File Permissions ​

• File Permissions
  • Setting the Permissions on and Ownership of Files
  • Deleting Unowned Files
  • Removing a Symbolic Link to /dev/null
  • Setting the umask Value for a Daemon
  • Adding a Sticky Bit Attribute to Globally Writable Directories
  • Disabling the Globally Writable Permission on Unauthorized Files
  • Restricting Permissions on the at Command
  • Restricting Permissions on the cron Command
  • Restricting Permissions on the sudo Command

Setting the Permissions on and Ownership of Files ​

Description ​

In Linux, all objects are processed as files. Even a directory will be processed as a large file containing many files. Therefore, the most important thing in Linux is the security of files and directories. Their security is ensured by permissions and owners.

By default, the permissions and ownership of common directories, executable files, and configuration files in the system are set in openEuler.

Implementation ​

The following uses the /bin directory as an example to describe how to change the permission and ownership of a file:

• Modify the file permission. For example, set the permission on the /bin directory to 755.

  shell

  chmod 755 /bin

• Change the ownership of the file. For example, set the ownership and group of the /bin directory to root:root.

  shell

  chown root:root /bin

Deleting Unowned Files ​

Description ​

When deleting a user or group, the system administrator may forget to delete the files of the user or group. If the name of a new user or group is the same as that of the deleted user or group, the new user or group will own files on which it has no permission. You are advised to delete these files.

Implementation ​

Delete the file whose user ID does not exist.

1. Search for the file whose user ID does not exist.

   shell

   find / -nouser

2. Delete the found file. In the preceding command, filename indicates the name of the file whose user ID does not exist.

   shell

   rm -f filename

Delete the file whose group ID does not exist.

1. Search for the file whose user ID does not exist.

   shell

   find / -nogroup

2. Delete the found file. In the preceding command, filename indicates the name of the file whose group ID does not exist.

   shell

   rm -f filename

Removing a Symbolic Link to /dev/null ​

Description ​

A symbolic link to /dev/null may be used by malicious users. This affects system security. You are advised to delete these symbolic links to improve system security.

Special Scenario ​

After openEuler is installed, symbolic links to /dev/null may exist. These links may have corresponding functions. (Some of them are preconfigured and may be depended by other components.) Rectify the fault based on the site requirements. For details, see Implementation.

For example, openEuler supports UEFI and legacy BIOS installation modes. The GRUB packages supported in the two boot scenarios are installed by default. If you select the legacy BIOS installation mode, a symbolic link /etc/grub2-efi.cfg is generated. If you select the UEFI installation mode, a symbolic link /etc/grub2.cfg is generated. You need to process these symbolic links based on the site requirements.

Implementation ​

1. Run the following command to search for symbolic links to /dev/null:

   shell

   find dirname -type l -follow 2>/dev/null

   NOTE

   dir__name indicates the directory to be searched. Normally, key system directories, such as /bin, /boot, /usr, /lib64, /lib, and /var, need to be searched.

2. If these symbolic links are useless, run the following command to delete them:

   shell

   rm -f filename

   NOTE

   filename indicates the file name obtained in Step 1.

Setting the umask Value for a Daemon ​

Description ​

The umask value is used to set default permission on files and directories. If the umask value is not specified, the file has the globally writable permission. This brings risks. A daemon provides a service for the system to receive user requests or network customer requests. To improve the security of files and directories created by the daemon, you are advised to set umask to 0027. The umask value indicates the complement of a permission. For details about how to convert the umask value to a permission, see umask Values.

Implementation ​

In configuration file /etc/sysconfig/init, add umask 0027 as a new row.

Adding a Sticky Bit Attribute to Globally Writable Directories ​

Description ​

Any user can delete or modify a file or directory in a globally writable directory, which leads to unauthorized file or directory deletion. Therefore, the sticky bit attribute is required for globally writable directories.

Implementation ​

1. Search for globally writable directories.

   shell

   find / -type d -perm -0002 ! -perm -1000 -ls | grep -v proc

2. Add the sticky bit attribute to globally writable directories. dirname indicates the name of the directory that is found.

   shell

   chmod +t dirname

Disabling the Globally Writable Permission on Unauthorized Files ​

Description ​

Any user can modify globally writable files, which affects system integrity.

Implementation ​

1. Search for all globally writable files.

   shell

   find / -type d ( -perm -o+w ) | grep -v proc
   find / -type f ( -perm -o+w ) | grep -v proc

2. View the settings of files (excluding files and directories with sticky bits) listed in step 1, and delete the files or disable the globally writable permission on them. Run the following command to remove the permission. In the command, filename indicates the file name.

   shell

   chmod o-w  filename

   NOTE

   You can run the following command to check whether the sticky bit is set for the file or directory. If the command output contains the T flag, the file or directory is with a sticky bit. In the command, filename indicates the name of the file or directory to be queried.

   shell

   ls -l filename

Restricting Permissions on the at Command ​

Description ​

The at command is used to create a scheduled task. Users who can run the at command must be specified to protect the system from being attacked.

Implementation ​

1. Delete the /etc/at.deny file.

   shell

   rm -f /etc/at.deny

2. Run the following commands to create the /etc/at.allow file and change its ownership to root:root.

   shell

   touch /etc/at.allow
   chown root:root /etc/at.allow

3. Set that only user root can operate file /etc/at.allow.

   shell

   chmod og-rwx /etc/at.allow

Restricting Permissions on the cron Command ​

Description ​

The cron command is used to create a routine task. Users who can run the cron command must be specified to protect the system from being attacked.

Implementation ​

1. Delete the /etc/cron.deny file.

   shell

   rm -f /etc/at.deny

2. Run the following commands to create the /etc/cron.allow file and change its ownership to root:root:

   shell

   touch /etc/cron.allow
   chown root:root /etc/cron.allow

3. Set that only user root can operate file /etc/cron.allow.

   shell

   chmod og-rwx /etc/cron.allow

Restricting Permissions on the sudo Command ​

Description ​

A common user can use the sudo command to run commands as the user root. To harden system security, it is necessary to restrict permissions on the sudo command. Only user root can use the sudo command. By default, openEuler does not restrict the permission of non-root users to run the sudo command.

Implementation ​

Modify the /etc/sudoers file to restrict permissions on the sudo command. Comment out the following configuration line:

#%wheel ALL=(ALL)       ALL