Lesson 9

Because access to practically every resource on the system is managed through the access permissions, this knowledge is crucial to your success as a UNIX system administrator. You are now able to:

1. Describe the central role that files play in the UNIX environment
2. List the principles of file and directory ownership
3. Set user and group ownership
4. Explain how UNIX grants access to files and directories
5. Set file and directory access permissions

If you are a UNIX system administrator or just interested in computer security, you might have heard about access control primitives. But what are they exactly? In this module, we explored the basics of access control primitives of a UNIX system, including their definition, types, and examples.

Access control primitives (ACPs) are the building blocks of access control mechanisms in UNIX systems. They define how users and processes are granted or denied access to resources such as files, directories, devices, and network services. ACPs are implemented by the operating system's kernel and are used by higher-level security systems such as access control lists (ACLs) and security policies.

Suppose we have a file called "secret.txt" that contains sensitive information. We want to restrict access to this file to only the user "alice" and members of the group "finance". We can set the ownership and permissions of the file as follows:

$ chown alice:finance secret.txt
$ chmod 640 secret.txt

This sets the owner to "alice" and the group to "finance", and gives the owner read and write permission, the group read permission, and others no permission.

Suppose we have a program called "packet-sniffer" that needs to capture network packets. However, capturing packets requires root privileges, which we don't want to give to the program. We can assign the "CAP_NET_RAW" capability to the program as follows:

$ setcap cap_net_raw+ep packet-sniffer

This allows the program to capture network packets without having root privileges.
Access control primitives are essential for ensuring the security and integrity of a UNIX system. By understanding how ownership, permissions, and capabilities work, you can control who has access to your system's resources and what they can do with them. Remember to always use the principle of least privilege, and only give users and processes the access

In this module, we used the following terms:

1. access mode: The access mode is the first column of an ls -l listing. The access mode is composed of a file type followed by the user permissions, group permissions, and other permissions.
2. access permission bits: Access permission bits are a series of 9 bits that describe various file permissions. The first 3 access permission bits describe the read, write, and execute permissions for the file's user. The second 3 bits describe the read, write, and execute permissions for the file's group. The final 3 bits describe the read, write, and execute permissions for others.
3. group: A group allows an arbitrary set of users to share files. When a user is a member of the file's group, the user will have that file's group permissions.
4. group permission: Group permissions are the second set of read/write/execute permissions in an access mode. Group permissions apply to users that are members of the file's group.
5. other permission: Other permissions are the third set of read/write/execute permissions in an access mode. Other permissions apply to everyone besides the file owner and the group members.
6. owner: The file owner is typically the user who created the file. You can change permissions only on files you own.
7. Permission type: A permission type grants users a particular type of access. The three basic permission types are r (read), w (write), and x (execute).
8. save text permission: Setting the save text permission bit (indicated by t) on an executable file is supposed to tell the kernel to leave a program in memory after it terminates. This use is now largely obsolete. The save text permission on a directory means something slightly different. When this permission bit is set on a directory, a user may delete a file only if he or she has write permission (w) for that file, even if he or she has write permission on the directory.
9. SGID permission: The SGID permission sets a process's group ID on execution.
10. SUID permission: The SUID permission sets a process of a user ID on execution.
11. user permission: User permissions are the first set of read/write/execute permissions in an access mode. User permissions apply to the file owner.

Click the Quiz link below to take a multiple-choice quiz covering what you learned in this module.
File Ownership Access Permissions- Quiz