Tag Info

New answers tagged

0

To give a binary permission to run things as root, you need to set the "sticky bit" on the binary. Normally after compiling, you might see: # ls -l print -rwxr-xr-x 1 mark mark 111 24 Oct 17:32 print Setting the set-uid (sticky) bit can be done using and octal mode, or symbolically: # chown root print # chmod o-x print # chmod u+s print # ls -l print ...


0

chown root:root name_of_binary chmod 4755 name_of_binary


3

It is there for an obvious reason. To quote from this answer, When you are creating an account to run a daemon, service, or other system software, rather than an account for interactive use. Technically, it makes no difference, but in the real world it turns out there are long term benefits in keeping user and software accounts in separate ...


0

It appears that you have your Gmail password in the configuration file so you would want the the third number to be 0 (No permissions to Others). Ideal is 640. You can change the ownership of the configuration file (using the command chown) e.g. chown root:mail /etc/ssmtp/ssmtp.conf. You can send from the command line using sudo or as root. Your web server ...


0

Cannot use apt-get --reinstall install cron because it gives back the following error: gateway:/home/firewall# apt-get --reinstall install cron Reading package lists... Done Building dependency tree... Done Suggested packages: anacron logrotate lockfile-progs checksecurity Recommended packages: exim4 postfix mail-transport-agent The following NEW ...


1

From man ssh_config: ~/.ssh/config This is the per-user configuration file. The format of this file is described above. This file is used by the SSH client. Because of the potential for abuse, this file must have strict permissions: read/write for the user, and not accessible by others. Your private keys and your ...


0

Is this analogy of mine correct, or is it a big blunder? I think it's correct, you need wx permission to be able to write to a folder. Irrespective of the previous answer, is there any situation where having a folder with permissions as described is appropriate? You may have a process that writes information in a folder and another ...


0

To "add a little step, like an option or confirmation message", you can do what artm suggested in the comments to your question: use a wrapper script. In other words, rather than dealing directly with the somewhat daunting command line arguments of dd directly, create a script in bash (or Python, etc) that takes the dd arguments that you're interested in, ...


5

It's reasonable to ask why the dd command doesn't first check whether its target contains a mounted filesystem, and then prompt for confirmation or require a special flag. One simple answer is that it would break any scripts that expect to be able to use dd in this way, and that aren't designed to handle interactive input. For instance, it can be reasonable ...


9

I know dd is supposed to be a power user tool but still, it doesn't make sense to me that you can basically screw your whole computer by hitting the wrong key. Consider the kinds of power tools used in civil construction and what you can screw up by doing one little thing wrong. Could those things be made more preventable? Probably, but the counter ...


-1

open("/usr/local/etc/no-ip2.conf", O_RDWR) = -1 EACCES (Permission denied) open("/usr/local/etc/no-ip2.conf", O_RDONLY) = -1 EACCES (Permission denied) noip2 tries to open its configuration file for reading and writing, and when this fails it tries again just to read, which also fails. The failure is due to a lack of permission; the error message is ...


1

I like this permissions calculator: http://file-permissions.ninja


1

In your /etc/exports you need to replace the 192.168.1.* with 192.168.1.0/24, you can only use wildcards in hostnames. You also need to create the mountpoints on the client system, you only show the current mountpoint /mnt/green; /mnt/nuci5 and /mnt/nuci5-extra must also exist. Maybe they do, but you filtered those out in that case. Beyond that it should ...


1

The file permissions specifically do not allow read, write or execute of that file to the owner (user1). If you were to change the owner to another user, then you would be able to read the file under the group permissions. Excert from File system permissions wiki page Classes ... The effective permissions are determined based on the user's class. ...


1

It's possible with SGID. So can read more on this here: http://linoxide.com/how-tos/stickbit-suid-guid/ Example on how to actually do it: Implementation of SGID on directory: # chmod g+s /test/ # ls -ld /test drwxrwsrwx 2 root root 4096 Mar 8 03:12 /test Now swich to other user and create a file in /test directory. # su - roger $ cd /test/ $ touch ...


-1

While L.D.James' answer (no longer here) put me onto the whole users and groups issue it was not wholly helpful. Thankfully it was enough to get Google involved. Here are the steps I took to solve the problem. The folder was owned by root which would not be a good group to add a user to. The solution was to create a special group. I called it "www" because ...


1

There's another similar question and bindfs is suggested there: mkdir /home/$user/sda1 bindfs -u $user -g $group /mnt/sda1 /home/$user/sda1 OSX users suggest noowners mount option described like this: Ignore the ownership field for the entire volume. This causes all objects to appear as owned by user ID 99 and group ID 99. User ID 99 is ...


0

Yes, cyrus does that. You need to login as cyrus user and then it should work, but if i remember right, you first need to create the user directory where the user has rights and only he can then create another (his) directories there.


1

This sounds like the user you're running has the default group set to yuri. You can confirm this like so: $ id -a uid=1000(saml) gid=1000(saml) groups=1000(saml),10(wheel),989(wireshark) The UID of your account is this: uid=1000(saml) whereas the default group is git=1000(saml) and any secondary groups are thereafter. NOTE: If you want the git clone to ...


1

Really all that is needed is to make sure that there is a directory in /mnt/bar that is writable by the influxdb user sudo mkdir /mnt/bar/influxdb sudo chown influxdb:influxdb /mnt/bar/influxdb Only root and influxdb will be able to write to it.


0

If you would like to have the user-influxdb for rw, you can chmod with 755! The disturbing point with 777 is that user has the control over anything in that mount point.


4

It sounds like opatch is a script. That is, it is a text file that starts with #! and lists its interpreter (maybe /bin/sh). Only compiled binaries (directly executable code) can be executed without read permission. For all scripts, no matter the interpreter (sh, python, etc...), the interpreter needs to be able to open the file, which mandates read ...


0

For directories and files already created: find /start_directory -type d -exec chmod 755 {} \; find /start_directory -type f -exec chmod 660 {} \; If your users should be able to create new files and/or subdirectories please give more details because a solution depends on exact requirements.


1

Well, just don't set the same permissions on the directory and the files within it: $ chmod g+rx directory/ $ chmod g= directory/* Here, the group members can enter and browse the directory, yet they won't be able to read the files within it. Edit: regarding your new title, I would suggest: $ chmod a+rx directory/ $ chmod u=rwX,g=rX,o= *


0

I normally use the following: find . -type f -print0 | xargs -0 sudo chmod 440 find . -type d -print0 | xargs -0 sudo chmod 555 However, that doesn't take into account executables. I was thinking of doing something like this for files: find . -type f -print0 | xargs -0 sudo chmod ug+r ug-w o-rwx But it's still two commands and I'm not sure if this is ...


0

I think it is because of the "noexec" mount option for the folder your script is in. You may try to check that by this command mount | grep `df -P /path/to/folder/with/script | tail -1 | cut -d ' ' -f 1`


2

I think you're pointing to this from the man page: When the owner or group of an executable file are changed by an unprivileged user the S_ISUID and S_ISGID mode bits are cleared. So why are they cleared now. You see they are only cleared in case of an executable file. Because when one of the bits (SUID/SGID) is set, the unprivileged user can ...


1

I think you misread man 2 chown: you don't have to clear S_ISUID and S_ISGID, they will automatically be cleared when you use that function as an unprivileged user. If your program is running as root the behaviour (on Linux) depends on the kernel version. If you need the bits set, just reapply them (assuming the account that tries to set them has the ...


0

After asking around on other places I found the answer. Following the instructions here and setting the umask to 0, I managed to set the permissions the way I want it.


6

There are two commands related to root privileges, SUDO and SU. With SUDO, you don't become another user (including root). SUDO has a pre-defined list of approved commands that it executes on your behalf (this addresses what I asked in the comment about how you give selected users selective privileges). Since you are not becoming root or another user, you ...


2

Another approach: if >> /path/to/file then echo "writeable" else echo "write permission denied" fi This will attempt to open the file for appending, and, if that succeeds, run no command (i.e., run a null command) with output to the file.  Beware that this creates an empty file if it didn't exist. The -w operator of the test command might ...


2

There isn't any native mechanism to easily achieve it. Linux's permission system cannot specify separate permissions for creating files and directories because directories are files in fact. But try such way: Make all archive directories to be owned by a one (or few different) user, created just for this purpose. Lets assume its name archiveuser. Make all ...


2

Short answer is you can't. If you allow someone (e.g. simth) in sudoer's group, he can issue a sudo su - then become root, then anoter user (e.g. wesson). This is an alternate way of giving root's password to simth. However he (smith) can change root passwd. Notes also that 1) you must specify in /etc/sudoers a line like %sudo ALL=(ALL:ALL) ALL 2) ...


11

The major difference between sudo and su is the mechanism used to authenticate. With su the user must know the root password (which should be a closely guarded secret), while with sudo the user uses his/her own password. In order to stop all users causing mayhem, the priviliges discharged by the sudo command can, fortunately, be configured using the ...


13

Just use the -w flag of the test utillity: [ -w /path/to/file ] && echo "writeable" || echo "write permission denied" Note that if you're going to write to the file later, it's still possible that you won't be able to write to it. The file may have moved, the permissions may have changed, etc. It can also happen that -w detects write permissions ...


0

Im not sure what "Windows super-administrator" is but, what you are asking for is root. You can run it using sudo.


1

Your understanding is wrong. root is all-powerful, and becoming other users is a critical part of root's usefulness.


8

In Linux/Unix the user with user id 0 is such a super administrator. The user is usually called "root", but the magic is really behind the id and not the name. That user is especially not bound to local file access permissions and can read and write any file. That user also has the ability to change to any other user without needing a password.


0

We can't know how that happened. You haven't even told us if this is your personal computer, if it's a server, if it is your computer but acting as a server, what OS you are running or anything else that we might use to guess how it happened. You didn't even tell us where these files are found but, presumably, they are in directly under your $HOME. Anyway, ...


0

Pipe the contents of chmod into an already executable file cp /usr/bin/executable_file ~/executable_file cat /usr/bin/chmod > ~/executable_file ~/executable_file +x file_to_be_executed.sh


2

Using GNU find, you can search for all directories and files that belong to groupX: find / -group groupX From man find: -group gname File belongs to group gname (numeric group ID allowed).


-1

You might also adjust your SELinux settings, and setenforce may not be on your path. So try this: sudo /usr/sbin/setenforce 0 and to make this persist between reboots sudo vi /etc/sysconfig/selinux


1

All permission bits can be set or cleared independently. Some combinations are very common, others serve no practical purpose. ls uses a capital letter S to mean “s without x” to highlight that this is an odd, possibly erroneous setting. If a file is not executable by anyone, its setuid and setgid bits are not relevant. Keep in mind that even if the file's ...


0

is_readable /path/to/file is spelled test -r /path/to/file or [ -r /path/to/file ] or [[ -r /path/to/file ]]. See using single or double bracket - bash for how they differ. is_writable uses -w. Not being able to access a file is not a very good indicator of “needing sudo”. It may be that you should run as a different user or group, not as root. It may be ...


1

Option 1: The permissions of the files inside the directory doesn't matter, blocking at the directory level is usually enough, so chmod 2750 /path-to-dir is enough. Option 2: Use ACLs only (chmod 2750 /path-to-dir is not necessary, but make things nicer for people not used to ACLs). setfacl -R -b -d -m o::--- -m u::rwX -m g::rX . note that you could set ...


2

You can try the -w switch of the test utillity: [ -w /path/to/file ] && do_command /path/to/file || sudo do_command /path/to/file Or the long version: if [ -w /path/to/file ]; then do_command /path/to/file else sudo do_command /path/to/file fi From the manpage -w FILE FILE exists and write permission is granted


2

Now, I believe with setuid any user could execute the script. Not quite. To make the script executable by every user, you just need to set a+rx permissions: chmod a+rx script setuid means that the script is always executed with the owner's permissions, that is, if you have the following binary: martin@dogmeat ~ % touch dangerous martin@dogmeat ~ % ...


17

You can use the Linux dynamic linker/loader directly to run ELF executables for which you have read, but not execute rights: $ /lib/ld-linux.so.* /home/user1/binary_program When an ELF executable is executed ordinarily, the dynamic linker which is stored in the .interp section of the program code is used. Reasons for invoking the dynamic linker directly ...


15

Since you have read permission: $ cp ~/binary_program my_binary $ chmod +x my_binary $ ./my_binary Of course this will not auto-magically grant you escalated privileges. You would still be executing that binary as a regular user.


3

Put a* and d* under quotes, so that shell would not expand them,and also add -name keyword. If you only want to search for files and not also directories for example then add -type f. find . -name 'a*' -type f -exec chmod o+r {} \; find . -name '*d' -type f -exec chmod o+x {} \; If you want to change only in current directory and not subdirectories, add ...



Top 50 recent answers are included