2

Hi I'm working in a Linux environment and I'm trying to write a command that will take a path as input and output a list of all users with read access to that file/directory.

For example, if file /a/b/c is owned by userid, u, and groupid, g, with some permissions, I want this command to identify the permissions of /a and /a/b and then calculate all the users who can read c. In particular, I'm having trouble when groups get involved.

I am trying to separate identifying read access based off group into cases:

1) g matches the gid of c's parent's gid, gp, (or grandparent, etc..), in which case, any member of g can read c if gp has permission: 040, or less restrictive.

2) g is different than c's parent's gid, gp. Two subcases:

...a) userid m is a member of g (for all m in g (m does not own c)) and owns c's parent, p. Then m can read c if p has permission: 400, or less restrictive.

...b) userid m is a member of g (for all m in c's gid (m does not own c)) and does not own c's parent, p. Then m can read c if p has permission: 004 or less restrictive.

3) u owns p, in which case p needs permissions 400 or less restrictive.

By the way, I have root access on this system. I imagine I'll have to make a series of cats to /etc/group and /etc/passwd and grep for relevant info, which is fine. Also, we can consider 'stat's free in this environment (it's part of a bigger project where we already have this info).

I guess what I'm looking for is an existing solution, pseudo code, or someone to help me brainstorm an algorithm and other considerations that I'm missing. Feel free to ask clarifying questions if necessary - I know this pseudo logic here isn't the easiest to read. Thanks guys.

4

2 回答 2

2

我认为您的最佳解决方案如下：

1.) 确定 c 的许可。

if(b does not have a minimum of world execute bit settings) i.e. 711
      return error; ( or owner && root)
      // you can easily extend this check to recursively work back to /
if (c has global read permissions) 
       return everyone;
else if (c has group read permissions)
       determine group name && return all members of said group
else (return owner && root)

2.) 可以使用 getent 确定所述组的成员。例如： getent group - 返回系统上的所有组 getent passwd - 返回所有用户 3.) 权限可以用“stat c”或类似的东西来确定。

于 2012-06-04T17:48:59.890 回答
1

cating有缺陷；改为使用getent。不要忘记检查 ACL。

于 2012-06-01T21:26:53.173 回答