9.3. 管理權限

Linux 是多使用者系統，必須以授權系統控制對檔案與資料夾的合法操作，包括所有的系統資源與設備 (在 Unix 系統裡，任何設備都以檔案或資料夾表示)。此原則適用於所有的 Unix 系統，不過多提醒一次總是好的，尤其碰到有趣相關的不明使用情況。

9.3.1. Owners and Permissions

每個檔案與資料夾都有三組不同權限的使用者：

擁有者 (符號為 u 取自使用者的英文字 “user”)；
群組擁有者 (符號為 g 取自群組的英文字 “group”)，代表群組內所有的使用者；
其他 (符號為 o 取自其他的英文字 “other”)。

Three basic types of rights can be combined:

讀取 (符號為 r 取自讀取的英文字 “read”)；
寫入 (或修改，符號為 w 取自寫入的英文字 “write”)；
執行 (符號為 x 取自執行的英文字 “eXecute”)。

以檔案來說，其權利較容易理解：讀取就是允許讀取其內容 (包括複製)、寫入就是允許改變它、而執行就是跑它 (檔案本身必須是程式)。

安全 setuid 與 setgid 可執行

Two particular rights are relevant to executable files: setuid and setgid (symbolized with the letter “s”). Note that we frequently speak of “bit”, since each of these Boolean values can be represented by a 0 or a 1. These two rights allow any user to execute the program with the rights of its owner or its group, respectively. This mechanism grants access to features requiring higher level permissions than those you would usually have.

因為 setuid 根程式係在超級使用者的認證下執行，必須確保它的安全與可靠。的確，使用者可能呼叫一個程式，監禁根使用者，並擁有系統的全部權限，並藉此癱瘓整個系統。

If you require running a program under a different user or if a program requires higher permissions, the sudo, su, or runuser commands are usually better choices than using these bits (see 節 8.9.4, “共享管理員權限”).

資料夾的處理方式略有不同。讀取其款目 (檔案及資料夾)、寫入包括新增與刪除檔案、而執行則是進入它 (尤其是使用 cd 命令)。進入資料夾而不必有讀取權限，執行已知的檔名，若不知其正確的名稱，則無法執行。

安全 setgid 資料夾和 sticky bit

setgid 位元也適用於資料夾。在該資料夾新增的項目自動賦予上層資料夾的群組擁有者權限，而不是繼承新增者的主要群組權限。與同組其他使用者共享檔案樹時，這種設定避免使用者改變其主要群組 (以 newgrp 命令)。

“sticky” bit (符號為字母 “t”) 是一種祗適用於資料夾的授權。特別用在大家都能寫入的暫時性的資料夾 (如 /tmp/)：但祗限檔案的擁有者 (或上層資料夾的) 才能刪除其檔案。少了這層授權，每個人都能刪除其他人在 /tmp/ 裡的檔案。

三個命令控制檔案的授權：

chown user file 改變檔案的擁有者；
chgrp group file 改變群組的擁有者；
chmod rights file 改變檔案的權限。

有兩種方法表示權限。其中，符號表示最容易理解和記憶。它使用前述的符號。可以經由 (u/g/o)，經過等於 ( =)、加 (+)、或減 (-) 設定每種使用者的權限類型。因此，u=rwx,g+rw,o-r 格式賦予擁有者讀、寫與執行的權限，對群組的擁有者給予讀寫的權限，以及移除其他使用者讀取的權限。命令中未新增或減少的權限不變。字母 a 指所有的英文字 “all”，涵蓋三種類型的使用者，所以 a=rx 給予三種使用者相同的權限 (讀與執行，但沒有寫)。

每個權限都可對應一個數值 (8 進位)：4 讀、2 寫、1 執行。這些數值可以加起來表示其權限的組合。每個值依序置於不同使用者的類型之後 (擁有者、群組、其他)。

For instance, the chmod 754 file command will set the following rights: read, write and execute for the owner (since 7 = 4 + 2 + 1); read and execute for the group (since 5 = 4 + 1); read-only for others. The 0 (zero) means no rights; thus chmod 600 file allows for read/write rights for the owner, and no rights for anyone else. The most frequent right combinations are 755 for executable files and directories, and 644 for data files.

還可以設定特別的權限，以同權的原則在原數值之前加入第四個數值，setuid、setgid 和 sticky 的位元數分別是 4、2 和 1。chmod 4754 設置 setuid 前述的位元權限。

八進位標記祗適用於對檔案的一次性設定所有權限；不能以它加入新的權限，如群組擁有者的讀取，因為必須把現在的權限與計算新的數值。

秘訣遞迴運算

有時需要改變整個檔案樹的權限。前述的命令可加入 -R 選項，在次資料夾內做遞迴運算。

The distinction between directories and files sometimes causes problems with recursive operations. That is why the “X” letter has been introduced in the symbolic representation of rights. It also represents the right to execute, but it applies differently to directories and files.

For directories it adds executable permissions to the chosen user(s). For files, it adds the executable bit only if at least one of the users (owner, group, or others) already has executable permissions. Let's demonstrate it, because this bit can be confusing:

$ ls test.txt
  -rw-r--r-- 1 daniel daniel 0 18. Nov 01:07 test.txt
  $ chmod u+X test.txt
  $ ls test.txt
  -rw-r--r-- 1 daniel daniel 0 18. Nov 01:07 test.txt
  $ chmod o+x test.txt
  $ ls test.txt
  -rw-r--r-x 1 daniel daniel 0 18. Nov 01:07 test.txt
  $ chmod u+X test.txt
  $ ls test.txt
  -rwxr--r-x 1 daniel daniel 0 18. Nov 01:07 test.txt

The example shows a typical file with its default permissions: its owner can read and write it, the owner's group and all other users can read it. The next operation (u+X) won't add executable permissions for the owner of the file, because permissions to execute have not been assigned. The operation has no effect on the file. Next we assign execute rights for "other" users and repeat the operation. This time it is successful, because at least one user group already had executable permissions.

It is a misconception that this bit will only affect directories. If files and directories have mixed permissions, it is often a good idea to use the find command to locate the targets you want to operate on.

下一步 umask

When an application creates a file, it assigns indicative permissions, knowing that the system automatically removes certain rights, given by the command umask. Enter umask in a shell; you will see a mask such as 0022. This is simply an octal representation of the rights to be systematically removed. In this case, the write right for the group and other users: With the above umask value, the default for directories 777 becomes 755 and the default permissions for files 666 become 644.

The system's default value is handled by pam_umask(8) and /etc/login.defs.

If you give it a new octal value, the umask command modifies the mask. Used in a shell initialization file (for example, ~/.bashrc or ~/.profile), it will effectively change the default mask for your work sessions.

9.3.2. ACLs - Access Control Lists

Many filesystems, e.g. Btrfs, Ext3, Ext4, JFS, XFS, etc., support the use of Access Control Lists (ACLs). These extend the basic features of file ownership and permission, described in the previous section, and allow for a more fine-grained control of each (file) object. For example: A user wants to share a file with another user and that user should only be able to read the file, but not write or change it.

For some of the filesystems, the usage of ACLs is enabled by default (e.g. Btrfs, Ext3, Ext4). For other filesystems or older systems it must be enabled using the acl mount option - either in the mount command directly or in /etc/fstab. In the same way the usage of ACLs can be disabled by using the noacl mount option. For Ext* filesystems one can also use the tune2fs -o [no]acl /dev/device command to enable/disable the usage of ACLs by default. The default values for each filesystem can usually be found in their homonym manual pages in section 5 (filesystem(5)) or in mount(8).

After enabling ACLs, permissions can be set using the setfacl(1) command, while getfacl(1) allows one to retrieve the ACLs for a given object or path. These commands are part of the acl package. With setfacl one can also configure newly created files or directories to inherit permissions from the parent directory. It is important to note that ACLs are processed in their order and that an earlier entry that fits the situation has precedence over later entries.

If a file has ACLs set, the output of the ls -l command will show a plus-sign after the traditional permissions. When using ACLs, the chmod command behaves slightly different, and umask might be ignored. The extensive documentation, e.g. acl(5) contains more information.