liunx命令3 attr、lsattr；特殊权限suid、sgid、sticky

attr文件隐藏属性
lsattr、chattr
[root@wangchao ~]# lsattr //查看当前目录特殊权限
-------------e- ./12.txt
-------------e- ./222
-------------e- ./1112
[root@wangchao ~]# chattr +a 1.txt //加a标记
[root@wangchao ~]# lsattr 1.txt
-----a-------e- 1.txt
[root@wangchao ~]# vim 1.txt //修改文件保存失败
"1.txt" E212: Can't open file for writing
[root@wangchao ~]# echo "1111">>1.txt //追加重定向成功（在文件后加内容）
[root@wangchao ~]# echo "1111">1.txt //重新赋内容失败
-bash: 1.txt: Operation not permitted
[root@wangchao ~]# rm -f 1.txt //删除失败，无权限
rm: cannot remove `1.txt': Operation not permitted
[root@wangchao ~]# mv 1.txt 11.txt //重命名失败
mv: cannot move `1.txt' to `11.txt': Operation not permitted
[root@wangchao ~]# chattr -a 1.txt //去掉a
[root@wangchao ~]# echo "111">1.txt //重定向成功
[root@wangchao ~]# cat 1.txt
111

[root@wangchao ~]# chattr +i 1.txt //加i标记
[root@wangchao ~]# chattr "2222">1.txt //加i后，更改文件操作都失败
-bash: 1.txt: Permission denied
[root@wangchao ~]# chattr "2222">>1.txt
-bash: 1.txt: Permission denied
[root@wangchao ~]# mv 1.txt 11.txt
mv: cannot move `1.txt' to `11.txt': Operation not permitted
[root@wangchao ~]# chown wangchao 1.txt
chown: changing ownership of `1.txt': Operation not permitted
[root@wangchao ~]# chattr -i 1.txt //解除i限制

+a后，仅仅可增加文件内容，不能删除，改
+i后，不能删，改，重命名

[root@wangchao ~]# mkdir -p 111/234/456
[root@wangchao ~]# touch 111/234/456/12.txt
[root@wangchao ~]# lsattr -R 111 //列出111下所有子目录，文件，权限
-------------e- 111/234

111/234:
-------------e- 111/234/456

111/234/456:
-------------e- 111/234/456/12.txt
[root@wangchao ~]# chattr +i 111/234/456/12.txt
[root@wangchao ~]# rm -rf 111 //删除失败
rm: cannot remove `111/234/456/12.txt': Operation not permitted
[root@wangchao ~]# lsattr -R 111 //逐层显示特殊权限
-------------e- 111/234

111/234:
-------------e- 111/234/456

111/234/456:
----i--------e- 111/234/456/12.txt
[root@wangchao ~]# lsattr -d 111 //查看目录本身特殊权限
-------------e- 111

特殊权限suid
[root@wangchao ~]# umask
0022
[root@wangchao ~]# ls -l /etc/shadow //存放密码文件
----------. 1 root root 1221 Jul 3 06:19 /etc/shadow
//该文件任何人都没有权限，但是root还是拥有绝对权限，其他也可以改自己的密码
[root@wangchao ~]# ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 25980 Feb 22 2012 /usr/bin/passwd
有个s标记即set_uid,使使用命令的人临时拥有root的权限

[root@wangchao ~]# which ls
alias ls='ls --color=auto'
/bin/ls
[root@wangchao ~]# su - wangchao
[wangchao@wangchao ~]$ ls /root/ //权限不够不能看root目录
ls: cannot open directory /root/: Permission denied
[wangchao@wangchao ~]$ logout
[root@wangchao ~]# ls -l /bin/ls
-rwxr-xr-x. 1 root root 118932 Oct 15 2014 /bin/ls
[root@wangchao ~]# chmod u+s /bin/ls //加s权限，使使用的人拥有root权限
[root@wangchao ~]# ls -l /bin/ls
-rwsr-xr-x. 1 root root 118932 Oct 15 2014 /bin/ls
[root@wangchao ~]# !su
su - wangchao
[wangchao@wangchao ~]$ ls /root/ //加了s权限后，能看root目录了
111 1.txt 234 Documents install.log.syslog Public
1112 1.txt~ anaconda-ks.cfg Downloads Music Templates
12.txt 222 Desktop install.log Pictures Videos

set_uid 该特殊权限只能用于可执行文件及二进制文件上，非二进制文件加s位，不起作用（ls为二进制文件）

[root@wangchao ~]# chmod u-x /bin/ls //u减x权限
[root@wangchao ~]# ls -l /bin/ls //去掉x权限后，小s变成了大S
-rwSr-xr-x. 1 root root 118932 Oct 15 2014 /bin/ls
[root@wangchao ~]# ls //ls还是可以使用
111 1.txt 234 Documents install.log.syslog Public
1112 1.txt~ anaconda-ks.cfg Downloads Music Templates
12.txt 222 Desktop install.log Pictures Videos
[root@wangchao ~]# su - wangchao
[wangchao@wangchao ~]$ ls /root/ //还是可以正常使用ls命令，有X权限
111 1.txt 234 Documents install.log.syslog Public
1112 1.txt~ anaconda-ks.cfg Downloads Music Templates
12.txt 222 Desktop install.log Pictures Videos
[wangchao@wangchao ~]$ logout
[root@wangchao ~]# chmod o-x /bin/ls //所有人去x权限
[root@wangchao ~]# ls -l /bin/ls
-rwSr-xr--. 1 root root 118932 Oct 15 2014 /bin/ls
[wangchao@wangchao ~]$ ls /root/ //ls不能被wnagchao用户使用了
-bash: /bin/ls: Permission denied
[root@wangchao ~]# chmod o+x /bin/ls //改回到原先状态
[root@wangchao ~]# chmod u-s /bin/ls
[root@wangchao ~]# chmod u+x /bin/ls
[root@wangchao ~]# ls -l /bin/ls
-rwxr-xr-x. 1 root root 118932 Oct 15 2014 /bin/ls

特殊权限之sgid
[root@wangchao ~]# ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 25980 Feb 22 2012 /usr/bin/passwd

755 u+s =4755
[root@wangchao ~]# ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 25980 Feb 22 2012 /usr/bin/passwd
[root@wangchao ~]# chmod 4755 /usr/bin/passwd
[root@wangchao ~]# ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 25980 Feb 22 2012 /usr/bin/passwd

-rwsr-xr-x=4755
r=4,w=2,x=1,set_uid=4,set_gid=2,stick_bit=1
[root@wangchao ~]# ls -l /bin/ls
-rwxr-xr-x. 1 root root 118932 Oct 15 2014 /bin/ls
[root@wangchao ~]# chmod g+s /bin/ls //使使用命令者有其组权限
[root@wangchao ~]# ls -l /bin/ls
-rwxr-sr-x. 1 root root 118932 Oct 15 2014 /bin/ls
[root@wangchao ~]# su - wangchao
[wangchao@wangchao ~]$ ls /root/
111 1.txt 234 Documents install.log.syslog Public
1112 1.txt~ anaconda-ks.cfg Downloads Music Templates
12.txt 222 Desktop install.log Pictures Videos
//可以使用ls查看root目录，因为有了root组的权限
[wangchao@wangchao ~]$ logout
[root@wangchao ~]# chmod g-s /bin/ls
//去掉sgid,其他用户不能使用ls，查看root目录了
[root@wangchao ~]# su - wangchao
[wangchao@wangchao ~]$ ls /root/
ls: cannot open directory /root/: Permission denied
[wangchao@wangchao ~]$ logout

[root@wangchao ~]# cd /tmp/
[root@wangchao tmp]# chmod 777 222
[root@wangchao tmp]# su - wangchao
[wangchao@wangchao ~]$ cd /tmp/222/
[wangchao@wangchao 222]$ ls
[wangchao@wangchao 222]$ mkdir dir
[wangchao@wangchao 222]$ touch file
[wangchao@wangchao 222]$ ls -l
total 4
drwxrwxr-x. 2 wangchao wangchao 4096 Jul 3 10:15 dir
-rw-rw-r--. 1 wangchao wangchao 0 Jul 3 10:15 file
[wangchao@wangchao 222]$ logout
[root@wangchao tmp]# chmod g+s 222/
[root@wangchao tmp]# !su
su - wangchao
[wangchao@wangchao ~]$ cd /tmp/222/
[wangchao@wangchao 222]$ touch file2
[wangchao@wangchao 222]$ mkdir dir2
[wangchao@wangchao 222]$ ls -l
total 8
drwxrwxr-x. 2 wangchao wangchao 4096 Jul 3 10:15 dir
drwxrwsr-x. 2 wangchao root 4096 Jul 3 10:17 dir2
-rw-rw-r--. 1 wangchao wangchao 0 Jul 3 10:15 file
-rw-rw-r--. 1 wangchao root 0 Jul 3 10:17 file2

[wangchao@wangchao 222]$ ls -ld
drwxrwsrwx. 4 root root 4096 Jul 3 10:17 .

如果是set_gid作用于目录：目录无论谁创建目录或文件时，创建的目录，文件与set_gid作用的目录所属组保持一致。
set_gid即可作用于文件也可作用于目录

set_gid的权限
[wangchao@wangchao 222]$ logout
[root@wangchao tmp]# chmod 2755 /bin/ls
[root@wangchao tmp]# ls -l !$
ls -l /bin/ls
-rwxr-sr-x. 1 root root 118932 Oct 15 2014 /bin/ls
[root@wangchao tmp]# chmod g-x /bin/ls //同理无x权限，也将变成大S标记
[root@wangchao tmp]# !ls
ls -l /bin/ls
-rwxr-Sr-x. 1 root root 118932 Oct 15 2014 /bin/ls

[root@wangchao tmp]# chmod g+x /bin/ls //还原到原先状态
[root@wangchao tmp]# chmod g-s /bin/ls
[root@wangchao tmp]# ls -l /bin/ls
-rwxr-xr-x. 1 root root 118932 Oct 15 2014 /bin/ls

有执行权限为小s
无执行权限为大S

特殊权限之sticky (防删除位)
[root@wangchao ~]# cd /tmp/
[root@wangchao tmp]# mkdir 333
[root@wangchao tmp]# chmod 777 333 //给权限给任何人
[root@wangchao tmp]# cd 333
[root@wangchao 333]# vi 12.txt
[root@wangchao 333]# cat 12.txt
1234
[root@wangchao 333]# ls -l 12.txt
-rw-r--r--. 1 root root 5 Jul 3 21:05 12.txt
[root@wangchao 333]# su - wangchao
[wangchao@wangchao ~]$ cd /tmp/333/
[wangchao@wangchao 333]$ ls -l
total 4
-rw-r--r--. 1 root root 5 Jul 3 21:05 12.txt
[wangchao@wangchao 333]$ vi 12.txt
//文件为只读，但：wq还是可以强制保存，实际上是删除了原文件，新建了新文件
[wangchao@wangchao 333]$ cat 12.txt
1234aaakkkkkkk
[wangchao@wangchao 333]$ ls -l //查看文件，以由root变为wangchao
total 4
-rw-r--r--. 1 wangchao wangchao 15 Jul 3 21:06 12.txt
[wangchao@wangchao 333]$ ls -ld
drwxrwxrwx. 2 root root 4096 Jul 3 21:06 .
[wangchao@wangchao 333]$ logout
[root@wangchao 333]# chmod o+t . //将文件加t标记
[root@wangchao 333]# ls -ld
drwxrwxrwt. 2 root root 4096 Jul 3 21:06 .
[root@wangchao 333]# chmod o-x . //文件无x权限，小t变为大T
[root@wangchao 333]# ls -ld
drwxrwxrwT. 2 root root 4096 Jul 3 21:06 .
[root@wangchao 333]# chmod o+x . //加回x权限，否则其他人无法打开该目录
[root@wangchao 333]# ls -l
total 4
-rw-r--r--. 1 wangchao wangchao 15 Jul 3 21:06 12.txt
[root@wangchao 333]# cp 12.txt 33.txt
[root@wangchao 333]# ls -l
total 8
-rw-r--r--. 1 wangchao wangchao 15 Jul 3 21:06 12.txt
-rw-r--r--. 1 root root 15 Jul 3 21:09 33.txt
[wangchao@wangchao 333]$ rm -f 33.txt
rm: cannot remove `33.txt': Operation not permitted
//加了t标记后，删除失败（不能删除他人的文件）。

T权限只能作用于目录，对文件无意义。