|
58 | 58 | \pdfbookmark[1]{file access rights}{fsaccessrights} |
59 | 59 |
|
60 | 60 | \begin{slide} |
61 | | -\sltitle{Pøístupová práva} |
| 61 | +\sltitle{Access rights} |
62 | 62 | \begin{center} |
63 | 63 | \input{img/tex/prava.tex} |
64 | 64 | \end{center} |
65 | 65 | \begin{itemize} |
66 | | -\item \emsl{SGID} pro soubor bez práva spu¹tìní pro skupinu v System |
67 | | -V: kontrola zámkù pøi ka¾dém pøístupu (\emsl{mandatory locking}) |
68 | | -\item \emsl{sticky bit} pro adresáøe: právo mazat a pøejmenovávat |
69 | | -soubory mají jen vlastníci souborù |
70 | | -\item \emsl{SGID} pro adresáø: nové soubory budou mít stejnou |
71 | | -skupinu jako adresáø (System V; u BSD systémù to funguje jinak, viz |
72 | | -poznámky) |
| 66 | +\item \emsl{SGID} on a file without the executable bit for its group means |
| 67 | +\emsl{mandatory locking} in systems based on System~V |
| 68 | +\item \emsl{sticky bit} for directories: remove and renamed allowed for file |
| 69 | +owners only. |
| 70 | +\item \emsl{SGID} for directory: new files will have the same group as the |
| 71 | +directory (on System~V based systems; it works in a different way on BSD |
| 72 | +systems, see below) |
73 | 73 | \end{itemize} |
74 | 74 | \end{slide} |
75 | 75 |
|
76 | 76 | \begin{itemize} |
77 | | -\item SGID pro adresáøe u BSD systémù zpùsobí, ¾e soubory a podadresáøe |
78 | | -vytvoøené v tomto adresáøi budou mít stejného majitele jako je majitel daného |
79 | | -adresáøe. Nutným pøedpokladem je dále to, ¾e daný UFS filesystém musí být |
80 | | -namontován s suiddir pøíznakem a v jádru je option SUIDDIR (a to není |
81 | | -default). Navíc to nefunguje pro roota. Tato mo¾nost existuje kvùli Sambì a |
82 | | -Nettalku. |
83 | | -\item sticky bit pro adresáøe: pøejmenovat nebo smazat soubor mù¾e jen jeho |
84 | | -vlastník (v~nìkterých implementacích staèí i právo zápisu do souboru), |
85 | | -ne\-sta\-èí právo zápisu do adresáøe. Toto nastavení se pou¾ívá pro veøejné |
86 | | -adresáøe (napø. \texttt{/tmp}). |
87 | | -\item pùvodnì mìl sticky bit význam i pro spustitelné soubory: program s |
88 | | -nastaveným sticky bitem zùstal po ukonèení v pamìti a jeho opìtovné spu¹tìní |
89 | | -bylo rychlej¹í. Dnes se sticky bit v tomto významu u¾ nepou¾ívá. |
90 | | -\item nìkteré filesystémy (XFS, AFS, UFS2, ZFS) mají tzv. access control lists |
91 | | -(ACLs), které dovolují jemnìj¹í pøidìlování práv jednotlivým u¾ivatelùm a |
92 | | -skupinám. |
| 77 | +\item The sticky bit for directories means that when the directory is writable |
| 78 | +for a given user (possibly because all users can write), the user can create any |
| 79 | +file that does not exist in that directory yet. However, if the file exists but |
| 80 | +is not owned by the user, he/she can not remove nor rename it even that by |
| 81 | +itself he/she can write the directory. Sticky bit is denoted by ``t'' and is |
| 82 | +typically used for temporary directories: |
| 83 | + |
| 84 | +\begin{verbatim} |
| 85 | +$ ls -ld /tmp |
| 86 | +drwxrwxrwt 9 root root 356352 Jan 27 22:37 /tmp/ |
| 87 | +\end{verbatim} |
| 88 | + |
| 89 | +\item The SGID bit on directories on BSD based systems means that files and |
| 90 | +directories created in this directory will have the same owner as the directory |
| 91 | +itself. The filesystem must be mounted with an \texttt{suiddir} flag and |
| 92 | +the kernel may need an additional non-default option \texttt{SUIDDIR}. It also |
| 93 | +does not work for the root user. This functionality is there to support Samba. |
| 94 | +\item Originally, the sticky bit had a meaning for regular files as well but |
| 95 | +that is not used anymore. |
| 96 | +\item Some filesystems (XFS, AFS, UFS2, ZFS, and others) also support |
| 97 | +\emph{access control lists} (ACLs) that allow for finer access right management. |
93 | 98 | \end{itemize} |
94 | 99 | %%%%% |
95 | 100 |
|
|
118 | 123 | \end{slide} |
119 | 124 |
|
120 | 125 | \begin{itemize} |
121 | | -\item tyto funkce fungují nezávisle na tom jak z jaké databáze byly |
122 | | -získány informace o daném u¾ivateli. |
123 | | -\item v¹echny tyto funkce jsou souèástí POSIX 1003.1-2008 (sekce XSH) |
124 | | -\item \funnm{setpwent} je tøeba zavolat pøed prvním voláním \funnm{getpwent} |
125 | | -\item analogicky exitují funkce \funnm{getgrnam} a \funnm{getgrent} které |
126 | | -získávají informace o skupinách. |
127 | | -\item pro prohledávání a výpis databazí lze pou¾ít program |
128 | | -\texttt{getent}. Napø. k nalezení záznamu u¾ivatele a skupiny |
129 | | -\texttt{root}: |
| 126 | +\item These functions work independently on what database was used to get the |
| 127 | +user information, see page \pageref{name_service_switch} for more information on |
| 128 | +naming databases. |
| 129 | +\item All these functions are part of POSIX 1003.1-2008. |
| 130 | +\item \funnm{setpwent}() is needed to call before first calling |
| 131 | +\funnm{getpwent}(). |
| 132 | +\item There are also functions \funnm{getgrnam}() and \funnm{getgrent}() which |
| 133 | +can be used to get group information. |
| 134 | +\item To search and list naming databases, you can use program \texttt{getent}. |
| 135 | +For example: |
130 | 136 |
|
131 | 137 | \begin{verbatim} |
132 | 138 | $ getent passwd root |
|
155 | 161 | \end{itemize} |
156 | 162 | \end{slide} |
157 | 163 |
|
| 164 | +\label{name_service_switch} |
| 165 | + |
158 | 166 | \begin{itemize} |
159 | 167 | \item Systems using the name service switch typically have |
160 | 168 | \texttt{nsswitch.conf(4)} where you can find information about what databases |
|
0 commit comments