LinuxBasics - Revision history

Daveturner: /* Access Control Lists */

2025-01-15T22:50:45Z

Access Control Lists

Daveturner: /* Ownership and Permissions */

2025-01-15T22:49:15Z

Ownership and Permissions

← Older revision		Revision as of 17:49, 15 January 2025
Line 388:		Line 388:
	Permissions as described above determine how you can use your own files and directories.		Permissions as described above determine how you can use your own files and directories.
	If you want to share any files, or create a shared directory that other users or your entire		If you want to share any files, or create a shared directory that other users or your entire
	research group access, please go to the ~~Advanced Slurm~~		research group access, please go to the
	[[AdvancedSlurm\|~~File_Sharing~~]] documentations and read about Access Control Lists (ACLs).		[[AdvancedSlurm\|Advanced Slurm]] documentations and read about File Sharing using Access Control Lists (ACLs).

	=== Access Control Lists ===		=== Access Control Lists ===

Daveturner: /* Ownership and Permissions */

2025-01-15T22:46:20Z

Ownership and Permissions

← Older revision		Revision as of 17:46, 15 January 2025
Line 388:		Line 388:
	Permissions as described above determine how you can use your own files and directories.		Permissions as described above determine how you can use your own files and directories.
	If you want to share any files, or create a shared directory that other users or your entire		If you want to share any files, or create a shared directory that other users or your entire
	research group access, please go to the		research group access, please go to the Advanced Slurm
	[[AdvancedSlurm\|~~File Sharing~~]] documentations.		[[AdvancedSlurm\|File_Sharing]] documentations and read about Access Control Lists (ACLs).

	=== Access Control Lists ===		=== Access Control Lists ===

Daveturner: /* Ownership and Permissions */

2025-01-15T22:44:47Z

Ownership and Permissions

← Older revision		Revision as of 17:44, 15 January 2025
Line 389:		Line 389:
	If you want to share any files, or create a shared directory that other users or your entire		If you want to share any files, or create a shared directory that other users or your entire
	research group access, please go to the		research group access, please go to the
	[~~Advanced Documentation on Access Control Lists~~]~~(https://support.beocat.ksu.edu/Docs/AdvancedSlurm#File_Sharing)~~.		[[AdvancedSlurm\|File Sharing]] documentations.

	=== Access Control Lists ===		=== Access Control Lists ===

Daveturner: /* Ownership and Permissions */

2025-01-15T22:41:47Z

Ownership and Permissions

← Older revision		Revision as of 17:41, 15 January 2025
Line 389:		Line 389:
	If you want to share any files, or create a shared directory that other users or your entire		If you want to share any files, or create a shared directory that other users or your entire
	research group access, please go to the		research group access, please go to the
	[Advanced Documentation on Access Control Lists][https://support.beocat.ksu.edu/Docs/AdvancedSlurm#File_Sharing}.		[Advanced Documentation on Access Control Lists](https://support.beocat.ksu.edu/Docs/AdvancedSlurm#File_Sharing).

	=== Access Control Lists ===		=== Access Control Lists ===

Daveturner: /* Ownership and Permissions */

2025-01-15T22:38:16Z

Ownership and Permissions

← Older revision		Revision as of 17:38, 15 January 2025
Line 375:		Line 375:
	* The final column ('MyProgram') is the name of the file		* The final column ('MyProgram') is the name of the file

	So why is this interesting to us? Because ~~whenever~~ things ''don't'' work, it's usually because of file ownership or permissions. Looking at these often gives us some useful diagnostic information.		So why is this interesting to us? Because often when things ''don't'' work, it's usually because of file ownership or permissions. Looking at these often gives us some useful diagnostic information.

	The permissions field shows us who has permissions to do what with this file. It is always 10 characters. The first character (-) is usually either a '-' for a regular file or a 'd' for a directory. The next 9 characters are broken into three groups of three, with each group showing read (r), write (w), and execute (x) permissions for the owner, group, and world, in that order.		The permissions field shows us who has permissions to do what with this file. It is always 10 characters. The first character (-) is usually either a '-' for a regular file or a 'd' for a directory. The next 9 characters are broken into three groups of three, with each group showing read (r), write (w), and execute (x) permissions for the owner, group, and world, in that order.
Line 386:		Line 386:
	This changes the permissions so that the user ('u', i.e., the owner) adds ('+') execute permission ('x').		This changes the permissions so that the user ('u', i.e., the owner) adds ('+') execute permission ('x').

	~~For more complex ownership~~ or ~~permissions changes~~, please ~~feel free~~ to ~~contact~~ the ~~Beocat staff~~.		Permissions as described above determine how you can use your own files and directories.
			If you want to share any files, or create a shared directory that other users or your entire
			research group access, please go to the
			[Advanced Documentation on Access Control Lists][https://support.beocat.ksu.edu/Docs/AdvancedSlurm#File_Sharing}.

	=== Access Control Lists ===		=== Access Control Lists ===

Mozes at 16:09, 4 April 2024

2024-04-04T16:09:25Z

← Older revision		Revision as of 11:09, 4 April 2024
Line 24:		Line 24:
	You'll know you are successfully logged in when you see a prompt that says		You'll know you are successfully logged in when you see a prompt that says
	[''username''@''machinename'' ~]$		[''username''@''machinename'' ~]$
	where ''machinename'' is the name of the machine you've logged into (currently either '~~eos~~' or '~~selene~~') and ''username'' is your eID username		where ''machinename'' is the name of the machine you've logged into (currently either 'clymene' or 'helios') and ''username'' is your eID username

	== Transferring files (SCP or SFTP) ==		== Transferring files (SCP or SFTP) ==
Line 328:		Line 328:
	Previously, we gave you the option of using a <code>~/.login</code> to modify your shell. This is no longer supported, if you have issues with your shell/paths/environment variables we will ask you to delete your <code>~/.login</code> file and change your shell via the method below.		Previously, we gave you the option of using a <code>~/.login</code> to modify your shell. This is no longer supported, if you have issues with your shell/paths/environment variables we will ask you to delete your <code>~/.login</code> file and change your shell via the method below.

	You can change your shell is via <code>chsh</code> on either of the headnodes (~~eos~~/~~selene~~). This does not need to be re-done if you've changed to it to your preferred shell in the past.		You can change your shell is via <code>chsh</code> on either of the headnodes (clymene/helios). This does not need to be re-done if you've changed to it to your preferred shell in the past.

	Use the appropriate of the following three lines:		Use the appropriate of the following three lines:

Mozes: /* Example 1 */

2023-09-14T14:41:48Z

Example 1

← Older revision		Revision as of 09:41, 14 September 2023
Line 478:		Line 478:
	First, in each section, we see the POSIX owner and group as comments prefixed by '#' characters. These are what the respective user:: and group:: lines refer to when viewing the permissions.		First, in each section, we see the POSIX owner and group as comments prefixed by '#' characters. These are what the respective user:: and group:: lines refer to when viewing the permissions.

	Second, we have lines related to the permissions of each accessor. These do what they say, show the permissions that an accessor would be granted. Please note there is a catch here, it seems to be most specific permission wins. This can come into play with granting a certain group access and then a specific member of the group a ~~differering~~ level of access.		Second, we have lines related to the permissions of each accessor. These do what they say, show the permissions that an accessor would be granted. Please note there is a catch here, it seems to be most specific permission wins. This can come into play with granting a certain group access and then a specific member of the group a differing level of access.

	Third, on many of them there are lines prefixed with default: and then a permissions set. Default permissions are interesting. They are only set to directories and they define the starting set of acls that should be set when new files or folders are created within that folder.		Third, on many of them there are lines prefixed with default: and then a permissions set. Default permissions are interesting. They are only set to directories and they define the starting set of acls that should be set when new files or folders are created within that folder.

Mozes: /* Example 2 */

2023-06-05T21:03:57Z

Example 2

← Older revision		Revision as of 16:03, 5 June 2023
Line 532:		Line 532:
	There are a few things to note there:		There are a few things to note there:
	* We're setting multiple acls at once (note the multiple -m arguments)		* We're setting multiple acls at once (note the multiple -m arguments)
	* We're setting those permissions recursively (on all files/folders nested anywhere in that directory hierarchy).		* We're setting those permissions recursively (on all files/folders nested anywhere in that directory hierarchy). The <tt>-R</tt> option does this.
	* We're setting some default permissions. Default permissions are prefixed with d:. Here we're saying that the (g)roup my_grad_students should be granted read/write permissions, we aslo set a default permission for ourselves. d:u:mozes:rw grants me read/write access to those files as if I were the owner, this is nice in the event that you're not a member of the my_grad_students group, it would make sure that you still retain a reasonable baseline of access.		* We're setting some default permissions. Default permissions are prefixed with d:. Here we're saying that the (g)roup my_grad_students should be granted read/write permissions, we aslo set a default permission for ourselves. d:u:mozes:rw grants me read/write access to those files as if I were the owner, this is nice in the event that you're not a member of the my_grad_students group, it would make sure that you still retain a reasonable baseline of access.

Mozes: /* Access Control Lists */

2023-06-05T20:56:11Z

Access Control Lists

← Older revision		Revision as of 15:56, 5 June 2023
Line 391:		Line 391:
	Access Control Lists build on our knowledge and use of basic Linux permissions, so we'll cover those again:		Access Control Lists build on our knowledge and use of basic Linux permissions, so we'll cover those again:

	Linux permissions are typically broken down to (r)ead, (w)rite, and e(x)ecute split across 3 classes of accessors.		Linux permissions are typically broken down to ('''r''')ead, ('''w''')rite, and e('''x''')ecute split across 3 classes of accessors.

	'''Files'''		'''Files'''
Line 409:		Line 409:
	: Pass through the directory (cd into and through).		: Pass through the directory (cd into and through).

	Those accessors are (u)ser, (g)roup, and (o)ther.		Those accessors are ('''u''')ser, ('''g''')roup, and ('''o''')ther.
	; user		; user
	: The user would typically be the user account that created the file or folder		: The user would typically be the user account that created the file or folder
Line 415:		Line 415:
	: The group would be that accounts primary group by default or can be changed by the user to be any group that they are a member of		: The group would be that accounts primary group by default or can be changed by the user to be any group that they are a member of
	; other		; other
	: Other is special, other is anything that doesn't meet either of the two other critera. We typically refer to them as world permissions, as they match everyone else.		: Other is special, other is anything that doesn't meet either of the two other critera. We typically refer to them as world permissions, as they match ''everyone'' else.

	Unfortunately, it is that "Other" permission that is a frequent problem. You may want to share some data with a colleague, but, from a security standpoint, you also may need to make sure that only that colleague has access to the data. If you aren't in the same group as the colleague, then, under standard Linux permissions, you have no other option except making the file "world" accessible.		Unfortunately, it is that "Other" permission that is a frequent problem. You may want to share some data with a colleague, but, from a security standpoint, you also may need to make sure that only that colleague has access to the data. If you aren't in the same group as the colleague, then, under standard Linux permissions, you have no other option except making the file "world" accessible.
Line 433:		Line 433:

	==== Example 1 ====		==== Example 1 ====
	Let's say I have a file in a directory that I want the user billy to be able to read. This file is /homes/mozes/example/input.file. We'll look at the current permissions of the directory tree like so:		Let's say I have a file in a directory that I want the user billy to be able to read. This file is <tt>/homes/mozes/example/input.file</tt>. We'll look at the current permissions of the directory tree like so:

	We'll assume everyone has requisite permissions for / and /homes.		We'll assume everyone has requisite permissions for <tt>/</tt> and <tt>/homes</tt>.

	First we'll check my home directory		First we'll check my home directory
Line 484:		Line 484:
	Finally, there is a mask, I'm not covering it because there are very few cases that people would need to use them.		Finally, there is a mask, I'm not covering it because there are very few cases that people would need to use them.

	Back to the task at hand, We want billy to be able to read /homes/mozes/example/input.file. ~~checking~~ /homes/mozes, we see that 'other' has no permissions, and billy is not granted any special access ~~yet~~.		Back to the task at hand, We want billy to be able to read <tt>/homes/mozes/example/input.file</tt>. Checking <tt>/homes/mozes</tt>, we see that 'other' has no permissions, and billy has not been granted any special access.

	So we grant billy access "through" /homes/mozes, granting the smallest set of permissions would be this:		So we grant billy access "through" <tt>/homes/mozes</tt>, granting the smallest set of permissions would be this:
	$ setfacl -m u:billy:x /homes/mozes		$ setfacl -m u:billy:x /homes/mozes

	Note, since I didn't give billy read access to my home directory, they wouldn't be able to 'ls /homes/mozes', they can simply cd into it and through it.		Note, since I didn't give billy read access to my home directory, they wouldn't be able to <tt>ls /homes/mozes</tt>, they can simply cd into it and through it.

	Then we check the rest of the permissions, /homes/mozes/example has an 'other' permission granting (r)ead and e(x)ecute, so that shouldn't be an issue. /homes/mozes/example/input.file allows 'other' to read it, so our job is done. Billy has access to read my file.		Then we check the rest of the permissions, <tt>/homes/mozes/example</tt> has an 'other' permission granting (r)ead and e(x)ecute, so that shouldn't be an issue. <tt>/homes/mozes/example/input.file</tt> allows 'other' to read it, so our job is done. Billy has access to read my file.

	If we decide later that billy needs to write to my file, we can grant them specific read/write permissions to just that file with:		If we decide later that billy needs to write to my file, we can grant them specific read/write permissions to just that file with:
Line 527:		Line 527:
	default:mask::r-x		default:mask::r-x

	We now want to grant my group of grad students the correct permissions to /homes/mozes/example		We now want to grant my group of grad students the correct permissions to <tt>/homes/mozes/example</tt>
	$ setfacl -R -m g:my_grad_students:rw -m d:g:my_grad_students:rw -m d:u:mozes:rw /homes/mozes/example		$ setfacl -R -m g:my_grad_students:rw -m d:g:my_grad_students:rw -m d:u:mozes:rw /homes/mozes/example

Line 535:		Line 535:
	* We're setting some default permissions. Default permissions are prefixed with d:. Here we're saying that the (g)roup my_grad_students should be granted read/write permissions, we aslo set a default permission for ourselves. d:u:mozes:rw grants me read/write access to those files as if I were the owner, this is nice in the event that you're not a member of the my_grad_students group, it would make sure that you still retain a reasonable baseline of access.		* We're setting some default permissions. Default permissions are prefixed with d:. Here we're saying that the (g)roup my_grad_students should be granted read/write permissions, we aslo set a default permission for ourselves. d:u:mozes:rw grants me read/write access to those files as if I were the owner, this is nice in the event that you're not a member of the my_grad_students group, it would make sure that you still retain a reasonable baseline of access.

	That all looks good, right? Except my grad students are complaining that they can't access /homes/mozes/example. What did we forget?		That all looks good, right? Except my grad students are complaining that they can't access <tt>/homes/mozes/example</tt>. What did we forget?

	Permissions are checked at every level of the directory hierarchy, and we forgot to grant my_grad_students access through my home directory.		Permissions are checked at every level of the directory hierarchy, and we forgot to grant my_grad_students access through my home directory.