\section{File Permissions and Ownership}

\begin{frame}
   {Owner, Group and World}

   \begin{itemize}
      \item
      \textbf{owner}: the user who owns the file (also called
      \textbf{user}).
      \item
      \textbf{group}: the group of users who have access.
      \item
      \textbf{other}: the rest of the world (also called
      \textbf{world}).
   \end{itemize}

   \begin{cmd}
 $ ls -l
    \end{cmd}
   \begin{response}
 -rw-rw-r-- 1 student student    1601 Mar  9  15:04  mfile
 -rw-r--r-- 1 student aproject   3280 Apr 15   5:09  gfile
 -rwxr-xr-x 1 student bproject 803280 Dec  9  11.42  doit
   \end{response}

\end{frame}

\cprotect\note{

When you do:

\begin{cmd}
 $ ls -l a_file
   \end{cmd}
\begin{response}
 -rw-rw-r-- 1 coop aproject 1601 Mar 9 15:04  a_file
   \end{response}

after the first character (which indicates the type of
the file object) there are nine more which indicate the
\textbf{access rights} granted to potential file
users. These are arranged in three groups of three,
corresponding to \textbf{owner}, \textbf{group} and
\textbf{other} (same as \textbf{world}.

In the above listing, the user is \texttt{coop} and the
group is \texttt{aproject}.

}
\section{File Access Rights}
\begin{frame}
   {File Access Rights}

   \begin{itemize}
      \item
      If you do a long listing of a file, as in:
      \begin{cmd}
 $ ls -l /usr/bin/vi
      \end{cmd}
      \begin{response}
-rwxr-xr-x. 1 root root 910200 Jan 30  2014 /usr/bin/vi
      \end{response}

      Each of the triplets (in characters 2-10) can have each
      of the following set:

      \begin{itemize}
         \item
         \textbf{r}: read access is allowed.
         \item
         \textbf{w}: write access is allowed.
         \item
         \textbf{x}: execute access is allowed.
      \end{itemize}
      \item
      Authentication is granted by the first to succeed of:
      \begin{itemize}
         \item File ownership
         \item Group membership
         \item World permissions
      \end{itemize}
   \end{itemize}

\end{frame}

\cprotect\note {

   If a permission is not allowed, a \texttt{-} appears
   instead of one of these characters.

   In addition, other specialized permissions exist for
   each category, such as the \textbf{setuid/setgid}
   permissions.

   These \textbf{file access permissions} are a critical
   part of the \textbf{Linux} security system. Any request
   to access a file requires comparison of the credentials
   and identity of the requesting user to those of the
   owner of the file.

   This \textbf{authentication} is granted depending on one
   of these three sets of permissions, in the following
   order:
   \begin{enumerate}

      \item
      If the requester is the file owner, the file owner
      permissions are used.
      \item
      Otherwise, if the requester is in the group that owns
      the files, the group permissions are examined;
      \item
      If that does not succeed, the world permissions are
      examined.

   \end{enumerate}

}

\section{chmod, chown and chgrp}
\begin{frame}
   {chmod}

   \begin{itemize}
      \item
      Changing file permissions is done with \textbf{chmod}.

      \item
      For example, to give the owner and world execute
      permission, and remove the group write permission:

      \begin{cmd}
 $ ls -l a_file
   \end{cmd}
      \begin{response}
 -rw-rw-r-- 1 coop coop 1601 Mar  9 15:04 a_file
   \end{response}
      \begin{cmd}
 $ chmod uo+x,g-w a_file
 $ ls -l a_file
   \end{cmd}
      \begin{response}
 -rwxr--r-x 1 coop coop 1601 Mar  9 15:04 a_file
      \end{response}
      where \verb?u? stands for user (owner), \verb?o?  stands
      for other (world), and \verb?g? stands for group.

      \item
      You can only change permissions on files you own, unless
      you are the superuser.

      \item Permissions are often given in numerical form, such as
      \verb?644?
   \end{itemize}

\end{frame}

\cprotect\note {

   Permissions can be represented either as a bitmap,
   usually written in octal, or in a symbolic form.  Octal
   bitmaps usually look like \texttt{0755} while symbolic
   representations look like \texttt{u+rwx,g+rwx,o+rx}.

}
\begin{frame}
   {Octal Digits}

   \begin{itemize}
      \item
      The \textbf{Octal} number representation is the sum for
      each digit of:

      \begin{itemize}
         \item

         \texttt{4} if read permission is desired.

         \item

         \texttt{2} if write permission is desired.

         \item

         \texttt{1} if execute permission is desired.

      \end{itemize}

   \end{itemize}

\end{frame}

\cprotect\note {


   The symbolic syntax can be difficult to type and
   remember, so one often uses the octal shorthand which
   lets you set all the permissions in one step. This is
   done with a simple algorithm, and a single digit
   suffices to specify all three permission bits for each
   entity.

   Thus \texttt{7} means read/write/execute, \texttt{6}
   means read/write, and \texttt{5} means read/execute.

   When you apply this with \textbf{chmod} you have to give
   a value for each of the three digits, such as in the
   below example:
   \begin{figure}[H]
      \includegraphics[width=5.0in]{IMAGES/chmodmint}
      \caption{Using chmod}
   \end{figure}
}

\begin{frame}
   {chown and chgrp}

   \begin{itemize}
      \item Change file ownership with \textbf{chown}
      (only superuser can do this)
      \begin{cmd}
$ sudo chown wally somefile
      \end{cmd}

      \item Change group ownership with \textbf{chgrp}
      (only to groups you belong to)
      \begin{cmd}
$ sudo chgrp cleavers somefile
      \end{cmd}

      \item Change both at the same time:
      \begin{cmd}
$ sudo chown wally:cleavers somefile
      \end{cmd}
      where you separate the owner and the group with a colon
      (or period).

      \item
      Can use the \verb?-R? option for recursive:
      \begin{cmd}
$ sudo chown -R wally:cleavers ./
$ sudo chown -R wally:wally subdir
      \end{cmd}
   \end{itemize}
\end{frame}

\cprotect\note{

   Changing file ownership is done with \textbf{chown} and
   changing the group is done with \textbf{chgrp}.

   Only the superuser can change ownership on files.
   Likewise, you can only change
   group ownership to groups that you are a member of.

   Use of the \verb?-R? option ensures all files and directories
   underneath the argument have their ownership changed.

}

\section{umask}
\begin{frame}
   {umask}

   \begin{itemize}
      \item Used to set default permissions for files and
      directories
      \item \textbf{umask}: program to set the umask
      \begin{itemize}
         \item Lists permissions to withhold
      \end{itemize}
      \item Default umask set in \filelink{/etc/profile}
      \begin{itemize}
         \item root's umask is 022
      \end{itemize}
      \item Can be set by any user
   \end{itemize}

\end{frame}

\cprotect\note{

   The default permissions given when creating a file are
   read/write for owner, group and world (\verb?0666?), and
   for a directory it is read/write/execute for everyone
   (\verb?0777?). However, if you do the following:
   \begin{cmd}
$ touch   afile
$ mkdir adir
$ ls -l | grep -e afile -e adir
   \end{cmd}
   \begin{response}
drwxrwxr-x 2  coop coop 4096 Sep 16 11:18 adir
-rw-rw-r-- 1  coop coop    0 Sep 16 11:17 afile
   \end{response}
   you will notice the actual permissions have changed to
   \verb?664? for the file and \verb?775? for the directory. They
   have been modified by the current \textbf{umask}, whose purpose is
   to show which permissions should be denied. The current
   value can be shown by:
   \begin{cmd}
$ umask
   \end{cmd}
   \begin{response}
0002
   \end{response}
   which is the most conventional value set by system
   administrators for users. This value is combined with the
   file creation permissions to get the actual result; i.e.,
   \begin{cmd}
0666 & ~002 = 0664; i.e., rw-rw-r--
   \end{cmd}
   You can change the \textbf{umask} at any time with the
   \textbf{umask} command, as in
   \begin{cmd}
$ umask 0022
   \end{cmd}

}

\section{Filesystem ACLs}
\begin{frame}
   {Filesystem ACLs}
   \begin{itemize}
      \item
      \textbf{POSIX ACL}s (\textbf{A}ccess \textbf{C}ontrol
      \textbf{L}ists) extend the simpler user, group, world
      system
      \item Used to share files/directories without using
      777 permission
      \item Implemented as mount option (\verb?acl?)
      \item Default set on filesystems created at install
      \item Use \texttt{getfacl/setfacl} to get/set \textbf{ACL}s
      \item Examples:
      \begin{cmd}
$ getfacl /home/stephane/file1
$ setfacl -m u:isabelle:rx /home/stephane/file1
$ setfacl -x u:isabelle    /home/stephane/file
      \end{cmd}

   \end{itemize}

\end{frame}

\cprotect\note{

   Particular privileges can be granted to specific users
   or groups of users when accessing certain objects or
   classes of objects.

   While the \textbf{Linux} kernel enables the use of
   \textbf{ACL}s, it still must be implemented as well in
   the particular filesystem. All major filesystems used
   in modern \textbf{Linux} distributions incorporate the
   \textbf{ACL} extensions, and one can use the option
   \texttt{-acl} when mounting.  A default set of
   \textbf{ACL}s is created at system install.

   Note that new files inherit the default \textbf{ACL}
   (if set) from the directory they reside in.  Also note
   that \textbf{mv} and \textbf{cp -p} preserve
   \textbf{ACL}s.

   To remove an \textbf{ACL}:
   \begin{cmd}
$ setfacl -x u:isabelle /home/stephane/file1
   \end{cmd}
   To set the default on a directory:
   \begin{cmd}
$ setfacl -m d:u:isabelle:rx somedir
   \end{cmd}

}

