IT 244: Introduction to Linux/Unix

IT 244: Introduction to Linux/Unix
Class 10

Microphone

Questions

Are there any questions before I begin?

Homework 5

I have posted homework 5 here.

It is due this coming Sunday at 11:59 PM.

Today's Class

Today I'll discuss the root account, directory permissions and links.

General Advice

Read the Material Before Class

Learning is an incremental process
It proceeds in steps
Some things you pick up quickly
Others take more time
But the more you are exposed to course material ...
the more you learn
Reading new material before class is useful
It prepares your mind for what you will learn in class
I will post the Class Notes for each class at Noon the day before class
If you read them before class ...
t will make my lectures more understandable

Tips and Examples

Using Pathnames

If you want to work with a file ...
you usually go to the directory that contains the file
When you do this you can use just the name of the file ...

when you need to run a command on it

	$ cat lines.txt 
	Line 1
	Line 2
	Line 3
	Line 4
	Line 5

I have some web pages that offer help with Linux
They are contained in the directory /home/ghoffman/public_html/linux
One of these files is common_unix_commands.html
Let's say I wanted to find all lines int that file that contained finger
If I were in the directory that held the file I would simply type
```
	$ grep -n finger common_unix_commands.html
```
The -n option will give me the line number
If I were in my home directory, I could use a relative pathname
```
	grep -n finger public_html/linux/common_unix_commands.html
```
The file I want to access is below my current directory
So the path will list the directories between my current directory ...
and the directory that contains the file
What if I wanted you to make a copy of this file to practice with?
Each of you would be in a different directory when you copied the file
So I would give each of you an absolute pathname

Then you would type

	cp  /home/ghoffman/public_html/linux/common_unix_commands.html  .

Using a Pathname to Run a Script

In a few weeks I will show you how to make a Bash script executable
This will allow you to run the script without first typing bash
If you do this and place the script in a special directory ...
you can run the script just by typing its name on the command line
If the script is not located in one of these special directories ...
you have to use a pathname to run the script
The scripts you use to check your class exercises ...
are not in one of these special directories
They are stored in the directory /home/ghoffman/code/it244_code/testing_scripts_it244
That's why to run the script to check your ex10.sh ...
you have to use the pathname ~ghoffman/code/it244_code/testing_scripts_it244/ex10.sh
This is a absolute pathname because it starts with ~
After you hit Enter or Return ...
Bash will change ~ghoffman to /home/ghoffman
Because this is an absolute pathname ...
you can use this anywhere in the filesystem

The pathname to run step_comment_check.sh is

~ghoffman/it244_test/step_comment_check.sh

Is also an absolute pathname

Practice with Access Permissions

You will need to know how to use chmod to change access permissions ...
on the Midterm and Final exams
And you will need to do this using the numerical format ...
that uses the digits from 0 to 7
You will get some practice with chmod in the Class Exercise for this class
I have also created a web page to give you extra practice with chmod
You will find this page here
The page also has a link to the answers
There is a link to the chmod practice page on the class web page

Review

Access Permissions

All Unix files and directories have access permissions
The access permissions allow the owner to control acces to a file or directory
They regulate who gets to do what with the file or directory
The owner of a file or directory is the user account that created it
Every file, directory or device on a Unix filesystem has three types of permissions
- Read
- Write
- Execute
Each access permission can either be on or off
If you have read permission on a file you can look at the data in the file
If you only have read permission, you cannot change a file
To change a file you need write permission
To run a program or script using only its name on the command line ...
you must have execute permission on that file
These permissions apply to three classes of users
- The owner
- The group
- Every other account
Every file or directory has an owner
The account that created the file is the owner
A group is a collection of Unix accounts
A group can only be set up by a system administrator
Every file or directory is assigned to a group
The last class of users is everyone else
Any account that is not the owner or a member of the group ...
is a member of this user class
It is sometimes called other

Viewing Access Permissions

To view the permissions of a file or directory use ls -l

	it244gh@itserver6:~$ ls -l
	total 4
	-rw-r--r-- 1 it244gh ugrad    0 May  7 09:47 foo.txt
	lrwxrwxrwx 1 it244gh ugrad   36 Sep 23  2017 it116 -> /courses/it116/s26/ghoffman/it244gh/
	lrwxrwxrwx 1 it244gh ugrad   36 Sep 23  2017 it117 -> /courses/it117/s26/ghoffman/it244gh/
	lrwxrwxrwx 1 it244gh ugrad   36 Sep 23  2017 it244 -> /courses/it244/s26/ghoffman/it244gh/
	drwxrwxrwx 5 it244gh ugrad 4096 Apr  7 09:34 tmp

The character in the first column indicates the type of file
A dash, -, means an ordinary file
The letter d indicates a directory
The letter l (el) indicates a link
The next three characters indicate the permission of the owner
r means the owner has read permission
w means the owner has write (change) permission
x means the owner has execute (run) permission
- means the owner does not have the permission that would normally appear in this column
The next three characters give the permissions of the group
The last three characters are the permission of all other accounts
The next column is a number that indicates the number of links to the file or directory
The following column is the owner of the file or directory
Next, you will find the group assigned to the file or directory

`chmod`

When a file is created, is has certain default permissions

	$ touch test.txt
	$ ls -l test.txt 
	-rw-r--r-- 1 it244gh libuuid 0 2012-09-17 14:40 test.txt

To change these permission, you need to use the chmod command
Only the owner of a file can do this
chmod requires two arguments
- The permissions you want to grant
- The name of the file(s) or directory(s) to which the change will be applied

The format for a call to chmod is

	chmod  PERMISSIONS  FILES_OR_DIRECTORIES

The permission can be specified in two ways
- Symbolically
- Numerically
Symbolic permissions use letters and the plus and minus signs
The numeric form uses three digits running from 0 to 7
I will teach the numeric format for expressing permissions
You must use the numeric method in all homework assignments, quizzes and tests
Scoring answers that use the symbolic method takes time I do not have

Using `chmod` with Numeric Arguments

The numeric permissions format uses three digits
Each digit is a number from 0 to 7
The first digit gives the permission of the owner
The second digit gives the permissions assigned to the group
The third digit gives the permissions for every other account
How do you get three pieces of information out of one number?
By adding powers of two
Each digit is the sum of three other numbers
When constructing each of these 3 digits ...
you start with 0 and add
- 4 if you want to give read permission
- 2 if you want to give write permission
- 1 if you want to give execute permission
Notice that all the number are powers of two
If we write these values in binary notation
- 100 represents 4
- 010 represents 2
- 001 represents 1
A single decimal digit from 0 to 7 is represented by 3 binary digits
This is how we get three pieces of information out of one digit
For example, to give full permissions I would add
- 4 for read permission
- 2 for write permission
- 1 for execute permission
So the total, 7, represents all three permissions

Try to remember this chant

	read    write   execute
	4       2       1
	owner   group   everyone

Remember that you need three digits ...
to specify the full permissions for a file or directory

Attendance

New Material

The root Account

On every Unix or Linux system there is a special account named root
This account is sometimes referred to as the superuser
root can access any file or run any program
root is an administrator account
It is used for system configuration and maintenance
Even a system administrator should not log in as root
Because root is very powerfull
Instead he or she should use a regular Unix account ...
and should switch to the root account only when they need its power
This can be done with the su (switch user) command
To become the root user you would enter the following on the command line
```
	su -
```
This will only work if you know the root password
A better way of doing this is to use the sudo command
sudo stands for superuser do
You type sudo and then the command that only the root user can run
You use it like this
```
	sudo COMMAND_ONLY_ROOT_CAN_RUN
```
You will then be prompted for your password
Not the root password
This will only work if the system administer has added you to the sudoers list
sudo is safer than using su -
Because the person using it does not have to know the root password
If all administrators knew the root password ...
you would have to change it every time one of them left
If instead they all used sudo it would be much easier
You would just delete the account of the terminated employee
And delete the acount name from the sudoers list

Directory Access Permissions

Directories are a special kind of file
They do not hold user data
They hold the names and internal representation of other files and directories
Unix permissions work a little differently for directories
Read and write permissions for a directory are similar to those for a file
Read permission on a directory allows you to list the contents ...
using ls
Read permission on a directory only allows you to run ls on it
To read the contents of the files in the directory ...
you need read permission for each file
Read permission on a directory does not allow you to read the files in that directory
You need read permission on the file to do that
Write permission on a directory allows you to create or delete anything in that directory ...
and to change the name of anything inside that directory
But you cannot change the files themselves ...
unless you have write permission on those files
Write permission on a directory only applies to the contents of a directory
Not to the directory itself
You cannot change the directory name or delete a directory on which you have write permission
To do that you have write permission on its parent directory
Execute permission on a directory ...
is very different from execute permission on a file
You can't run a directory from the command line like a program or script
Execute permission on a directory allows you to cd into that directory ...
so you can make the directory your current directory

Links

Sometimes you want more than one way of getting to a file or directory
Windows, for example has shortcuts
You can create a shortcut anywhere ...
and clicking on it will take you to the real file
This allows the user another way of getting to the file ...
instead of going to the directory that holds the file
In Unix these pointer files are called links
Links allow you to move to a directory ...
that is far away from your current directory
If your current directory has a link to another directory ...
you can use the link to access that file or directory
This saves you the bother of using a long absolute or relative pathname

For example, each of you has an entry in your home directory called it244

	$ ls -l it244
	lrwxrwxrwx 1 ghoffman faculty 39 May 30 14:08 it244 -> /courses/it244/s26/ghoffman/ghoffman/

Notice the l (el), the first character in the permissions string
This tells you that you have a link named it244, not a directory
The real directory is ghoffman inside /courses/it244/s26/ghoffman
This diagram shows the situation

You can use the link just as if it were a directory
If you cd to the link, you will go to the real directory
If you then use pwd inside the directory you will see
```
	$ pwd
	/home/ghoffman/it244
```
The path that pwd prints ...
is the route you took to get to the current directory
But it is not the real path to the directory
You can only get the true location ,,,

if you use pwd with the -P option

	$ pwd
	/home/ghoffman/it244
	
	$ pwd -P
	/courses/it244/s26/ghoffman/ghoffman

You must use a capital P, not a lowercase p
Unix tries to hide your real location when you use a link ...
so as not to confuse you

I can get back to where I came from using ..

	$ pwd
	/home/ghoffman/it244
	
	$ cd ..
	
	$ pwd
	/home/ghoffman

Why does your home directory have a link to your it244 class directory?
To make things easier for instructors like me
If you did your work for this course in your home directory ...
it would make more work for me
I would have to go to many places to collect your assignments
Instead I only have to go one place ...
the class directory
And if I run ls in the class directory ...
I see each of your course directories
The it244 entry in your home directory is a link
It points to your course directory in /courses/it244/s26/ghoffman
The name of your course directory is your Unix username

The Two Types of Links

There are two types of links
- Hard links
- Symbolic, or soft, links
Hard links are older
But they are not used much these days
A hard link is like a duplicate file name
If you have a hard link to a file and the original filename is deleted ...
the file will still be there
The file will remain until the last hard link is removed
Hard links have some disadvantages
Hard links can only point to files, not directories
Our Unix filesystem appears to be a single hierarchy
In reality it is a collection of different file systems ..
on different hard disk volumes
The different file systems are stitched together ...
so they look like a single system
Unix hides this fact from users
But this causes problems for hard links
You can only have a hard link to a file in the same volume ...
as the link you are creating
That means you can't link to a file on a different disk or partition
Symbolic links are much more flexible
Symbolic links are sometimes called soft links
You can use either an absolute or relative pathname ...
when creating a symbolic link
A symbolic link can point to a file or directory on any disk or partition

`ln`

How do you create a link?
You did it with the ln utility
To create a symbolic or soft link, use ln with the -s option
Otherwise you will create a hard link
That is not usually what you want
ln takes two arguments
```
ln  -s  PATHNAME  [LINK_NAME]
```
The second argument, the link name, is optional
If you ommit it, the link name will be the same as the name of the file or directory ...
that you are linking to

Here is an example

$ pwd
/home/it244gh

$ ln  -s  ~ghoffman/course_files/it244_files  examples

$ ls -l examples
lrwxrwxrwx 1 it244gh libuuid 28 2012-09-17 17:53 examples -> /home/ghoffman/examples_it244

Removing a Link

To delete a link, use rm
This will work whether the link points to a file or a directory
If you delete a symbolic link it will not affect the file or directory it points to
If you delete a hard link you will not delete the file ...
unless the link is the last connection to the file

Setuid and Setgid Permissions

Sometimes a program needs to read or modify a file ...
to do the work it was designed to do
The passwd command is used to change the password for an account
To do this it has to make changes to the file /etc/shadow
But /etc/shadow is owned by the root account
And no other account can change it
To deal with situations like this, two special permissions were created
- setuid
- setgid
If a program file has setuid permission ...
any account that runs the program has the same permission as the owner ...
when accessing files the program needs to function
This permission means a user can modify files that the program needs to do its job ...
even files for which that user has no permissions
setgid permission is similar
Anyone who runs the program has the permissions ...
of the group assigned to that program
setuid and setgid permissions only apply to executable files
That is, programs and scripts
A file with setuid permission will have s in place of x in the owner's execute column
A file with setgid permission will have s in place of x in the group's execute column
Since these permission only appear in the executable column ..
there is no ambiguity in replacing x with s
For example, consider the passwd command
The executable file for this utility is /usr/bin/passwd

Running ls -l on this file we get

ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 42824 2011-02-20 19:18 /usr/bin/passwd

Notice the s in the place where the owner's execute permission should be
The passwd command needs to modify /etc/shadow ..
which is a file that stores the encrypted passwords

Only root can change this file

ls -l /etc/shadow
-rw-r--r-- 1 root shadow 926 Jul 16  2013 /etc/shadow

But you need to change this file when you change your password
The setuid permission allows you to run passwd and modify /etc/shadow
You can do this when you run passwd because the it has setuid permission ...
even though you could not change this file directly using nano
setuid and setgid permissions work unlike other permissions
You set these permissions on executable files ...
but they affect the access to the data files these programs use

Setting Setuid and Setgid with `chmod`

How do you assign setuid or setgid permissions to a file?
You do it with chmod and an extra digit
If I wanted to assign 755 permission to a script ...
along with setuid permission ...
I would use 4755 as the first argument to chmod
When 4 is the first digit in a series of four digits used with chmod ...

setuid permission is assigned to the file

$ chmod 4755 work.sh 

$ ls -l work.sh 
-rwsr-xr-x 1 ghoffman grad 0 Mar  3 12:30 work.sh

To assign the setgid permission I would use 2 instead

$ chmod 2755 work.sh 

$ ls -l work.sh 
-rwxr-sr-x 1 ghoffman grad 0 Mar  3 12:30 work.sh

setuid and setgid will not be on any test or quiz

General Advice

Tips and Examples

Review

New Material

Questions

Homework 5

Today's Class

General Advice

Read the Material Before Class

Tips and Examples

Using Pathnames

Using a Pathname to Run a Script

Practice with Access Permissions

Review

Access Permissions

Viewing Access Permissions

chmod

Using chmod with Numeric Arguments

Attendance

New Material

The root Account

Directory Access Permissions

Links

The Two Types of Links

ln

Removing a Link

Setuid and Setgid Permissions

Setting Setuid and Setgid with chmod

Class Exercise

Class Quiz

`chmod`

Using `chmod` with Numeric Arguments

`ln`

Setting Setuid and Setgid with `chmod`