- File Permissions
- Setting the Permissions on and Ownership of Files
- Deleting Unowned Files
- Removing a Symbolic Link to /dev/null
- Setting the umask Value for a Daemon
- Adding a Sticky Bit Attribute to Globally Writable Directories
- Disabling the Globally Writable Permission on Unauthorized Files
- Restricting Permissions on the at Command
- Restricting Permissions on the cron Command
- Restricting Permissions on the sudo Command
Setting the Permissions on and Ownership of Files
In Linux, all objects are processed as files. Even a directory will be processed as a large file containing many files. Therefore, the most important thing in Linux is the security of files and directories. Their security is ensured by permissions and owners.
By default, the permissions and ownership of common directories, executable files, and configuration files in the system are set in openEuler.
The following uses the /bin directory as an example to describe how to change the permission and ownership of a file:
Modify the file permission. For example, set the permission on the /bin directory to 755.
chmod 755 /bin
Change the ownership of the file. For example, set the ownership and group of the /bin directory to root:root.
chown root:root /bin
Deleting Unowned Files
When deleting a user or group, the system administrator may forget to delete the files of the user or group. If the name of a new user or group is the same as that of the deleted user or group, the new user or group will own files on which it has no permission. You are advised to delete these files.
Delete the file whose user ID does not exist.
Search for the file whose user ID does not exist.
find / -nouser
Delete the found file. In the preceding command, filename indicates the name of the file whose user ID does not exist.
rm -f filename
Delete the file whose group ID does not exist.
Search for the file whose group ID does not exist.
find / -nogroup
Delete the found file. In the preceding command, filename indicates the name of the file whose group ID does not exist.
rm -f filename
Removing a Symbolic Link to /dev/null
A symbolic link to /dev/null may be used by malicious users. This affects system security. You are advised to delete these symbolic links to improve system security.
After openEuler is installed, symbolic links to /dev/null may exist. These links may have corresponding functions. (Some of them are preconfigured and may be depended by other components.) Rectify the fault based on the site requirements. For details, see Implementation.
For example, openEuler supports UEFI and legacy BIOS installation modes. The GRUB packages supported in the two boot scenarios are installed by default. If you select the legacy BIOS installation mode, a symbolic link /etc/grub2-efi.cfg is generated. If you select the UEFI installation mode, a symbolic link /etc/grub2.cfg is generated. You need to process these symbolic links based on the site requirements.
Run the following command to search for symbolic links to /dev/null:
find dirname -type l -follow 2>/dev/null
dir__name indicates the directory to be searched. Normally, key system directories, such as /bin, /boot, /usr, /lib64, /lib, and /var, need to be searched.
If these symbolic links are useless, run the following command to delete them:
rm -f filename
filename indicates the file name obtained in Step 1.
Setting the umask Value for a Daemon
The umask value is used to set default permission on files and directories. If the umask value is not specified, the file has the globally writable permission. This brings risks. A daemon provides a service for the system to receive user requests or network customer requests. To improve the security of files and directories created by the daemon, you are advised to set umask to 0027. The umask value indicates the complement of a permission. For details about how to convert the umask value to a permission, see umask Values.
By default, the umask value of the daemon is set to 0022 in openEuler.
In configuration file /etc/sysconfig/init, add umask 0027 as a new row.
Adding a Sticky Bit Attribute to Globally Writable Directories
Any user can delete or modify a file or directory in a globally writable directory, which leads to unauthorized file or directory deletion. Therefore, the sticky bit attribute is required for globally writable directories.
Search for globally writable directories.
find / -type d -perm -0002 ! -perm -1000 -ls | grep -v proc
Add the sticky bit attribute to globally writable directories. dirname indicates the name of the directory that is found.
chmod +t dirname
Disabling the Globally Writable Permission on Unauthorized Files
Any user can modify globally writable files, which affects system integrity.
Search for all globally writable files.
find / -type d ( -perm -o+w ) | grep -v proc find / -type f ( -perm -o+w ) | grep -v proc
View the settings of files (excluding files and directories with sticky bits) listed in step 1, and delete the files or disable the globally writable permission on them. Run the following command to remove the permission. In the command, filename indicates the file name.
chmod o-w filename
You can run the following command to check whether the sticky bit is set for the file or directory. If the command output contains the T flag, the file or directory is with a sticky bit. In the command, filename indicates the name of the file or directory to be queried.
ls -l filename
Restricting Permissions on the at Command
The at command is used to create a scheduled task. Users who can run the at command must be specified to protect the system from being attacked.
Delete the /etc/at.deny file.
rm -f /etc/at.deny
Create the /etc/at.allow file.
Run the following command to change the ownership of the /etc/at.allow file to root:root.
chown root:root /etc/at.allow
Set that only user root can operate file /etc/at.allow.
chmod og-rwx /etc/at.allow
Restricting Permissions on the cron Command
The cron command is used to create a routine task. Users who can run the cron command must be specified to protect the system from being attacked.
Delete the /etc/cron.deny file.
rm -f /etc/at.deny
Create the /etc/cron.allow file.
Run the following command to change the ownership of the /etc/cron.allow file to root:root:
chown root:root /etc/cron.allow
Set that only user root can operate file /etc/cron.allow.
chmod og-rwx /etc/cron.allow
Restricting Permissions on the sudo Command
A common user can use the sudo command to run commands as the user root. To harden system security, it is necessary to restrict permissions on the sudo command. Only user root can use the sudo command. By default, openEuler does not retrict the permission of non-root users to run the sudo command.
Modify the /etc/sudoers file to restrict permissions on the sudo command. Comment out the following configuration line:
#%wheel ALL=(ALL) ALL