New answers tagged

55

No, the sticky bit was not like the set-UID or set-GID flags. It didn't effect any changes to process credentials. What the sticky bit did was make the program text "sticky". It wasn't a misnomer, originally. background: program image sections and shared text In essence, without getting too deep into the details of executable file formats (which can, ...


0

I'm not entierly sure, but you should be able to do it as described below. Grant Write permission for the Users group that is applied to This Folder only. (This is an option available on the Advanced page.) If each user needs to have certain permissions to the files that he or she dropped, you can create a permission entry for the Creator Owner ...


7

They are not the same. The -g option specifies the "primary" group that a user should belong to, while the -G option specifies one or many supplementary ("secondary") groups. On a work machine I have access to I have $ id uid=1001(me) gid=1001(me) groups=1001(me),27(sudo),110(lxd),1005(theproject) This shows that my "primary" group is me (same as my ...


1

The group applied via -g is the primary group, so for example when you create a file it will default to making it with your primary group as the group associated with that file. You can however temporarily change which group it uses as default with the sg or newgrp commands. All groups in the -G are secondary groups. More about this here


11

-g sets the initial, or primary, group. This is what appears in the group field in /etc/passwd. On many distributions the primary group name is the same as the user name. -G sets the supplementary, or additional, groups. These are the groups in /etc/group that list your user account. This might include groups such as sudo, staff, etc.


1

In my case I've found that I can add an entry to /etc/group that masks the Active Directory entry. (This might not be the correct solution but in my situation it works). Here is what I would add for your example, where getent group 67uts-mq-admins returns 67uts-mq-admins:x:57376: mqm:x:57376: You may be able to run the command addgroup --gid 57376 mqm or ...


0

It's best to add a user with restricted privileges, see this post for more details. On the other hand you can also limit his login shell, for example useradd -s $(which mysql) whatshisname This makes his default shell mysql


0

Hugo. You can create an inbound rule in your vpc security group to allow remote connections to port 3306, which is used from mysql. In this way your users will bi able to access the mysql via mysql-client installed on their computers without the need to connect via ssh.


1

You wrote: result of execution of ls -l $(type -p su) -rwxr-xr-x root root 157400 2016-04-21 19:11 su There's your problem. su is missing the setuid root bit. The permissions should look like this: -rwsr-xr-x 1 root root 40040 Nov 12 2015 /bin/su There are three possibilities for this situation. The su executable on the server is not setuid (...


0

I realised the answer to use-case one this morning (as I woke up). How can a pupil set a file to be readable by self and sub-math-teacher? To do this the pupil can use file access control lists: setfacl -m g:subMathTeacher:r file-to-share-with-teacher The pupil does not need to belong to the group, to do this. There are problems with _ or - in group name ...


3

That's not what the default entry means on a ACL; if you look at the new file you created you'll see it already has an ACL (the + at the end of the ls output), and a getfacl test_file will show it has group:www-data:rwx associated with it. If you want the newly created file to be owned by www-data then you need to add the setgid bit on the directory. ...


-1

If you would type sudo -s in the terminal then all command afterward will be executed as sudo, but I would not suggest staying in such mode if not necessary.


0

Just in case anyone was wondering this is what I did to fix this problem. Fix: sudo setfacl -R -b This recursively (-R) removes all (-b) acl permissions I was also getting a group write warning for the following files: /var/lib/sudo/lectured /var/lib/sudo/ts Fix: sudo chmod 700 for both of the files and that correct the permissions and it fixed ...


1

If I get your question right you want to establish some kind of sub-administrator. Actually you're asking for different roles with different privileges. At Unix/Linux system level there is only the all-powerful superuser and ordinary users, nothing in between. Maybe some sudo-magic might do the trick. However, if you just want to share documents, then you're ...


3

In my answer I will not concern myself with Vim, but instead look at the underlying mechanisms, that you have stumbled upon. It is important to understand these, as it affects the security of your entire system. It has nothing to do with owner: try it, make a file not owned by you, then give your self read not write. You will get the same results. So why is ...


3

With "wq", "!" asks Vim to ignore the read-only attribute. From the documentation: :wq [++opt] Write the current file and quit. Writing fails when the file is read-only or the buffer does not have a name. Quitting fails when the last file in the argument list has not been edited. :wq! [++opt] ...


0

Do you have an entry for user1 in your /etc/passwd ? If you want to change the ownership of the directory you can type as root: chown apache:apache /var/www -R You can also add user1 to apache group and in this way your web server will fine. Maybe it's good idea to read the following topic: How can I create an SFTP user in CentOS?


1

Typically this happens if the NFS share isn't exported properly. By default, the root user is mapped to nobody. This means that when you try and run su (which is suid root) then you will try to access files on the NFS server as user nobody... and this won't let you read /etc/shadow and similar. You didn't say what your NFS server is, but if it's the ...


2

Boot into recovery on your droplet and you should be able to at least login after fixing some permissions. You might need some trial and error on which directories will be necessary. I'd start with /bin, /sbin, /usr/bin etc.


1

Just in case anyone is interested in further studies and/or clarification: In a nearly POSIX compliant shell implemented a while ago the internal workings of the 'exec_program()' and the 'builtin_source()' functions are very exemplary. In those functions you see exactly what is the difference between them: https://github.com/rsenn/shish/blob/master/src/...


1

Yes, doing it as the root user would allow you to change the permissions on (and owner of) these files and directories. $ cd /backup/dir/somewhere $ sudo chown myname:mygroup myfile $ sudo chmod u+rw myfile ... where myname and mygroup is your username and default group (check you other files in your home directory or use id -n -u (for username) and id -n ...


0

You need to become root (using su or sudo) as only the owner of a file can change its permissions.


1

They mean "make it executable by the user that will be invoking the application". This is usually what is meant by "making a file executable" when nothing else is specified. They also say "make sure it's owned by git", which makes it even more explicit that they need the file to be executable by the owner, which should be the git user. Hence (possibly with ...


0

Indeed what I proposed above worked. The answer is to do -rwxr--r-- 1 git git 0 Jun 24 00:32 pre-receive


0

Hmm, I can reproduce this with setfacl -m default:group:foogrp:rwx foodir though in that case I cannot even chdir into the directory (did the user chdir before the ACL were applied?). Is there a reason you need to use the default group? E.g. what happens after something like: setfacl -k example.com setfacl -m group:dev:rwx example.com To nix the ...


20

Bash is an interpreter; it accepts input and does whatever it wants to. It doesn't need to heed the executable bit. In fact, Bash is portable, and can run on operating systems and filesystems that don't have any concept of an executable bit. What does care about the executable bit is the operating system kernel. When the Linux kernel performs an exec, ...


4

As far as the OS is concerned, a file containing shell script is just data. If you pass the name of such a data file to the source command or pass it on the command line to an invocation of the bash shell, all the OS sees is a string that happens to coincide with the name of a file containing data. How would the execute bit be at all relevant in that case?


2

Executive summary: "root" is the actual name of the administrator account. "sudo" is a command which allows ordinary users to perform administrative tasks. "Sudo" is not a user. Long answer: "root" (aka "superuser") is the name of the system administrator account. The origins of the name are a little archaic, but that doesn't matter. Root user has user ...


3

The distinction is important because you may have a file of shell commands which is not useful as an executable, but only useful when sourced. For this file you can turn off the execute bit and then it will never be accessed unless explicitly in a source command. The reason for such a thing is to have side effects on the shell it is run from. For a ...


-2

Another point of view: Sourced script basically consists of shell builtins and program calls. Shell builtins (with source among them) are parts of the shell and the shell must be executable in the first place. Every program called (that being ELF, another script with shebang, whatever) has to have execution bit set, otherwise it will not run. So it is not ...


8

That's a good question! Unix uses the executable bit to distinguish between programs and data. The OS does not require the execution bit, since a sourced script is not passed to the OS for execution as a new process. But the shell treats a sourced script as a program, and will look in $PATH for the file you want to source. So, the shell itself could have ...


18

The executable bit (unlike the rest) on nonsetuid and nonsetguid files isn't much of a security mechanism. Anything you can read, you can run indirectly, and Linux will let you indirectly read anything you can run but not directly read (that should be enough to punch a hole in the concept of non-set(g)uid x-bit being a security measure). It's more of a ...


48

source or the equivalent but standard dot . do not execute the script, but read the commands from script file, then execute them, line by line, in current shell environment. There's nothing against the use of execution bit, because the shell only need read permission to read the content of file. The execution bit is only required when you run the script. ...


9

Maybe searching a little more: http://superuser.com/questions/501818/changing-ownership-without-the-sudo-command#501824 Reboot, hold down right shift key to bring up the grub2 boot menu. Then follow these instructions to enter single user mode. How do I boot into single user mode from grub? In single user mode you can fix the file permissions ...


3

Unix systems provide the chroot command which allows you to reset the / of the user to some directory in the filesystem hierarchy, where they cannot access "higher-up" files and directories. However in your case, it would appropriate to provide a virtual chroot implemented by the remote shell service. sftp can be easily configured to restrict a local user ...


0

i found the answer.. Because i was installing the app at my sd card thats why i could not access or change the permissions of the folder.. because it was located at the sd card and not at the phone storage.. fix that by installing the app at the phone storage!


2

The "+x" to which you refer is the symbolic mode argument to chmod. As given, and assuming that your chmod comes from Gnu Coreutils, that argument directs chmod to set the executable bits for user, group, and other, except for those executable bits set in your shell's umask. So, if your umask is 0077 (as is common) that command will only set the executable ...


1

chmod can give rights by two ways: 1) with numbers (eg chmod 744 file will make file wrx to you and r to group and others) 2) with specific right to specific category (eg chmod +x will give all the execute right) on your case i suppose tha your user and his group(maybe)need the execute right not everyone some more examples: chmod u=rx file (Give ...


2

x is a symbolic presentation of the executable mode (it can be in numeric format as well) that chmod command uses to set the executable permission of a file (in case of directories it sets their searchable mode). + sets executable mode and - unsets it. From man page of chmod: The format of a symbolic mode is [ugoa...][[+-=][perms...]...], where perms ...


1

I worked it out - our system used CloudLinux and the other user was operating under CageFS determined by running: /usr/sbin/cagefsctl --list-enabled Following the instructions at: https://www.ndchost.com/wiki/cloudlinux/how-to-add-commands-to-cagefs-users, I then added xvfb to the Cage: vi /etc/cagefs/conf.d/binutils.cfg Then added the lines: [custom] ...


15

In the image you show that the "other" group has read permissions; if you tried to append echo testline >> useradd or execute ./useradd it would give you a permission denied. If you're looking to remove read permissions for the 'other' users you can use sudo chmod o-r useradd


7

I believe it is because the permission on the useradd file is set to rw-r--r--, thus giving read access to all users.


1

Ok. So screwing around with things I think I managed to solve me issue. For those using an Upstart script to fire and respawn PHP scripts you can add the following to your Upstart script to run as a specific user / group. setuid $user setgid $group Where $user and $group are the names of the specific user and group you want to run your script as. My ...


1

First question: Yes. Although you could have used the -G option to add the supplementary group Webdev at account creation time: -G Webdev. SELinux marks users' home directories as user_home_dir_t. Therefore to set the SELinux context you can use: # chcon -t user_home_dir_t /websites Note that if you had another user's home directory as reference, you ...


3

ACLs allow more than one person and more than one group to be granted permissions. For example, you might have an SA team and a DBA team. You want to grant SAs "read+write" access to a file, but the DBAs only read access. Since a file can only have one group owner this is hard to do. But with ACLs it is easy. ACL implementations are filesystem specific. ...


0

The solution I use is to run the command as the user that has the permissions you want to keep: sudo -u user command This keeps the permissions from changing. I use it when updating git repositories on my VPS, while keeping the file permissions set to the webserver user. See also the same question here.


0

The problem is the wrong context (postgresql_exec_t). The solution: semanage fcontext -a -t bin_t "usr/pgsql-9.5/bin(/.*)?" restorecon -vR /usr/pgsql-9.5/bin Note the new context bin_t. I thought reading this that `postgresql_exec_t was the correct context.


3

sshfs is using sftp under the hood and the umask for creation new files is handled by the remote sftp-server. You can set umask as an argument to the sftp-server in /etc/ssh/sshd_config on the server, such as Subsystem sftp /usr/lib/openssh/sftp-server -u 027 # Debian/Ubuntu or Subsystem sftp /usr/libexec/openssh/sftp-server -u 027 # RHEL/Fedora ...


2

Since rsyslog ignores setgid sticky bits I was able to correct the issue by using the following directives in my rsyslogd.conf custom template config: $template TmplAuth, "/var/log/projects/%FROMHOST-IP%/%PROGRAMNAME%.log" $template TmplMsg, "/var/log/projects/%FROMHOST-IP%/%PROGRAMNAME%.log" $umask 0000 $DirCreateMode 0750 $FileCreateMode 0640 $FileGroup ...


3

The method you made would work with programs that don't specifically manage their output permissions and ownership, but rsyslogd does. Rsyslogd's output module documentation page shows that you can use the fileGroup [groupName] configuration directive to set the default value for the output file's group.



Top 50 recent answers are included