命令行快速提示：权限
权限
![](/data/attachment/album/201907/20/002206gmse8odsynsz71ds.jpg)


Fedora 与所有基于 Linux 的系统一样，它提供了一组强大的安全特性。其中一个基本特性是文件和文件夹上的*权限*。这些权限保护文件和文件夹免受未经授权的访问。本文将简要介绍这些权限，并向你展示如何使用它们共享对文件夹的访问。


### 权限基础


Fedora 本质上是一个多用户操作系统，它也有*组*，用户可以是其成员。但是，想象一下一个没有权限概念的多用户系统，不同的登录用户可以随意阅读彼此的内容。你可以想象到这对隐私或安全性并不是很好。


Fedora 上的任何文件或文件夹都分配了三组权限。第一组用于拥有文件或文件夹的*用户*，第二组用于拥有它的*组*，第三组用于其他人，即既不是该文件的用户也不是拥有该文件的组中的用户。有时这被称为*全世界*。


### 权限意味着什么


每组权限都有三种形式：*读*、*写*和*执行*。其中每个都可以用首字母来代替，即 `r`、`w`、`x`。


#### 文件权限


对于*文件*，权限的含义如下所示：


* 读（`r`）：可以读取文件内容
* 写（`w`）：可以更改文件内容
* 执行（`x`）：可以执行文件 —— 这主要用于打算直接运行的程序或脚本


当你对任何文件进行详细信息列表查看时，可以看到这三组权限。尝试查看系统上的 `/etc/services` 文件：



```
$ ls -l /etc/services
-rw-r--r--. 1 root root 692241 Apr  9 03:47 /etc/services
```

注意列表左侧的权限组。如上所述，这些表明三种用户的权限：拥有该文件的用户，拥有该文件的组以及其他人。用户所有者是 `root`，组所有者是 `root` 组。用户所有者具有对文件的读写权限，`root` 组中的任何人都只能读取该文件。最后，其他任何人也只能读取该文件。（最左边的 `-` 显示这是一个常规文件。）


顺便说一下，你通常会在许多（但不是所有）系统配置文件上发现这组权限，它们只由系统管理员而不是普通用户更改。通常，普通用户需要读取其内容。


#### 文件夹（目录）权限


对于文件夹，权限的含义略有不同：


* 读（`r`）：可以读取文件夹内容（例如 `ls` 命令）
* 写（`w`）：可以更改文件夹内容（可以在此文件夹中创建或删除文件）
* 执行（`x`）：可以搜索文件夹，但无法读取其内容。（这听起来可能很奇怪，但解释起来需要更复杂的文件系统细节，这超出了本文的范围，所以现在就这样吧。）


看一下 `/etc/grub.d` 文件夹的例子：



```
$ ls -ld /etc/grub.d
drwx------. 2 root root 4096 May 23 16:28 /etc/grub.d
```

注意最左边的 `d`，它显示这是一个目录或文件夹。权限显示用户所有者（`root`）可以读取、更改和 `cd` 到此文件夹中。但是，没有其他人可以这样做 —— 无论他们是否是 `root` 组的成员。注意，你不能 `cd` 进入该文件夹。



```
$ cd /etc/grub.d
bash: cd: /etc/grub.d: Permission denied
```

注意你自己的主目录是如何设置的：



```
$ ls -ld $HOME
drwx------. 221 paul paul 28672 Jul  3 14:03 /home/paul
```

现在，注意除了作为所有者之外，没有人可以访问此文件夹中的任何内容。这是特意的！你不希望其他人能够在共享系统上读取你的私人内容。


### 创建共享文件夹


你可以利用此权限功能轻松创建一个文件夹以在组内共享。假设你有一个名为 `finance` 的小组，其中有几个成员需要共享文档。因为这些是用户文档，所以将它们存储在 `/home` 文件夹层次结构中是个好主意。


首先，[使用 sudo](https://fedoramagazine.org/howto-use-sudo/) 创建一个共享文件夹，并将其设置为 `finance` 组所有：



```
$ sudo mkdir -p /home/shared/finance
$ sudo chgrp finance /home/shared/finance
```

默认情况下，新文件夹具有这些权限。注意任何人都可以读取或搜索它，即使他们无法创建或删除其中的文件：



```
drwxr-xr-x. 2 root root 4096 Jul  6 15:35 finance
```

对于金融数据来说，这似乎不是一个好主意。接下来，使用 `chmod` 命令更改共享文件夹的模式（权限）。注意，使用 `g` 更改所属组的权限，使用 `o` 更改其他用户的权限。同样，`u` 会更改用户所有者的权限：



```
$ sudo chmod g+w,o-rx /home/shared/finance
```

生成的权限看起来更好。现在，`finance` 组中的任何人（或用户所有者 `root`）都可以完全访问该文件夹及其内容：



```
drwxrwx---. 2 root finance 4096 Jul  6 15:35 finance
```

如果其他用户尝试访问共享文件夹，他们将无法执行此操作。太棒了！现在，我们的金融部门可以将文档放在一个共享的地方。


### 其他说明


还有其他方法可以操作这些权限。例如，你可能希望将此文件夹中的任何文件设置为 `finance` 组所拥有。这需要本文未涉及的其他设置，但请继续关注我们，以了解关于该主题的更多信息。




---


via: <https://fedoramagazine.org/command-line-quick-tips-permissions/>


作者：[Paul W. Frields](https://fedoramagazine.org/author/pfrields/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[MjSeven](https://github.com/MjSeven) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Fedora, like all Linux based systems, comes with a powerful set of security features. One of the basic features is *permissions* on files and folders. These permissions allow files and folders to be secured from unauthorized access. This article explains a bit about these permissions, and shows you how to share access to a folder using them.

## Permission basics

Fedora is by nature a multi-user operating system. It also has *groups*, which users can be members of. But imagine for a moment a multi-user system with no concept of permissions. Different logged in users could read each other’s content at will. This isn’t very good for privacy or security, as you can imagine.

Any file or folder on Fedora has three sets of permissions assigned. The first set is for the *user* who owns the file or folder. The second is for the *group* that owns it. The third set is for everyone else who’s not the user who owns the file, or in the group that owns the file. Sometimes this is called the *world*.

## What permissions mean

Each set of permissions comes in three flavors — *read*, *write*, and *execute*. Each of these has an initial that stands for the permission, thus *r*, *w*, and *x*.

### File permissions

For *files*, here’s what these permissions mean:

- Read (r): the file content can be read
- Write (w): the file content can be changed
- Execute (x): the file can be executed — this is used primarily for programs or scripts that are meant to be run directly

You can see the three sets of these permissions when you do a long listing of any file. Try this with the */etc/services* file on your system:

$ls -l /etc/services

-rw-r--r--. 1 root root 692241 Apr 9 03:47 /etc/services

Notice the groups of permissions at the left side of the listing. These are provided in three sets, as mentioned above — for the user who owns the file, for the group that owns the file, and for everyone else. The user owner is *root* and the group owner is the *root* group. The user owner has read and write access to the file. Anyone in the group *root* can only read the file. And finally, anyone else can also only read the file. (The dash at the far left shows this is a regular file.)

By the way, you’ll commonly find this set of permissions on many (but not all) system configuration files. They are only meant to be changed by the system administrator, not regular users. Often regular users need to read the content as well.

### Folder (directory) permissions

For folders, the permissions have slightly different meaning:

- Read (r): the folder contents can be read (such as the
*ls*command) - Write (w): the folder contents can be changed (files can be created or erased in this folder)
- Execute (x): the folder can be searched, although its contents cannot be read. (This may sound strange, but the explanation requires more complex details of file systems outside the scope of this article. So just roll with it for now.)

Take a look at the */etc/grub.d* folder for example:

$ls -ld /etc/grub.d

drwx------. 2 root root 4096 May 23 16:28 /etc/grub.d

Note the *d* at the far left. It shows this is a directory, or folder. The permissions show the user owner (*root*) can read, change, and *cd* into this folder. However, no one else can do so — whether they’re a member of the *root* group or not. Notice you can’t *cd* into the folder, either:

$cd /etc/grub.d

bash: cd: /etc/grub.d: Permission denied

Notice how your own home directory is setup:

$ls -ld $HOME

drwx------. 221 paul paul 28672 Jul 3 14:03 /home/paul

Now, notice how no one, other than you as the owner, can access anything in this folder. This is intentional! You wouldn’t want others to be able to read your private content on a shared system.

## Making a shared folder

You can exploit this permissions capability to easily make a folder to share within a group. Imagine you have a group called *finance* with several members who need to share documents. Because these are user documents, it’s a good idea to store them within the */home* folder hierarchy.

To get started, [use ](https://fedoramagazine.org/howto-use-sudo/)* sudo* to make a folder for sharing, and set it to be owned by the

*finance*group:

$ sudo mkdir -p /home/shared/finance

$ sudo chgrp finance /home/shared/finance

By default the new folder has these permissions. Notice how it can be read or searched by anyone, even if they can’t create or erase files in it:

drwxr-xr-x. 2 root finance 4096 Jul 6 15:35 finance

That doesn’t seem like a good idea for financial data. Next, use the *chmod* command to change the mode (permissions) of the shared folder. Note the use of *g* to change the owning group’s permissions, and *o* to change other users’ permissions. Similarly, *u* would change the user owner’s permissions:

$ sudo chmod g+w,o-rx /home/shared/finance

The resulting permissions look better. Now, anyone in the *finance* group (or the user owner *root*) have total access to the folder and its contents:

drwxrwx---. 2 root finance 4096 Jul 6 15:35 finance

If any other user tries to access the shared folder, they won’t be able to do so. Great! Now our finance group can put documents in a shared place.

## Other notes

There are additional ways to manipulate these permissions. For example, you may want any files in this folder to be set as owned by the group *finance*. This requires additional settings not covered in this article, but stay tuned to the Magazine for more on that topic soon.

## Tom

Paul – The finance group isn’t shown in the final ls of the /home/shared/finance directory.

## Paul W. Frields

@Tom: Thanks, I must have copypasta’d the wrong output. Fixed!

## OlivierS

I think when you :

sudo chgrp finance /home/shared/finance

You should have

drwxr-xr-x. 2 root finance 4096 Jul 6 15:35 finance

and not

drwxr-xr-x. 2 root root 4096 Jul 6 15:35 finance

A mistake in images i think but at the end

drwxrwx—. 2 root root 4096 Jul 6 15:35 finance

seems not to be correct too because in this case just user “root” and group “root” can access “finance”

## Paul W. Frields

@OlivierS: Indeed, fixed now as above.

## Chris Rainey

Great and

timelyarticle Paul!I’ve recently returned to Fedora from Ubuntu due to my concerns about $PRIVACY over $CONVENIENCE in the default umask=0022 of Ubuntu(and Debian). How I missed these defaults in Ubuntu’s /etc/adduser.conf(DIR_MODE=0750) and /etc/login.defs for so many years is a matter of some embarrassment for me and ought to be for Ubuntu/Debian, as well.

All one has to do is look signpost’s such as the GDPR or the Equifax data breach for clues as to why ‘open'(world readable) $HOME dirs is a

verybad idea for $DEFAULTS.Thank you for bringing the remedy and highlighting the point in your post, as Fedora uses $SANE defaults in this regard.

BTW: I started my journey with Linux by purchasing a boxed-set of “RED HAT 8.0” at a CompUSA store for $39.00. Fedora was still just a gleam in some developer’s eyes.

## Chris Rainey

Errrrr…

:%s/DIR_MODE=0750/DIR_MODE=0755/g , above, as 0750 is my change to the default of 0755.

:%s/look signpost’s/look to signpost’s/g , above, proof-b4-post!

## Jarek

I am very grateful for these articles. Could the next advanced article also explain the use of numbers with the permission system? A person can see those a lot when searching for some solutions (or reading specfiles 🙂 ) regarding the permissions

## Yuri Oliveira

I would add that we can use numbers to change permissions:

read: 4

write: 2

execute: 1

And we would sum up the permissions for each category (user, group, others). For a

permission, we’d have

rwx = 4+2+1 = 7

r-x = 4+0+1 = 5

r-x = 4+0+1 = 5

So, if you’d like to change the permissions of the

shared folder from

(755) to

(700), that would be:

## NotEnough

And what about 2775 ?

## we4

and create finance user

and change own

chown finance.finance

## fdelapena

Thanks! Another interesting permissions feature not quite popular is ACL (getfacl/setfacl) for fine-grained control for users and groups.