Control Access to Files

# Control Access to Files
      ## Dennis Kibbe
      ### Mesa Community College
      Note: This slide presentation was created using [Reveal.js](https://revealjs.com/). You can access a transcript of this presentation by pressing S for speaker notes. You can access navigation help by pressing the question mark key. Audio for this presentation is artificially generated.
      ---
      
      # Module Outline
      1. Introduction
      1. Interpret Linux File Permissions
      1. Quiz
      1. Manage File Permissions from the Command Line
      1. Guided Exercise
      1. Manage Default Permissions and File Access
      1. Guided Exercise
      1. Key Takeaways
      1. Resources
      1. Graded Lab
      Note: 
      ---
      
      # Learning Objectives
      *After completing the work in this module you will be able to:*
      1. List and interpret file permissions.
      1. Change file permissions and file owners.
      1. Set default permissions on the system.
      1. Explain the purpose of special permissions.
      Note:
      ---
      
      # Interpret Linux File System Permissions
      ```
      [student@workstation ~]$ ls -l myscript.sh
      -rwxrwxr--. 1 student student 1520 May  18 07:36 myscript.sh
      ```
      Note: Every file on a Linux system has an owner and belongs to a group. File permissions control who can access which files. The `-l` option to the `ls` command displays file permissions and file ownership.
      >>>
      
      # File Type
      <pre><strong>-</strong>rwxrwxr--. 1 student student 1520 May  18 07:36 myscript.sh</pre>
      Note: The first character indicates the file type. The most common are a dash for an ordinary file while d indicates a directory and l a symbolic link.
      >>>
      
      # Permissions
      <pre>-<strong>rwxrwxr--</strong>. 1 student student 1520 May  18 07:36 myscript.sh</pre>
      Note: The next field shows permissions for the owner of the file, the group the file belongs to, and, finally for others on the system. The possible permissions are read, write, and eXecute. A dash in this field indicates the lack of that permission.
      >>>
      
      # SELinux
      <pre>-rwxrwxr--<strong>.</strong> 1 student student 1520 May  18 07:36 myscript.sh</pre>
      Note: SELinux is a mandatory access control mechanism. A period here indicates that permissions are controlled by SELinux.
      >>>
      
      # Number of Links to the File
      <pre>-rwxrwxr--. <strong>1</strong> student student 1520 May  18 07:36 myscript.sh</pre>
      Note: A file will have at least one link but you can create additional links either hard or symbolic  with the `ln` command.
      >>>
      
      # File Owner
      <pre>-rwxrwxr--. 1 <strong>student</strong> student 1520 May  18 07:36 myscript.sh</pre>
      Note: This is the account that owns the file.
      >>>
      
      # Group Owner
      <pre>-rwxrwxr--. 1 student <strong>student</strong> 1520 May  18 07:36 myscript.sh</pre>
      Note: This is the group that the file belongs to.
      >>>
      
      # File Size in Bytes
      <pre>>-rwxrwxr--. 1 student student <strong>1520</strong> May  18 07:36 myscript.sh</pre>
      Note: This field shows the file size in bytes. Adding the `-h` option to the `ls` command makes the size easier to read.
      >>>
      
      # Creation or Modification Date
      <pre>-rwxrwxr--. 1 student student 1520 <strong>May  18 07:36</strong> myscript.sh</pre>
      Note: This is the date the file was created or last modified.
      >>>
      
      # File Name
      <pre>-rwxrwxr--. 1 student student 1520 May  18 07:36 <strong>myscript.sh</strong></pre>
      Note: The last field is the name of the file.
      ---
      
      # Effects of Permissions on Files and Directories
      <table>
      <tr>
        <th>Permission</th>
        <th>Effect on Files</th>
        <th>Effect on Directories</th>
      </tr>
      <tr>
        <td>r (read)</td>
        <td>Content of files can be read.</td>
        <td>Contents can be listed.</td>
       </tr>
       <tr> 
        <td>w (write)</td>
        <td>Content of files can be changed.</td>
        <td>Files can be created or deleted.</td>
       </tr>
       <tr> 
        <td>x (execute)</td>
        <td>File can be run as a commands.</td>
        <td>The <strong>cd</strong> command can be used.</td>
       </tr>
       </table>
      Note: The effect of permissions on directories is different than that of ordinary files. Read permission means the contents of the directory can be listed. Write permission allows files to be created or deleted in the directory. The eXecute permission allows use of the `cd` command to make the directory the current directory.
      ---
      
      # Listing Permissions Symbolically
      Permissions can be represented symbolically by the term, UGOA.
      1. The file owner (u)
      1. The group a file belongs to (g)
      1. Everyone else on the system (o)
      1. All (a)
      Note: 
      ---
      
      # Permission Operation
      The following permission operations are valid.
      1. Add permissions with the plus (+) sign.
      1. Remove permissions with the minus (-) sign.
      1. Set permissions exactly with the equal (=) sign.
      Note: 
      ---
      
      # List Directory Permissions
      ```
      [megan@localhost ~]$ ls -ld Documents
      drwxr-xr-x 1 megan staff 1574 Apr 9 13:05 Documents
      ```
      Note: Adding the `-d` option to the `ls` command lists the permissions on the Documents directory itself rather than the contents of the directory. Notice that the first character in the line changed to a `d` indicating that Documents is a directory.
      ---
      
      # Manage File System Permissions from the Command Line
      <pre>
      [joe@localhost ~]$ man -k permissions
      access (2)        - check user's permissions for a file
      <strong>chmod (2)         - change permissions of a file</strong>
      console.perms (5) - permissions control file for users at the system console
      ...
      </pre>
      Note: The `chmod` command is used to change permissions from the command line. If you don't remember the command you can use the `man` command with the -k option to find the `chmod` command.
      ---
      
      # Use `chmod` to Change File Permissions
      ```
      [joe@localhost ~]$ ./myscript.sh
      bash: ./myscript.sh: Permission denied
      [joe@localhost ~]$ ls -l myscript.sh
      -rw-r--r-- 1 joe joe 1824 Sep 14 12:46 myscript.sh
      ```
      Note: In this example user `joe` tries to run `myscript.sh` but the Bash shell blocks the execution of the file. The `ls -l` command shows that the file does not have the eXecute  bit set.
      ---
      
      # Change File Permissions - Symbolic Method
      ```  
      [joe@localhost ~]$ chmod +x myscript.sh
      [joe@localhost ~]$ ls -l myscript.sh
      -rwxr-xr-x 1 joe joe 1824 Sep 14 12:47 myscript.sh
      ```
      Note: Here Joe uses the `chmod` command to change file permissions symbolically adding the executable bit making `myscript.sh` executable by the Bash shell.
      ---
      
      # Change File Permissions - Octal Method
      ![Screenshot show incorrect permissions](../images/ssh_permissions.png)
      Note: The octal method is used to change permissions with numbers. In this example the `ssh` command will not use a private key that is accessible by others.
      ---
      
      # Octal Permissions
      <table>
      <tr>
        <th>Number</th>
        <th>Description</th>
      </tr>
      <tr>
        <td>4</td>
        <td>Permission to read file.</td>
       </tr>
       <tr> 
        <td>2</td>
        <td>Permission to write to file.</td>
       </tr>
       <tr> 
        <td>1</td>
        <td>Permission to run file as a program.</td>
       </tr>
       <tr>
        <td>0</td>
        <td>No permissions</td>
       </tr>
       </table>
      Note: This table shows which number is assigned to a permission. Numbers can be added to represent a combination of permissions.
      ---
      
      # Octal Example
      <pre>
      [student@workstation ~]$ ls -l ~/.ssh/sdf_rsa
      -rw-rw-rw- 1 student student 2675 Jul 29 2022 .ssh/sdf_rsa
      <strong>[student@workstation ~]$ chmod 0600 .ssh/sdf_rsa</strong>
      [student@workstation ~]$ ls -l ~/.ssh/sdfid_rsa
      -rw- - - - - - - 1 student student 2675 Jul 29 2022 .ssh/sdf_rsa
      </pre>
      Note: The octal method is used here to set read and write permissions for the owner of the file. Members of the group to which the file belongs and others on the system have no permissions. The leading zero applies to special permissions which will be described later.
      ---
      
      # Change File Owner or File Group
      <pre>
      [student@workstation ~]$ man -k owner
      chgrp (1)         - change group ownership
      <strong>chown (1) - change file owner and group</strong>
      ...
      </pre>
      Note: A new file is owned by the user that creates it and belongs to that owner’s primary group. Only root can change the owner of a file. The user who owns the file can change the group to which a file belongs to another group if the user is a member of the new group. The `groups` or `id` command is used to show the groups a user belongs to.
      ---
      
      # Change File Group Example
      <pre>
      [joe@localhost ~]$ ls -l myscript.sh
      -rw-r--r-- 1 joe joe 1760 Sep 14 12:48 myscript.sh
      <strong>[joe@localhost ~]$ chown :devops myscript.sh</strong>
      -rw-r--r-- 1 joe devops 1760 Sep 14 12:49 myscript.sh
      </pre>
      Note: Here user joe changes the group for `myscript.sh` from his private group, joe to the devops group which Joe is also a member of.
      ---
      
      # Guided Exercise
      ## Manage File System Permissions from the Command Line
      Note: In this guided exercise you will use file system permissions to create a directory in which all members of a particular group can add and delete files.
      ---
      
      # Special Permissions (suid)
      <pre>
      [student@workstation ~]$ which passwd
      /usr/bin/passwd
      [student@workstation ~]$ ls -l /usr/bin/passwd 
      -<strong>rwsr</strong>-xr-x 1 root root 59976 Nov 24  2022 /usr/bin/passwd
      Note: Sometimes a program needs to be run with the permissions of the owner of the program rather than the user who runs the program. The `passwd` command is an example. The `/etc/shadow` file must be updated when a user sets a new password. Root privileges are required to change that file. The s in the permissions field indicates that this special permission is set.
     ---
     
     # Special Permissions (sgid)

Note: Similar to suid, sgid runs a file with the permissions of the group the file belongs to. If the permission is set on a directory files created in the directory inherit the directory's group. 
     ---
       
      # Special Permissions (Sticky Bit)
      <pre>
      [student@workstation ~]$ ls -ld /tmp
      drwxrwx<strong>rwt</strong> 19 root root 4096 Feb  7 08:26 /tmp/
      Note: The sticky bit limits the permissions on a directory. Note the t in the permissions. With the sticky bit set on a directory only the owner of a file in the `/tmp` directory can remove or change the file.
     ---
      
      # Manage Default Permissions and File Access
      ![screenshot of the login.defs file showing the umask](../images/login_defs.png)
      Note: When a new file is created it inherits the default permissions set on the system. These permissions are set in the `umask` section of the `/etc/login.defs` file.
      ---
      
      # The `umask` Command
      ```
      [student@workstation ~]$ umask
      ```
      Note: The `umask` command is used to display default permissions. A user can change the default permissions temporarily for files that user creates. Root can set new default permissions for all users by editing the `umask` section of `/etc/login.defs`. The change will take effect the next time the system is booted.
      ---
      
      # How the `umask` is Set
      <table>
      <tr>
      <td>Total possible permissions</td>
      <td>0666</td>
      </tr>
      <tr>
        <td>umask (subtracts)</td>
        <td>0002</td>
       </tr>
       <tr> 
        <td>Resulting permissions</td>
        <td>0664</td>
       </tr>
       </table>
      Note: This table shows how the `umask` is calculated. The maximum permissions are read and write; the eXecute bit must be set explicitly for each file. The `umask` can not set the executable bit. The `umask` removes permissions to arrive at the default permissions. In this example, the write permission is removed from others on the system but permissions for the file owner and the file group are left unchanged.
      ---
      
      # Calculate the Resulting Umask
      <table>
      <tr>
      <td>Total possible permissions</td>
      <td>0666</td>
      </tr>
      <tr>
        <td>umask (subtracts)</td>
        <td>0022</td>
       </tr>
       <tr> 
        <td>Resulting permissions</td>
        <td>????</td>
       </tr>
       </table>
       
      Note: In this example, what are the new default permissions?
      ---
      
      # Guided Exercise
      ## Manage Default Permissions and File Access
      Note: In this exercise, you control the permissions on files that are created in a directory by using `umask` settings and the setgid permission.
      ---
      
      # Key Takeaways
      1. The `ls -l` command displays file permissions and file ownership.
      1. Add the `-d` option to `ls -l` to display the permissions for the directory itself.
      1. The `chmod` command changes permissions.
      1. The `chown` command changes the owner of a file or the group to which a file belongs.
      1. Only the superuser can change the owner of a file.
      1. The `umask` command displays or changes temporarily the default permissions for files.
      1. The `suid`, `sgid`, and `sticky bit` special permissions provide additional access-related features to files.
      Note:
      ---
      
      # Resources
      - [How to use the chmod command: 2-Minute Linux Tips](https://youtu.be/XZLBJfQ6jTc)
      - [How to use the chown command: 2-Minute Linux Tips](https://youtu.be/yO0bCP0maL4)
      - [How to use the umask command: 2-Minute Linux Tips](https://youtu.be/bZZHKy8UN_s)
      - [Linux permissions: SUID, SGID, and sticky bit](https://www.redhat.com/sysadmin/suid-sgid-sticky-bit)
      Note: Here are some resources for the topics covered in this chapter.
      ---
      
      # Graded Lab
      ## Control Access to Files
      ![Screenshot of a sample grading script](../images/lab_techs.png)
      Note: In this lab, you configure permissions on files and set up a directory that users in a particular group can use to share files on the local file system. When you complete the lab submit a screenshot of the output of the `lab grade perms-default` command. The screenshot shown here is for reference only.
      ---
      
      
      ![Mesa Community College logo](../images/mcc_logo.png "Mesa Community College")
      Note: This ends this slide presentation. I hope you found it useful.