Linux Access Privileges 2: Access Again

In our last article, we covered the chmod command which allows you to manipulate file access permissions on a per-user and per-group basis.That article covered the basics, so with this one we want to get a little deeper with advanced attributes. Let's start off with 'suid' and 'sgid.'

Suid and sgid bits are useful if a user needs to run an executable that they otherwise don't have any priveleges for. Before execution, the system checks these bits and substitutes the current user's privileges to the owner`s (or owner's group) of a file. If we want to, for example, restart apache process and we`d like to delegate its execution to an unprivileged (not root or sudoer) user of our system, we'd start with the following script:


echo service httpd restart >> /home/myuser/restart-apache.sh

Make it executable:


chmod +x /home/myuser/restart-apache.sh

Change owner (if you're running these scripts as root, skip this step):


chown root:root /home/myuser/restart-apache.sh

Finally, set the suid bit and change the other permissions:


chmod 4750 /home/myuser/restart-apache.sh

In this script, 4 - SUID (Substitute user id to the owner`s for the execution process) 7 - owner have full access (read, write, execute) 5 - owner-group can read and execute, and 0 - others can do nothing.

Or you can set the SGID:


chmod 6570 /home/myuser/restart-apache.sh

ls -l ./restart-apache.sh
-rwsr-xr-x 1 root root 24 2016-06-02 22:03 ./restart-apache.sh

Some things to keep in mind:

1. Don`t allow the delegated user to change the file - they can replace the content and run any other command with higher privileges.

2. Some modern distributions of Linux can ignore SUID and SGID bits.

3. While the it's important to know and understand suid and sgid commands, you should probably never run them on your production servers. It`s kind of a "quick and dirty" hack, the best practice is to use sudo with options (you can grant sudo for defined user and any command specified in /etc/sudoers file) .

Sticky bits

Sticky bits are permission bits that are left on files or directories that ensures that only the owner of the file to delete it. As a quick example:

chmod 1750 /home/shared_folder

ls -l /home/shared_folder
drwxr-x--T   2 root  root             4096 2016-06-02 23:03 shared_folder

Here, we can see a new “T” attribute – that's the sticky bit.

Advanced file attributes with lsattr and chattr

Chattr and lsattr are two components of the e2fsilibs package. They're basically used to set other, special, attributes for file and folders. You can quickly list all their attributes using the 'man chattr' command, which will return:


append only (a), 
no atime  updates(A), 
compressed (c), 
no copy on write (C), 
no dump (d), 
synchronous directory updates (D), 
extent format(e), 
immutable (i), 
data journalling (j), 
secure deletion (s), 
synchronous updates (S), 
no  tail-merging(t), 
top of directory hierarchy (T), 
and undeletable (u)

The following attributes are read-only, and may be listed by lsattr but not modified by chattr: compression error (E), huge file (h), indexed directory (I), inline data (N), compression raw access (X), and compressed dirty file (Z).

We can use 'lsattr' to view file attributes. It works almost just like 'ls -l', so we can compare the output of both:


ls -l /etc/passwd
-rw-r--r-- 1 root root 1730 дек 14 16:47 /etc/passwd
and
lsattr /etc/passwd
-------------e-- /etc/passwd

There aren't any advanced attributes set by default. Let's mix it up and set a few with chattr. If we have a file we don't want to change or delete by mistake, and don`t want to let anyone else do it either, we can set an immutable (i) attribute to it:


chattr +i /home/myuser/myVeryImportantFile.txt

Check the result with 'ls -l':


ls -l myVeryImportantFile.txt
-rw-r--r-- 1 root root 0 may 30 02:53 myVeryImportantFile.txt

Nothing changed. And with 'lsattr':


lsattr myVeryImportantFile.txt
----i--------e-- myVeryImportantFile.txt

Notice the 'i' is listed now. Let's try to delete it:


rm myVeryImportantFile.txt
rm: unable to delete «myVeryImportantFile.txt»: operation is not permitted

...Or modify:


echo test >> myVeryImportantFile.txt
bash: myVeryImportantFile.txt: access denied

Perfect. Exactly what we wanted. Now, let's say we want to let users add content to a file, but not to replace or delete any. We have to add an "a" (append only) attribute:


chattr +a Linux_File_Permissions_advanced.txt

lsattr Linux_File_Permissions_advanced.txt
-----a-------e-- Linux_File_Permissions_advanced.txt

echo “Put some text to file” >> Linux_File_Permissions_advanced.txt

cat Linux_File_Permissions_advanced.txt
Write some awesome text! 

Using this script, no one will be able to delete or change any part of that document except to write new content.

For our next trick, let's say we want to remove and completely destroy a file because it has private information in it. As you might know, the rm command does not actually remove anything – it just marks the space as free for the system, and the file system will overwrite it eventually when it needs more space. This means files can be easily restored before it's overwritten with basic software like extundelete, for example. So to prevent any restoration we can use the attribute "s", which will overwrite the file with 0s instead of just marking it as free:


chattr +s ./mysecretfile.txt

lsattr ./mysecretfile.txt
s----------------e- mysecretfile.txt

When you 'rm' it now, after enabling the 's' attribute the file will be deleted and unrestorable. Can be useful when old but vulnerable content needs to get deleted. 

Something I'd like to mention again is that advanced attributes should only be used once you really know what you want to do with them. Personally, I don't think they should ever be used on production servers within companies and organizations, unless you have explicit awareness and permission that you're doing so. Any mistake with regards to these permissions can lead to data being compromised or lost. It's generally much safer to go with the traditional routes of backups, firewalls, antiviruses, antirootkits,encryption and server monitoring (hey, that's us!)

That's all for now. Don't forget to like on follow on Twitter and Facebook so keep updated with new articles from ServerSuit.

Until next time!

June 14 2016

Add or review comments

Please leave your comment

Existing comments

Comments 66


Lbgsesse
viagra brand online sensitivity <a href="http://genqpviag.com/#">viagra softtabs</a> professional vs super active viagra [url=http://genqpviag.com/]viagra trial pack canada[/url] ’
Jdbxsesse
over the counter viagra substitute <a href="http://llviabest.com/#">where can i buy viagra in canada</a> viagra brand frizer [url=http://llviabest.com/]brand viagra[/url] ’
Kbcxhifs
pain relief <a href="http://xuypharmacyonline.com/">walgreens pharmacy online</a> canadian pharmaceuticals online safe
Lbsxsesse
buy generic viagra online <a href="https://ssviagriia.com/ ">where can i buy viagra in ireland</a> cheap prescription drugs online
Jbbvsesse
canada pharmacy online <a href="http://canadianpharmnorx.com/ ">prescription drugs without prior prescription</a> no prescription pharmacies
JbnbUript
canadian pharmacy viagra generic <a href="http://online21rxon.com/ ">eye drop</a> cheap pharmacy online
NncsExole
buy viagra cheap usa <a href="http://lightvigra.com/ ">online pfizer viagra au</a> chewing gum viagra
FvfcExole
viagra on the web <a href="http://hopeviagrin.com/ ">viagra super force</a> genetric viagra
Kuikinend
overnightpharmacy4u brand viagra <a href="http://viagerkr.com/ ">actual prescription cost of viagra</a> viagra optimum on line to canada
Kvaxhifs
are payday loans legal in kansas <a href="http://rirocash.com/ ">payday loans 2k</a> va loan cash out ltv
Labxsesse
cialis high cholesterol <a href="https://jecialisbn.com/ ">cialis 18 ans</a> cialis kaufen wien
Fqbbsesse
payday loans for az residents <a href="http://ascashapply.com/ ">pa cash advances</a> cash loan roodepoort
Jbbnsesse
how does cialis affect the heart <a href="http://ljcialishe.com/ ">cialis es adictivo</a> cialis 20 mg pris
FbsgExole
where can i buy cialis in canada <a href="http://llecialisjaw.com/ ">http://llecialisjaw.com/ </a> cialis with dapoxetine
Kbbfinend
buy viagra in sydney <a href="https://kloviagrli.com/ ">http://kloviagrli.com/ </a> who has the best deal on viagra generic
NbmoExole
cialis usa <a href="https://buycialisxz.com/ ">http://buycialisxz.com/ </a> cheap generic cialis canada
FjjuExole
does viagra work for women <a href="http://viagraonlinejc.com/ ">como funciona el viagra </a> viagra overdose
Lmoppsesse
[url=http://essaywriteris.com/]write my essay website[/url] can someone write my essay for me <a href="http://essaywriteris.com/ ">can i hire someone to write my essay</a> cheap essay services
Fbshsesse
[url=https://thesisacloud.com/]how to write thesis proposal[/url] thesis editing <a href="http://thesisacloud.com/ ">thesis express</a> thesis writing
GrvUript
[url=https://kloviagrli.com/]how to get viagra to work[/url] [url=https://vigedon.com/]natural viagra foods[/url] [url=https://llecialisjaw.com/]viagra vs cialis reddit[/url] [url=https://jwcialislrt.com/]buy cialis online in usa[/url] [url=https://jecialisbn.com/]generic cialis prices[/url]
Fbshsesse
[url=https://thesisacloud.com/]writing your thesis[/url] thesis data analysis <a href="http://thesisacloud.com/ ">help with writing thesis</a> umi thesis
Fbshsesse
[url=https://thesisacloud.com/]thesis writing online[/url] thesis abstracts <a href="http://thesisacloud.com/ ">writing thesis proposal</a> thesis literature review
Abgcsesse
[url=https://thesiswritingtob.com/]thesis paper writing[/url] writing a good thesis <a href="http://thesiswritingtob.com/ ">example thesis</a> help me write a thesis statement
Fbsfsesse
discount prescription drug [url=https://uspharmus.com/ ]canada drug[/url] Top Avana
LhdvExole
soft cialis canadian pharmacy https://asciled.com/ buy cialisonline
Bbdfhifs
generic viagra price [url=http://gensitecil.com/ ]viagra for sale ebay[/url] generic viagra usa
Jbsdsesse
Penegra [url=http://onlinecanda21.com/ ]п»їed meds online without doctor prescription[/url] walmart pharmacy price check
Abdgsesse
canadian prescription drugs [url=http://canadianeve21.com/ ]Malegra DXT[/url] drugs for sale
Lrbssesse
levitra online amazon http://uslevitraanna.com/ levitra before or after meal
GvdbUript
tadalafil 40 mg for sale [url=http://boxtadafil.com/ ]cialis tadalafil generic[/url] what is tadalafil liquid
LhdvExole
female cialis online http://asciled.com/ cialis generic dapoxetine
Fbsfsesse
Forxiga [url=http://uspharmus.com/ ]no prior prescription required pharmacy[/url] international pharmacy
RfvbExole
free shipping cialis usa https://cileve.com/ generic cialis]
Fmrfsesse
does cialis work http://cialisee.com/ howard stern commercial cialis
LbsoExole
cheap generic cialis in the us [url=https://ucialisdas.com/ ]cialis online american express[/url] cialis generic dapoxetine
Jebgsesse
mail order pharmacy india http://pharmacylo.com/ antibiotics
GtnbUript
lemonaid health viagra [url=https://jokviagra.com/ ]cialis vs viagra cost[/url] generic viagra over the counter
Anoosesse
buy viagra manchester uk https://llviagra.com/ en que casos tomar viagra
Lebnsesse
Aricept https://xlnpharmacy.com/ online pharmacy uk
Fmrfsesse
cialis no prescription uk [url=http://cialisee.com/ ]buy cialis from cananda[/url] supreme suppliers cialis
LbsoExole
cialis overnight online https://ucialisdas.com/ ver to bay cialis 20mg
Bbshhifs
how much does viagra cost without insurance [url=https://loxviagra.com/ ]better than viagra[/url] levitra vs viagra
RebfExole
cialis 5mg no perscription http://rcialisgl.com/ cialis black
Anoosesse
what is better viagra cialis https://llviagra.com/ viagra da 100 mg prezzo
GtnbUript
where to get viagra [url=https://jokviagra.com/ ]what is the cost of viagra[/url] viagra generic date
Jebgsesse
Sporanox [url=https://pharmacylo.com/ ]erectile dysfunction drug[/url] weight loss
Lebnsesse
weight loss [url=http://xlnpharmacy.com/ ]online pharmacy bc[/url] Prothiaden
LbsoExole
cialis 10 mg tablet [url=https://ucialisdas.com/ ]take cialis the correct way[/url] cheap cialis from australia
Fmrfsesse
cialis without a perscription [url=http://cialisee.com/ ]cialis cost nz[/url] generuc cialis
RebfExole
discount generic cialis [url=http://rcialisgl.com/ ]cialis without prescriptions[/url] cialis fastest shipping
Fmrfsesse
generic cialis online [url=http://cialisee.com/ ]overnight cialis online[/url] cialis on line purchase
Lebnsesse
online pharmacy no prescription needed http://xlnpharmacy.com/ best drugstore face moisturizer
LbsoExole
cialis no prescription paypal [url=https://ucialisdas.com/ ]generic cialis australia[/url] how to get cialis 800mg
RebfExole
cialis or viagra ? https://rcialisgl.com/ online cialis
sesseHtf
cheap cialis 20 mg [url=https://cialishav.com/ ]best online pharmacy cialis[/url] cialis canadian purchase
ExoleVed
generic cialis 40 mg [url=https://krocialis.com/ ]what to do when viagra and cialis dont work[/url] what happens when you mix cialis with grapefruit?
hifsSwa
best generic cialis [url=https://ckacialis.com/ ]cialis canada no prescription[/url] cialis dosage for women
Exoleloh
what happens if a woman takes cialis [url=https://rcialisgl.com/ ]taking cialis for the first time[/url] cialis reddit
sesseAni
online pharmacy in canada [url=https://pharmacyken.com/ ]canadapharmacy[/url] voltaren gel canadian pharmacy
sesseGtv
online pharmacy tech schools [url=https://pharmacyhrn.com/ ]canadian pharmacy viagra prices[/url] Himplasia
sesseDev
search canadian pharmacy [url=https://cjepharmacy.com/ ]canadian discount pharmacy[/url] online canadian pharmacy reviews
sesseHtf
best time of day to take cialis 5mg [url=https://cialishav.com/ ]cialis for sale online in canada[/url] cialis online kaufen
hifsSwa
cialis 20 mg tablets [url=https://ckacialis.com/ ]cialis with dapoxetine overnight delivery australia[/url] cialis extra
sesseAni
buy cialis online canada pharmacy [url=https://pharmacyken.com/ ]pharmacy rx one coupon code[/url] rx advantage pharmacy
sesseHtf
cialis offer [url=https://cialishav.com/ ]cialis generika[/url] back pain from cialis
sesseGtv
target store pharmacy [url=https://pharmacyhrn.com/ ]pharmacy technician training online free[/url] best value pharmacy