Tips and Examples

• Using Pathnames
• Using a Pathname to Run a Script
• Practice with Access Permissions

Review

• Access Permissions
• Viewing Access Permissions
• chmod
• Using chmod with Numeric Arguments

New Material

• The root Account
• Directory Access Permissions
• Links
• The Two Types of Links
• ln
• Removing a Link
• Setuid and Setgid Permissions
• Setting Setuid and Setgid with chmod

Studying

• Read the Material Before Class

Questions

Are there any questions before I begin?

Homework 5

I have posted homework 5 here.

It is due this coming Sunday at 11:59 PM.

Quiz 3

I have posted the answers to Quiz 3 here.

Tips and Examples

Using Pathnames

• If you want to work with a file ...
• you usually go to the directory that contains the file
• When you do this you can use just the name of the file ...
• when you need to run a command on it
• I have some web pages that offer help with Linux
• They are contained in the directory /home/ghoffman/public_html/linux
• One of these files is common_unix_commands.html
• Let's say I wanted to find a mention of the finger command on this page
• If I were in the directory that held the file I would simply type

  $ grep -n finger common_unix_commands.html

• The -n option will give me the line number
• If I were in my home directory and I could use a relative pathname

  grep -n finger public_html/linux/common_unix_commands.html

• The file I want to access is below my current directory
• So the path will list the directories between my current directory ...
• and the directory that contains the file
• What if I wanted you to make a copy of this file to practice with?
• Each of you would be in a different directory when you copied the file
• So I would give each of you an absolute pathname
• Then you would type

  cp  /home/ghoffman/public_html/linux/common_unix_commands.html  .

Using a Pathname to Run a Script

• In a few weeks I will show you how to make a Bash script executable
• This will allow you to run the script without first typing bash
• If you do this and place the script in a special directory ...
• you can run the script just by typing its name on the command line
• If the script is not located in one of these special directories ...
• you have to use a pathname to run the script
• The scripts you use to check your class exercises ...
• are not in one of these special directories
• They are stored in the directory /home/ghoffman/code/it244_code/testing_scripts_it244
• That's why to run the script to check your ex10.sh ...
• you have to use the pathname ~ghoffman/code/it244_code/testing_scripts_it244/ex10.sh
• This is a absolute pathname because it starts with ~
• After you hit Enter or Return ...
• Bash will chage ~ghoffman to /home/ghoffman
• Because this is an absolute pathname ...
• you can use this anywhere in the filesystem
• The pathname to run step_comment_check.sh is

  ~ghoffman/it244_test/step_comment_check.sh

• Is also an absolute pathname

Practice with Access Permissions

• You will need to know how to use chmod to change access permissions ...
• on the Midterm and Final exams
• You will get some practice with chmod in the Class Exercise for this class
• I have also created a web page to give you extra practice with chmod
• You will find this page here
• The page also has a link to the answers
• There is a link to the chmod practice page on the class web page

Review

Access Permissions

• All Unix files and directories have access permissions
• The access permissions allow the owner control of a file or directory
• They regulate who gets to do what with the file or directory
• The owner of a file or directory is the user account that created it
• Every file, directory or device on a Unix filesystem has three types of permissions
  • Read
  • Write
  • Execute
• Each access permission can either be on or off
• If you have read permission on a file you can look at the data in the file
• If you only have read permission, you cannot change a file
• To change a file you need write permission
• To run a program or script using only its name on the command line ...
• you must have execute permission on that file
• These permissions apply to three classes of users
  • The owner
  • The group
  • Every other account
• Every file or directory has an owner
• The account that created the file is the owner
• A group is a collection of Unix accounts
• A group can only be set up by a system administrator
• Every file or directory is assigned to a group
• The last class of users is everyone else
• Any account that is not the owner or a member of the group ...
• is a member of this user class
• It is sometimes called other

Viewing Access Permissions

• To view the permissions of a file or directory use ls -l

  it244gh@itserver6:~$ ls -l
  total 4
  -rw-r--r-- 1 it244gh ugrad    0 May  7 09:47 foo.txt
  lrwxrwxrwx 1 it244gh ugrad   36 Sep 23  2017 it116 -> /courses/it116/f25/ghoffman/it244gh/
  lrwxrwxrwx 1 it244gh ugrad   36 Sep 23  2017 it117 -> /courses/it117/f25/ghoffman/it244gh/
  lrwxrwxrwx 1 it244gh ugrad   36 Sep 23  2017 it244 -> /courses/it244/f25/ghoffman/it244gh/
  drwxrwxrwx 5 it244gh ugrad 4096 Apr  7 09:34 tmp

• The character in the first column indicates the type of file
• A dash, -, means an ordinary file
• The letter d indicates a directory
• The letter l (el) indicates a link
• The next three characters indicate the permission of the owner
• r means the owner has read permission
• w means the owner has write (change) permission
• x means the owner has execute (run) permission
• - means the owner does not have the permission that would normally appear in this column
• The next three characters give the permissions of the group
• The last three characters are the permission of all other accounts
• The next column is a number that indicates the number of links to the file or directory
• The following column is the owner of the file or directory
• Next, you will find the group assigned to the file or directory

chmod

• When a file is created, is has certain default permissions

  $ touch test.txt
  $ ls -l test.txt 
  -rw-r--r-- 1 it244gh libuuid 0 2012-09-17 14:40 test.txt

• To change these permission, you need to use the chmod command
• Only the owner of a file can do this
• chmod requires two arguments
  • The permissions you want to grant
  • The name of the file(s) or directory(s) to which the change will be applied
• The format for a call to chmod is

  chmod  PERMISSIONS  FILES_OR_DIRECTORIES

• The permission can be specified in two ways
  • Symbolically
  • Numerically
• Symbolic permissions use letters and the plus and minus signs
• The numeric form uses three digits running from 0 to 7
• I will teach the numeric format for expressing permissions
• You must use the numeric method in all homework assignments, quizzes and tests
• Scoring answers that use the symbolic method takes time I do not have

Using chmod with Numeric Arguments

• The numeric permissions format uses three digits
• Each digit is a number from 0 to 7
• The first digit gives the permission of the owner
• The second digit gives the permissions assigned to the group
• The third digit gives the permissions for every other account
• How do you get three pieces of information out of one number?
• By adding powers of two
• Each digit is the sum of three other numbers
• When constructing each of these 3 numbers ...
• you start with 0 and add
  • 4 if you want to give read permission
  • 2 if you want to give write permission
  • 1 if you want to give execute permission
• Notice that all the number are powers of two
• If we write these values in binary notation
  • 100 represents 4
  • 010 represents 2
  • 001 represents 1
• A single decimal digit from 0 to 7 is represented by 3 binary digits
• This is how we get three pieces of information out of one digit
• For example, to give full permissions I would add
  • 4 for read permission
  • 2 for write permission
  • 1 for execute permission
• So the total, 7, represents all three permissions
• Try to remember this chant

  
  read    write   execute
  4       2       1
  owner   group   everyone

• Remember that you need three digits ...
• to specify the full permissions for a file or directory

Attendance

New Material

The root Account

• On every Unix or Linux system there is a special account named root
• This account is sometimes referred to as the superuser
• root can access any file or run any program
• root is an administrator account
• It is used for system configuration and maintenance
• Even a system administrator should not log in as root
• Because root is very powerfull
• Instead he or she should use a regular Unix account ...
• and should switch to the root account only when they need its power
• This can be done with the su (switch user) command
• To become the root user you would enter the following on the command line

  su -

• This will only work if you know the root password
• A better way of doing this is to use the sudo command
• sudo stands for superuser do
• You type sudo and then the command that only the root user can run
• You use it like this

  sudo COMMAND_ONLY_ROOT_CAN_RUN

• You will then be prompted for your password
• Not the root password
• This will only work if the system administer has added you to the sudoers list
• sudo is safer than using su -
• Because the person using it does not have to know the root password
• If all administrators knew the root password ...
• you would have to change it every time one of them left
• If instead they all used sudo it would be much easier
• You would just delete the account of the terminated employee
• And delete the acount name from the sudoers list

Directory Access Permissions

• Directories are a special kind of file
• They do not hold user data
• They hold the names and internal representation of other files and directories
• Unix permissions work a little differently for directories
• Read and write permissions for a directory are similar to those for a file
• Read permission on a directory allows you to list the contents ...
• using ls
• So read permission on a directory only allows you to run ls on it
• To read the contents of the files in the directory ...
• you need read permission for each file
• Read permission on a directory does not allow you to read the files in that directory
• You need read permission on the file to do that
• Write permission on a directory allows you to create or delete anything in that directory ...
• and to change the name of anything inside that directory
• But you cannot change the files themselves ...
• unless you have write permission on those files
• Write permission on a directory only applies to the contents of a directory
• Not to the directory itself
• You cannot change the directory name or delete a directory on which you have write permission
• To do that you have write permission on its parent directory
• Execute permission on a directory ...
• is very different from execute permission on a file
• You can't run a directory from the command line like a program or script
• Execute permission on a directory allows you to cd into that directory ...
• so you can make the directory your current directory

Links

• Sometimes you want more than one way of getting to a file or directory
• Windows, for example has shortcuts
• You can create a shortcut anywhere ...
• and clicking on it will take you to the real file
• This allows the user another way of getting to the file ...
• instead of going to the directory that holds the file
• In Unix these pointer files are called links
• Links allow you to move to a directory ...
• that is far away from your current directory
• If your current directory has a link
• you can use the link to access that file or directory
• This saves you the bother of using a long absolute or relative pathname
• For example, each of you has an entry in your home directory called it244

  $ ls -l it244
  lrwxrwxrwx 1 ghoffman faculty 39 May 30 14:08 it244 -> /courses/it244/f25/ghoffman/ghoffman/

• Notice the l (el), the first character in the permissions string
• This tells you that you have a link named it244, not a directory
• The real directory is ghoffman inside /courses/it244/f25/ghoffman
• This diagram shows the situation

• You can use the link just as if it were a directory
• If you cd to the link, you will go to the real directory
• If you then use pwd inside the directory you will see

  $ pwd
  /home/ghoffman/it244

• The path that pwd prints ...
• is the route you took to get to the current directory
• But it is not the real path to the directory
• You can only get the true location ,,,
• if you use pwd with the -P option

  $ pwd
  /home/ghoffman/it244
  
  $ pwd -P
  /courses/it244/f25/ghoffman/ghoffman

• You must use a capital P, not a lowercase p
• Unix tries to hide your real location when you use a link ...
• so as not to confuse you
• I can get back to where I came from using .. 

  $ pwd
  /home/ghoffman/it244
  
  $ cd ..
  
  $ pwd
  /home/ghoffman

• Why does your home directory have a link to your it244 class directory?
• To make things easier for instructors like me
• If you did your work for this course in your home directory ...
• it would make more work for me
• I would have to go to many places to collect your assignments
• Instead I only have to go one place
• And if I run ls I see each of your course directories
• The it244 entry in your home directory is a link
• It points to your course directory in /courses/it244/f25/ghoffman
• The name of your course directory is your Unix username

The Two Types of Links

• There are two types of links
  • Hard links
  • Symbolic, or soft, links
• Hard links are older
• But they are not used much these days
• A hard link is like a duplicate file name
• If you have a hard link to a file and the original filename is deleted ...
• the file will still be there
• The file will remain until the last hard link is removed
• Hard links have some disadvantages
• Hard links can only point to files, not directories
• Our Unix filesystem appears to be a single hierarchy
• In reality it is a collection of different file systems ..
• on different hard disk volumes
• The different file systems are stitched together ...
• so they look like a single system
• Unix hides this fact from users
• But this causes problems for hard links
• You can only have a hard link to a file in the same volume ...
• as the link you are creating
• That means you can't link to a file on a different disk or partition
• Symbolic links are much more flexible
• Symbolic links are sometimes called soft links
• You can use either an absolute or relative pathname ...
• when creating a symbolic link
• A symbolic link can point to a file or directory on any disk or partition
• Deleting a soft link does not delete the file or directory it points to
• The symbolic link remains but it points to nothing

ln

• Use ln to create a link
• To create a symbolic or soft link, use ln with the -s option
• Otherwise you will create a hard link
• That is not what you want
• ln takes two arguments

  ln  -s  PATHNAME  [LINK_NAME]

• The second argument, the link name, is optional
• If you ommit it, the link name will be the same as the name of the file or directory ...
• that you are linking to
• Here is an example

  $ pwd
  /home/it244gh
  
  $ ln  -s  ~ghoffman/course_files/it244_files  examples
  
  $ ls -l examples
  lrwxrwxrwx 1 it244gh libuuid 28 2012-09-17 17:53 examples -> /home/ghoffman/examples_it244

Removing a Link

• To delete a link, use rm
• This will work whether the link points to a file or a directory
• If you delete a symbolic link it will not affect the file or directory it points to
• If you delete a hard link you will not delete the file ...
• unless the link is the last connection to the file

Setuid and Setgid Permissions

• Sometimes a program needs to read or modify a file ...
• to do the work it was designed to do
• The passwd command is used to change the password for an account
• To do this it has to make changes to the file /etc/shadow
• But /etc/shadow is owned by the root account
• And no other account can change it
• To deal with situations like this, two special permissions were created
  • setuid
  • setgid
• If a program file has setuid permission ...
• any account that runs the program has the same permission as the owner ...
• but only while the program is running
• This permission means a user can modify files that the program needs to do its job ...
• even files for which it has no permissions
• setgid permission is similar
• Anyone who runs the program has the permissions of the group assigned to that program
• setuid and setgid permissions only apply to executable files
• That is, programs and scripts
• A file with setuid permission will have s in place of x in the owner's execute column
• A file with setgid permission will have s in place of x in the group's execute column
• So there is no ambiguity in replacing x with s
• For example, consider the passwd command
• The executable file for this utility is /usr/bin/passwd
• Running ls -l on this file we get

  ls -l /usr/bin/passwd
  -rwsr-xr-x 1 root root 42824 2011-02-20 19:18 /usr/bin/passwd

• Notice the s in the place where the owner's execute permission should be
• The passwd command needs to modify /etc/shadow ..
• which is a file that stores the encrypted passwords
• Only root can change this file

  ls -l /etc/shadow
  -rw-r--r-- 1 root shadow 926 Jul 16  2013 /etc/shadow

• But you need to change this file when you change your password
• The setuid permission allows you to run passwd and modify /etc/shadow
• But passwd knows who you really are ...
• and it will only let you modify your own entry ...
• not the entry for any other account

Setting Setuid and Setgid with chmod

• How do you assign setuid or setgid permissions to a file?
• You do it with chmod and an extra digit
• If I wanted to assign 755 permission to a script ...
• along with setuid permission ...
• I would use the 4755 with chmod
• When 4 is the first digit in a series of four digits used with chmod ...
• setuid permission is assigned to the file

  $ chmod 4755 work.sh 
  
  $ ls -l work.sh 
  -rwsr-xr-x 1 ghoffman grad 0 Mar  3 12:30 work.sh

• To assign the setgid permission I would use 2 instead

  $ chmod 2755 work.sh 
  
  $ ls -l work.sh 
  -rwxr-sr-x 1 ghoffman grad 0 Mar  3 12:30 work.sh

• Setuid and setgid will not be on any test or quiz

Studying

• Read the Material Before Class

Class Exercise

Class Quiz