Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Руководство по установке

Страница: 300 / 982

would not be able to change
passwd
, because it would be too dangerous to grant all
users direct access to this file. A possible solution to this problem is the setuid mecha-
nism. setuid (set user ID) is a special file attribute that instructs the system to execute
programs marked accordingly under a specific user ID. Consider the
passwd
command:
-rwsr-xr-x 1 root shadow 80036 2004-10-02 11:08 /usr/bin/passwd
You can see the
s
that denotes that the setuid bit is set for the user permission. By
means of the setuid bit, all users starting the
passwd
command execute it as
root
.
14.1.2 The setgid Bit
The setuid bit applies to users. However, there is also an equivalent property for groups:
the setgid bit. A program for which this bit was set runs under the group ID under which
it was saved, no matter which user starts it. Therefore, in a directory with the setgid bit,
all newly created files and subdirectories are assigned to the group to which the direc-
tory belongs. Consider the following example directory:
drwxrws--- 2 tux archive 48 Nov 19 17:12 backup
You can see the
s
that denotes that the setgid bit is set for the group permission. The
owner of the directory and members of the group
archive
may access this directory.
Users that are not members of this group are “mapped” to the respective group. The
effective group ID of all written files will be
archive
. For example, a backup program
that runs with the group ID
archive
is able to access this directory even without root
privileges.
14.1.3 The Sticky Bit
There is also the sticky bit. It makes a difference whether it belongs to an executable
program or a directory. If it belongs to a program, a file marked in this way is loaded
to RAM to avoid needing to get it from the hard disk each time it is used. This attribute
is used rarely, because modern hard disks are fast enough. If this bit is assigned to a
directory, it prevents users from deleting each other's files. Typical examples include
the
/tmp
and
/var/tmp
directories:
drwxrwxrwt 2 root root 1160 2002-11-19 17:15 /tmp
282 Installation and Administration