8. chmod chown umask lsattr chattr

2.14 更改文件或目录权限

chmod - change file mode bits

chmod [OPTION]... MODE[,MODE]... FILE...

-R, --recursive

change files and directories recursively

# ll test/ -d

drwxr-xr-x. 2 root root 28 12月 21 00:32 test/

# ll test/

总用量 0

-rw-r--r--. 1 root root 0 12月 21 00:28 123

-rw-r--r--. 1 root root 0 12月 21 00:32 456

# chmod -R 700 test/

# ll test/ -d

drwx------. 2 root root 28 12月 21 00:32 test/

# ll test/

总用量 0

-rwx------. 1 root root 0 12月 21 00:28 123

-rwx------. 1 root root 0 12月 21 00:32 456

-c, --changes

like verbose but report only when a change is made

# chmod -c 777 123

mode of "123" changed from 0644 (rw-r--r--) to 0777 (rwxrwxrwx)

# chmod -c 777 123

-v, --verbose

output a diagnostic for every file processed

# chmod -v 644 123

mode of "123" changed from 0777 (rwxrwxrwx) to 0644 (rw-r--r--)

# chmod -v 644 123

"123" 的权限模式保留为0644 (rw-r--r--)

永久更改SELinux配置（/etc/selinux/config），重启后生效。

2.15 更改所有者和所属组

chown - change file owner and group

chown [OPTION]... [OWNER][:[GROUP]] FILE...

-R, --recursive

operate on files and directories recursively

-v, --verbose

output a diagnostic for every file processed

# chown -Rv aming:user1 test/

changed ownership of "test/123" from root:root to aming:user1

changed ownership of "test/456" from root:root to aming:user1

changed ownership of "test/" from root:root to aming:user1

-c, --changes

like verbose but report only when a change is made

chgrp - change group ownership

chgrp [OPTION]... GROUP FILE...

-R, --recursive

operate on files and directories recursively

-v, --verbose

output a diagnostic for every file processed

# chgrp -Rv aming test/

changed group of "test/123" from user1 to aming

changed group of "test/456" from user1 to aming

changed group of "test/" from user1 to aming

-c, --changes

like verbose but report only when a change is made

2.16 umask

# help umask

umask: umask [-p] [-S] [模式]

显示或设定文件模式掩码。

设定用户文件创建掩码为 MODE 模式。如果省略了 MODE，则

打印当前掩码的值。

-S 以符号形式输出，否则以八进制数格式输出

# umask -S

u=rwx,g=rx,o=rx

$ umask -S

u=rwx,g=rwx,o=rx

/etc/bashrc

# By default, we want umask to get set. This sets it for non-login shell.

# Current threshold for system reserved uid/gids is 200

# You could check uidgid reservation validity in

# /usr/share/doc/setup-*/uidgid file

if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then

umask 002

else

umask 022

fi

2.17 隐藏权限lsattr chattr

lsattr - list file attributes on a Linux second extended file system

lsattr [ -RVadv ] [ files... ]

-R Recursively list attributes of directories and their contents.

-a List all files in directories, including files that start with `.'.

# lsattr -a

---------------- ./.

---------------- ./..

---------------- ./.bash_logout

-d List directories like other files, rather than listing their contents.

# lsattr /tmp/ -d

---------------- /tmp/

chattr - change file attributes on a Linux file system

chattr [ -RVf ] [ -v version ] [ mode ] files...

The format of a symbolic mode is +-=[aAcCdDeijsStTu].

-R Recursively change attributes of directories and their contents.

-V Be verbose with chattr's output and print the program version.

# chattr +i -V test/

chattr 1.42.9 (28-Dec-2013)

test/的标志被设为 ----i-----------

A file with the 'a' attribute set can only be open in append mode for writing.

When a file with the 'A' attribute set is accessed, its atime record is not modified.

A file with the 'c' attribute set is automatically compressed on the disk by the kernel.

A file with the 'd' attribute set is not candidate for backup when the dump is run.

When a directory with the 'D' attribute set is modified, the changes are written synchronously on the disk.

When a file with the 'S' attribute set is modified, the changes are written synchronously on the disk; this is equivalent to the 'sync' mount option applied to a subset of the files.

A file with the 'i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file.

When a file with the 's' attribute set is deleted, its blocks are zeroed and written back to the disk.

When a file with the 'S' attribute set is modified, the changes are written synchronously on the disk; this is equivalent to the 'sync' mount option applied to a subset of the files.

When a directory with the 'D' attribute set is modified, the changes are written synchronously on the disk.

When a file with the 's' attribute set is deleted, its blocks are zeroed and written back to the disk.

When a file with the 'u' attribute set is deleted, its contents are saved.

# chattr +i -V test/

chattr 1.42.9 (28-Dec-2013)

test/的标志被设为 ----i-----------

[root@aminglinux-01 ~]# touch test/123

[root@aminglinux-01 ~]# touch test/456

[root@aminglinux-01 ~]# touch test/789

touch: 无法创建"test/789": 权限不够