Operating System

Lab 5 – Security and User Group Management

Operating systems in the Unix tradition are not only multitasking systems, but also multi-user
systems, as well. It means that more than one person can be using the computer at the same
time. While a typical computer will likely have only one keyboard and monitor, it can still be
used by more than one user. For example, if a computer is attached to a network or the
Internet, remote users can log in via ssh (secure shell) and operate the computer.

Part 1: Permission

In the Unix security model, a user may own files and directories. When a user owns a file or
directory, the user has control over its access. Users can, in turn, belong to a group consisting
of one or more users who are given access to files and directories by their owners. In addition
to granting access to a group, an owner may also grant some set of access rights to
everybody, which in Unix terms is referred to as the world. To find out information about
your identity, use the id command:

Access rights to files and directories are defined in terms of read access, write access, and
execution access. If we look at the output of the ls command, we can get some clue as to how
this is implemented:

The first ten characters of the listing are the file attributes. The first of these characters is the
file type. Here are the file types you are most likely to see (there are other, less com- mon
types too):

- : a regular file
d : a directory
l : a symbolic link

The remaining nine characters of the file attributes, called the file mode, represent the read,
write, and execute permissions for the file's owner, the file's group owner, and everybody
else:

Page 1 of 7
 Operating System

chmod – Change File Mode

Be aware that only the file’s owner or the superuser can change the mode of a file or
directory. chmod supports two distinct ways of specifying mode changes: octal number
representation, or symbolic representation.

Example: chmod 600 => 110 000 000

chmod also supports a symbolic notation for specifying file modes. Symbolic notation is
divided into three parts: who the change will affect, which operation will be performed, and
what permission will be set. To specify who is affected, a combination of the characters:

“u”: user (file or directory owner)

“g”: group user

“o”: others (the world)

“a”: all (the combination of “u”, “g”, and “o”)

If no character is specified, “all” will be assumed. The operation may be a “+” indicating that
a permission is to be added, a “-” indicating that a permission is to be taken away, or a “=”
indicating that only the specified permissions are to be applied and that all others are to be
removed. Permissions are specified with the “r”, “w”, and “x” characters.

Example:

u+x : Add execute permission for the owner.

+x : Add execute permission for the owner, group, and world. Equivalent to a+x.

o-rw : Remove the read and write permission from anyone besides the owner and group
owner.

go=rw : Set the group owner and anyone besides the owner to have read and write
permission. If either the group owner or world previously had execute permissions, they are
removed.

Page 2 of 7
 Operating System

Special Permission
Besides the read, write and execute permissions for user, group and others, each file can have three
other special permissions which can alter the way a directory works or how a program runs.

Sticky Bit

The sticky bit, also called the restricted deletion flag, has the octal value 1 and in symbolic mode is
represented by a t within the other’s permissions. This applies only to directories, and has no effect on
normal files. On Linux it prevents users from removing or renaming a file in a directory unless they
own that file or directory.

Set GID

Set GID, also known as SGID or Set Group ID bit, has the octal value 2 and in symbolic mode is
represented by an s on the group permissions. This can be applied to executable files or directories.
On files, it will make the process run with the privileges of the group who owns the file. When
applied to directories, it will make every file or directory created under it inherit the group from the
parent directory.

Set UID

SUID, also known as Set User ID, has the octal value 4 and is represented by an s on the user
permissions in symbolic mode. It only applies to files and has no effect on directories. Its behavior is
similar to the SGID bit, but the process will run with the privileges of the user who owns the file.

You can combine multiple special permissions on one parameter. So, to set SGID (value 2) and SUID
(value 4) in octal mode for the script test.sh with permissions 755, you would type:

And the result would be:

Part 2: Changing Identities

At various times, we may find it necessary to take on the identity of another user. Often we
want to gain superuser privileges to carry out some administrative task, but it is also possible
to “become” another regular user for such things as testing an account. There are three ways
to take on an alternate identity:

Page 3 of 7
 Operating System

1. Log out and log back in as the alternate user.

su – Run A Shell With Substitute User And Group IDs

The su command is used to start a shell as another user. The command syntax looks like this:

If the “-l” option is included, the resulting shell session is a login shell for the specified user.
This means that the user's environment is loaded and the working directory is changed to the
user's home directory. This is usually what we want.

If the user is not specified, the superuser is assumed. Notice that (strangely) the “-l” may be
abbreviated “-”, which is how it is most often used.

To start a shell for the superuser, we would do this:

sudo – Execute A Command as Another User

The sudo command is like su in many ways, but has some important additional capabilities.
The administrator can configure sudo to allow an ordinary user to execute commands as a
different user (usually the superuser) in a very controlled way.

In particular, a user may be restricted to one or more specific commands and no others.
Another important difference is that the use of sudo does not require access to the superuser's
pass- word. To authenticate using sudo, the user uses his/her own password.

Let's say, for example, that sudo has been configured to allow us to run a fictitious backup
program called “backup_script”, which requires superuser privileges. With sudo it would be
done like this:

chown – Change File Owner And Group

The chown command is used to change the owner and group owner of a file or directory.
Superuser privileges are required to use this command. The syntax of chown looks like this:

Page 4 of 7
 Operating System

chown can change the file owner and/or the file group owner depending on the first argument
of the command. Here are some examples:

Example: let's say that we have two users; janet, who has access to superuser privileges and
tony, who does not. User janet wants to copy a file from her home directory to the home
directory of user tony. Since user janet wants tony to be able to edit the file, janet changes the
ownership of the copied file from janet to tony:

Changing Your Password

To set or change a password, the passwd command is used.

Part 3: Manage User and Group

Page 5 of 7
 Operating System

Exercise (010-160 p.407):

1. Consider the following 4 files. Write down the corresponding permissions for each file
and directory using octal mode using the 4-digit notation.

drwxr-xr-t 2 carol carol 4,0K Dec 20 18:46 Another_Directory

2. Create an empty file named emptyfile with the command touch emptyfile. Now using
chmod in symbolic notation, add execute permissions for the owner of the file emptyfile,
and remove write and execute permissions for everyone else. Do this using only one
command.

3. What will be the permissions of a file called text.txt after I use the command chmod 754
text.txt?
4. Let’s assume a file named test.sh is a shell script with the following permissions and
ownership:

-rwxr-sr-x 1 carol root 33 Dec 11 10:36 test.sh

4.1. What are the permissions for the owner of the file?
4.2. If the user john runs this script, under which user’s privileges will it be run?
4.3. Using the numeric notation, which should be the syntax of chmod to “unset” the
special permission granted to this file?
5. Try this on a terminal: create an empty file called emptyfile with the command touch
emptyfile. Now “zero out” the permissions for the file with chmod 000 emptyfile. What
will happen if you change the permissions for emptyfile by passing only one value for
chmod in numeric notation, such as chmod 4 emptyfile? What if we use two, such as
chmod 44 emptyfile? What can we learn about the way chmod reads the numerical value?

6. Consider the permissions for the temporary directory on a Linux system, /tmp. User,
group and others have full permissions. But can a regular user delete any files inside this
directory? Why is this the case?

7. As the Linux Administrator for fast-growing company, you have been tasked with
creating, modifying, and removing user accounts from the Linux server. The company
has just hired 9 new employees to fill 3 newly designed departments. The departments
that have been created are Engineering, Sales and Information Systems. The server must
be setup with the appropriate files, folders, users, groups and permissions to ensure a
successful launch of the newly designed departments.

Page 6 of 7
 Operating System

7.1. Create a directory at the root (/) of the file system for each department. This name
should reflect the department name that will use the directory.
7.2. Create a group for each department. This name should reflect the department name
that the group will be assigned.
7.3. Create an administrative user for each of the departments.
o The user will have a Bash login shell.
o The user will belong to the respective group for each department. This will
need to be the user’s primary group.
7.4. Create two additional users for each department.
o The users will have a Bash login shell.
o The users will belong to their respective group for each department. This will
need to be the user’s primary group.
7.5. For security reasons, the following modifications will need to be made to each of the
departments' respective directories:
o Ensure that the owner of each of the directories is the department
administrator and the group ownership is the group for each department.
o The department administrator will have full access to their respective
department directories.
o Ensure that only the owner of a file in the department’s directory can delete
the file (Sticky bit). The user will also have ownership of their respective
department folders.
o Normal users in each department will have full access (Read, Write and
Execute) to their respective department folders.
o The department folders will ONLY be accessible by users/administrators in
each of the respective departments. Ensure that no one else will have
permissions to the folders.
7.6. Create a document in each of the department directories.
o The ownerships on this file will be the same as the directory it is located in
(SGID).
o The document should contain only one line of text that states, “This file
contains confidential information for the department.”
o This file can be read by any user in the department, but can only be modified
by the department administrator. No one else has permissions to this file.

Page 7 of 7