Bash is portable, and can run on operating systems and filesystems that don't have any concept of an executable bit. What does care about the executable bit is the operating system kernel. When the Linux kernel performs an exec, ...


18

The executable bit (unlike the rest) on nonsetuid and nonsetguid files isn't much of a security mechanism. Anything you can read, you can run indirectly, and Linux will let you indirectly read anything you can run but not directly read (that should be enough to punch a hole in the concept of non-set(g)uid x-bit being a security measure). It's more of a ...


15

In the image you show that the "other" group has read permissions; if you tried to append echo testline >> useradd or execute ./useradd it would give you a permission denied. If you're looking to remove read permissions for the 'other' users you can use sudo chmod o-r useradd


14

umask is subtractive, not prescriptive: permission bits set in umask are removed by default from modes specified by programs, but umask can't add permission bits. touch specifies mode 666 by default (the link is to the GNU implementation, but others behave in the same way; this is specified by POSIX), so the resulting file ends up with that masked by the ...


10

-g sets the initial, or primary, group. This is what appears in the group field in /etc/passwd. On many distributions the primary group name is the same as the user name. -G sets the supplementary, or additional, groups. These are the groups in /etc/group that list your user account. This might include groups such as sudo, staff, etc.


9

Maybe searching a little more: http://superuser.com/questions/501818/changing-ownership-without-the-sudo-command#501824 Reboot, hold down right shift key to bring up the grub2 boot menu. Then follow these instructions to enter single user mode. How do I boot into single user mode from grub? In single user mode you can fix the file permissions ...


8

That's a good question! Unix uses the executable bit to distinguish between programs and data. The OS does not require the execution bit, since a sourced script is not passed to the OS for execution as a new process. But the shell treats a sourced script as a program, and will look in $PATH for the file you want to source. So, the shell itself could have ...


7

I believe it is because the permission on the useradd file is set to rw-r--r--, thus giving read access to all users.


6

They are not the same. The -g option specifies the "primary" group that a user should belong to, while the -G option specifies one or many supplementary ("secondary") groups. On a work machine I have access to I have $ id uid=1001(me) gid=1001(me) groups=1001(me),27(sudo),110(lxd),1005(theproject) This shows that my "primary" group is me (same as my ...


4

As far as the OS is concerned, a file containing shell script is just data. If you pass the name of such a data file to the source command or pass it on the command line to an invocation of the bash shell, all the OS sees is a string that happens to coincide with the name of a file containing data. How would the execute bit be at all relevant in that case?


3

Unix systems provide the chroot command which allows you to reset the / of the user to some directory in the filesystem hierarchy, where they cannot access "higher-up" files and directories. However in your case, it would appropriate to provide a virtual chroot implemented by the remote shell service. sftp can be easily configured to restrict a local user ...


3

ACLs allow more than one person and more than one group to be granted permissions. For example, you might have an SA team and a DBA team. You want to grant SAs "read+write" access to a file, but the DBAs only read access. Since a file can only have one group owner this is hard to do. But with ACLs it is easy. ACL implementations are filesystem specific. ...


3

sshfs is using sftp under the hood and the umask for creation new files is handled by the remote sftp-server. You can set umask as an argument to the sftp-server in /etc/ssh/sshd_config on the server, such as Subsystem sftp /usr/lib/openssh/sftp-server -u 027 # Debian/Ubuntu or Subsystem sftp /usr/libexec/openssh/sftp-server -u 027 # RHEL/Fedora ...


3

The method you made would work with programs that don't specifically manage their output permissions and ownership, but rsyslogd does. Rsyslogd's output module documentation page shows that you can use the fileGroup [groupName] configuration directive to set the default value for the output file's group.


3

If you don't have write permission in the parent directory, you can't make any changes in the parent directory; this includes deleting the target directory, and creating a symlink. In any case, ln won't overwrite a directory, even with -f.


3

You can achieve that with ACLs, check this answer for an introduction: http://unix.stackexchange.com/a/12847/130303 You'll probably need default ACLs to achieve what you want to do. Lets say you have a directory test (with files and dirs already in it) and you want user and group to be able to write and others only to read, you can set default ACLs (...


3

The formula to calculate your file permission: default_mode & ~umask (Read the description of O_CREAT flag) Also specified by POSIX, the default mode for file is S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP | S_IRUSR | S_IWUSR or 666, the default mode for directory is S_IRWXU | S_IRWXG | S_IRWXO or 777 if it was not specified by application. Since when the ...


3

Moving files (without changing their ownership) only requires being able to write to the directories containing them. So, to move /home/usera/dir1/dir2 and its contents to /home/userb/dir3, starting as usera: cd ~/dir1 find . -type d -print0 | xargs -0 chmod 777 su userb cd ~/dir3 mv ~usera/dir1/dir2 . exit then, as usera, restore the permissions to ...


3

The distinction is important because you may have a file of shell commands which is not useful as an executable, but only useful when sourced. For this file you can turn off the execute bit and then it will never be accessed unless explicitly in a source command. The reason for such a thing is to have side effects on the shell it is run from. For a ...


3

With "wq", "!" asks Vim to ignore the read-only attribute. From the documentation: :wq [++opt] Write the current file and quit. Writing fails when the file is read-only or the buffer does not have a name. Quitting fails when the last file in the argument list has not been edited. :wq! [++opt] ...


3

In my answer I will not concern myself with Vim, but instead look at the underlying mechanisms, that you have stumbled upon. It is important to understand these, as it affects the security of your entire system. It has nothing to do with owner: try it, make a file not owned by you, then give your self read not write. You will get the same results. So why is ...


3

That's not what the default entry means on a ACL; if you look at the new file you created you'll see it already has an ACL (the + at the end of the ls output), and a getfacl test_file will show it has group:www-data:rwx associated with it. If you want the newly created file to be owned by www-data then you need to add the setgid bit on the directory. ...


2

Note that while you could edit the sudoers file (using visudo in a terminal as root), what you probably actually want to do is add yourself to the wheel group. See How to make Fedora user a sudoer? for details, but in short, this group is predefined as having sudo-for-everything privileges and is our standard "admin" group. (If you check the "make user an ...


2

In order to prevent root or any one from being able to read your files, you need to encrypt them. File Encryption is a very convenient option to look into if you wish to avoid having to deal with complex file system manipulations. Encryption Options: Encrypt ordinary files and prevent everyone but yourself from being able to view them Encrypt Shell ...


2

The following command should give users the capability to use ping6. As root run setcap cap_net_raw+ep /usr/bin/ping


2

Each user has its own crontab. By allowing the non-root users to write a root's crontab you make a security breach in your system, this is why crond rejects a file with such permissions. If you need to allow non-root accounts to perform some actions that require root privileges then consider to use sudo


2

Since rsyslog ignores setgid sticky bits I was able to correct the issue by using the following directives in my rsyslogd.conf custom template config: $template TmplAuth, "/var/log/projects/%FROMHOST-IP%/%PROGRAMNAME%.log" $template TmplMsg, "/var/log/projects/%FROMHOST-IP%/%PROGRAMNAME%.log" $umask 0000 $DirCreateMode 0750 $FileCreateMode 0640 $FileGroup ...


2

x is a symbolic presentation of the executable mode (it can be in numeric format as well) that chmod command uses to set the executable permission of a file (in case of directories it sets their searchable mode). + sets executable mode and - unsets it. From man page of chmod: The format of a symbolic mode is [ugoa...][[+-=][perms...]...], where perms ...


2

chmod o+rw yourfile For other add (+) read and write permissions. I think it's quite semantically meaningful. Alternatively, you could learn the numeric notation. R is worth 4, W is worth 2 and X is worth 1. If you want read and write, for example, you add 4 and 2 together giving 6. So to keep the permissions the same for owner (6) and group (4) you ...



Only top voted, non community-wiki answers of a minimum length are eligible