What is special permission in Unix -- An interesting topic for all Unix admin / DBAs

Yesterday , I had faced a strange issue while starting up oracle instance after applying PSU4 into our 12.1.0.2 database . Even when my ASM was up and running , I couldn't    able to start my database instances . Alerts log clearly showing ASM is not available .its quite strange to me so I started googling .After an hours of googling  I found the solution .The file permission of $ORACLE_HOME/bin/oracle got changed som how  while applying the PSU , So I have executed following and I am able to start my database instances .

#chown oracle:asmadmin $ORACLE_HOME/bin/oracle 

#chmod 6751 $ORACLE_HOME/bin/oracle 

  

We are familiar with setting file permission with 3 digit combination like  777,755 etc .

Now the question is,what is the purpose of this extra digit 6 here ?  and the answer is, its the combination of unix special file permission suid and sgid. 

So this time  instead of talking about Oracle specific topic , I would like to discuss more about Special permission in Unix based operating system. So for all DBAs who all are working in Unix based OS ,this will be an added advantage for them , if they have good idea about special permission in Unix. 

There are three type of special permission bits that may be setup on executable files or directories if required.

These permission bits are,

1.setuid (set user identification bit )

2.setgid (set group identification bit)

3.sticky bit

1)The suid (set user id bit)

Setting the suid bit on a file allows normal users to run that application with raised (usually superuser) priviledges. Remember that when a user launches an application, that application runs with the same permissions as that user. This is one of the fundamental differences between Windows and *nix systems.

An example of a file that has the suid bit set in most cases is the /usr/bin/passwd application. You can see that the /usr/bin/passwd application has the suid bit set by the letter s in place of the user’s eXecutable bit.

-rwsr-xr-x 1 root root 26680 May 10 13:44 passwd

For listing the setuid bit enabled files you can use the common ls command with long list parameter as follows

[root@node2 ~]# ls -lrt /bin/su

-rwsr-xr-x 1 root root 24060 Nov 27 2006 /bin/su

You can see that the owner-executable bit is set to 's', that means the executable file is setuid enabled

The passwd application allows users to change their own passwords. In order to do so, it has to write to the etc/passwd file which contains all of the accounts on a GNU/Linux system. However, if the suid bit was not set on the passwd application then the passwd application would only have the rights of the user and therefore could not make changes to the etc/passwd file. Setting the suid bit on the passwd application allows it to run as the superuser and it can therefore write the new password to the etc/passwd file.

How to set the suid bit?

Use the number 4 in front of a normal chmod string:

#chmod 4755 /home/mahi/mahi.sh

Alternatively you can use symbolic notation to get the exact result

#chmod u+s /home/mahi/mahi.sh

To unset the setuid bit use

# chmod u-s /home/mahi/mahi.sh
or
#chmod 0755 /home/mahi/mahi.sh

To search for all files in the system that have setuid bit set on them , use find command

# find / -type f -perm -04000 -exec ls -lrt {} \;

setuid on directories

Setting uid on a directory is easy to understand as it is simply ignored by Linux. i.e you can set it but it is given no special meaning when set on a directory. On Linux The setuid bit on a directory is only effective when it is on the group bit.

2)Setgid bit (set group id bit )

we can set setgid bit on both file and directory.

2.1 setgid on a file

The setgid bit is set on executable files at  the group level. When this bit is enabled , the file will be executed by the other users  with exact same privileges  that the group member have on it. SGID modes on a file don't occur nearly as frequently as SUID.

For example the linux write and wall command is owned by root with group membership set to tty. These command has setgid bit enabled on it.See the highlighted “s” in the group permission class below

[root@node2 ~]# ls -lrt /usr/bin/wall

-r-xr-sr-x 1 root tty 10420 Oct 13  2006 /usr/bin/wall

The write and wall commands are used to send messages to other users' terminals (ttys) or to any psuedo terminal (pts/n). The write command writes a message to a single user, while wall writes to all connected users. For eg;

[root@node2 ~]# wall

Hi

h r u?

^d

Then it will send message to all connected users. Sending text to another user's terminal or graphical display is normally not allowed. In order to bypass this problem, a group has been created, which owns all terminal devices. When the write and wall commands are granted SGID permissions, the commands will run using the access rights as applicable to this group, tty in the example. Since this group has write access to the destination terminal, also a user having no permissions to use that terminal in any way can send messages to it.

From the following output you can see that  each terminal device (tty1 ,pts/0,pts/1 etc) is owned by the group tty . So when a normal user run the ‘wall’ or ‘write’ command it will run with the access rights of the group tty .From the output we can see that ‘tty’  group have  the write permission  on each  destination terminal. So we will get the output on each terminal

[root@node2 ~]# ls -lrt /dev/tty1

crw--w---- 1 root tty 4, 1 Jan 21 23:29 /dev/tty1

[root@node2 ~]# ls -lrt /dev/pts

crw--w---- 1 root tty 136, 0 Jan 21 23:19 0

crw--w---- 1 root tty 136, 1 Jan 21 23:29 1

You can also send message to any destination terminal by using ‘echo’ if you have enough permission, for eg

[root@node2 ~]# echo Hi dear > /dev/pts/1

Then it will display the message “Hi dear “ on the pseudo terminal  dev/pts/1 , now try to execute

The same command as a normal user 

[mahi@node2 ~]$ echo Hi dear > /dev/pts/1

-bash: /dev/pts/1: Permission denied

Ie local user have no write permission to the destination terminal , here the ‘setuid’ bit comes into play .

How to set setgid bit on files and directory

To set setgid bit you must be either be the owner of the file or root , you can use chmod command to set setgid on files and directories

#chmod 2755 /home/mahi/free.sh

Alternatively you can use symbolic notation to get the exact result

#chmod  g+s  /home/mahi/free.sh

To unset the setgid bit

# chmod  g-s  /home/mahi/free.sh
or
#chmod 0755 /home/mahi/free.sh

To search for all files and directories in the system having setgid bit enabled

# find / -type f -perm -02000 -exec ls -lrt {} \;   (for  directories use ‘d’ instead of ‘f’ )

2.2 Setgid bit on directories

We can use the command chmod to set the group ID bit for a directory.
#chmod g+s /mydir

or with numeric mode:
#chmod 2775 /mydir

After the change, the permission of the directory "/mydir" becomes "drwxrwsr-x".

drwxrwsr-x 3 ora ora 4096 2010-03-18 19:57 /mydir
But what is so special about setting the group ID for a directory? The trick is that when another user creates a file or directory under such a directory "/mydir", the new file or directory will have its group set as the group of the owner of "/mydir", instead of the group of the user who creates it.

For example, if mahi belongs to the groups "mahi" (main group) and "ora", and he creates a file "setgid.txt" under the diretory "/mydir", "setgid.txt" will be owned by the group of "ora" instead of  mahi's main group ID "mahi".

   -rw-r--r-- 1 mahi ora   10 2010-03-18 20:01 setgid.txt

Even if ‘mahi’ does not belong to the group "ora", the files or directories he creates under "/mydir" (if "/mydir" grants the write permission to "others") will also get owned by group "ora".

You can use such feature to share files within the group. Create a directory which permits the group to write, and set the group ID bit. Every files or directories created under it will have the same group ownership. Therefore, the whole group can share them.

One commnad for finding all the files with setuid or setgid bit

#find / -perm  +6000 -type f -exec ls -lrt {} \;

3)sticky bit 

The sticky bit is normally set on public writable directories to protect files and sub-directories  of individual users from being  deleted  by other users. This bit is typically set on /tmp and /var/tmp directories. Thus If the sticky bit is set for a directory, only the owner of that directory or the owner of a file can delete or rename a file within that directory.

Normally all users are allowed to create and delete files and sub-directories in these directories.

With default permission, any user can remove any others files and sub-directories.

Sticky bit shows up as a t in the execute position of the other permission , foe eg

[root@server ~]# ls -ld /var/tmp/ /tmp

drwxrwxrwt 32 root root 4096 Mar 15 13:35 /tmp

drwxrwxrwt  2 root root 4096 Feb 20 10:35 /var/tmp/

How to set sticky bit permission

When digit 1 is used with chmod command it sets the sticky bit on the directory

#chmod  1777 test

Alternatively you can use symbolic notation to set the same

#chmod o+t  test

There is no need to specify  ‘o’ along with chmod command you can simply do it with

#chmod  +t  test 

How to unset sticky bit permission

 #chmod  -t  test

Or

#chmod 0777 test

Note:

You may see both a ‘t’ and ‘T’ to indicate that the sticky bit is set. You can see a ‘t’  if the world already have a execute permission before you set the sticky bit , and a ‘T’ if the world  didn’t have execute set before the sticky bit was put in place. For eg:

#mkdir  testdir

#chmod 754 testdir

#chmod  o+t  testdir

# ls -ld testdir

drwxr-xr-T 2 root root 4096 Mar 15 14:23 testdir

To list all directories having sticky bit enabled

#find / -perm  -1000 -type d

Note:

Linux ignores the sticky bit when it sets on files. It is possible to set combination of suid , sgid and the sticky bit at the same time . 

0	Remove sticky bit,suid &sgid
1	Sets sticky bit
2	Sets sgid bit
3	Sets sticky bit and sgid bit
4	Sets suid bit
5	Sets sticky bit and suid
6	Sets suid and sgid bit
7	Sets  sticky bit, suid &sgid bit

Be sure to note that using a 0 removes suid , sgid and sticky bit all at the same time . if you use 0 to remove suid but you still want the sticky bit set you need to go back and reset the sticky bit.

Shell Script:- How to colorful your shell script in linux

Shell scripts commonly used ANSI escape codes for color output. Following table shows Numbers representing colors in Escape Sequences.

Attribute codes:
00=none 01=set to bold intensity 02=set to faint intensity 03=use italic font 04=underscore 05=slow blink 06=fast blink 07=reverse foreground/background colors 08=Set foreground color to background color
Text color codes:
30=black 31=red 32=green 33=yellow 34=blue 35=magenta 36=cyan 37=white
Background color codes:
40=black 41=red 42=green 43=yellow 44=blue 45=magenta 46=cyan 47=white
Numbers Representing Colors in Escape Sequences

Color	Foreground	Background
Black	30	40
Red	31	41
Green	32	42
Yellow	33	43
Blue	34	44
Magenta	35	45
Cyan	36	46
White	37	47

The numbers in the above table work for xterm terminal.Result may vary for other terminal emulators.
Use the following template for writing colored text.
$ echo -e "\033[COLORm Sample text"
The "\033[" begins the escape sequence.You can also use "\e[" instead of "\033[". COLOR specifies a foreground color, according to the table above.The "m" terminates escape sequence, and text begins immediately after that.
eg:
$ echo -e "\033[1mThis is bold text.\033[0m"
The “\033[“ represents an escape( also you can use “\E[“ or “\e[“ ), the "1" turns on the bold attribute, 
while the "0" switches it off. The "m" terminates each term of the escape sequence.

Note:
Always use \033[0m at the end of the line to turn off the colour attribute at the end of the line. With an echo, the -e option enables the escape sequences.

Use the following template for writing colored text on a colored background.
$ echo -e "\E[COLOR1;COLOR2mSome text goes here."
The "\E[" begins the escape sequence. The semicolon-separated numbers "COLOR1" and "COLOR2" specify a foreground and a background color, according to the table below. (The order of the numbers does not matter, since the foreground and background numbers fall in non-overlapping ranges.) The "m" terminates the escape sequence, and the text begins immediately after that. Note also that single quotes enclose the remainder of the command sequence following the echo -e.

Note:
With an echo, the -e option enables the escape sequences.You can also use printf instead of echo.
printf "\e[COLORm sample text\n"

To print Green text
echo -e "\033[32m Hello World"

or
printf "\e[32m Hello World"

The problem with above statement is that the blue color that starts with the 32 color code is never switched back to the regular color, so any text you type after the prompt and even prompt also is still in the Green color.To return to the plain, normal mode, we have yet another sequence. The "\033[0m" ( so you have to add these entry whenever you required)

Note: Blink attribute doesn't work in any terminal emulator, but it will work on the console.
Combining all these Escape Sequences, you can get more fancy effect.

Use the following template for writing colored text on a colored background.
echo -e "\033[COLOR1;COLOR2m sample text\033[0m";

The semicolon separated numbers "COLOR1" and "COLOR2" specify a foreground and a background color. The order of the numbers does not matter, since the foreground and background numbers fall in non
- overlapping ranges."m" terminates the escape sequence, and the text begins immediately after that.
Although setting the colors separately also work (i.e. \033[44m\033[32m).

There are some differences between colors when combining colors with bold text attribute.
The following table summarises these differences.

Bold OFF	Color	Bold On	Color
0;30	Balck	1;30	Dark Gray
0;31	Red	1;31	Dark Red
0;32	Green	1;32	Dark Green
0;33	Brown	1;33	Yellow
0;34	Blue	1;34	Dark Blue
0;35	Magenta	1;35	Dark Magenta
0;36	Cyan	1;30	Dark Cyan
0;37	Light Gray	1;30	White

The following shell script prints all the colors and codes on the screen.
#!/bin/bash
# This script echoes colors and codes
echo -e "\n\033[4;31mLight Colors\033[0m \t\t\t \033[1;4;31mDark Colors\033[0m"
echo -e " \e[0;30;47m Black \e[0m 0;30m \t\t \e[1;30;40m Dark Gray \e[0m 1;30m"
echo -e " \e[0;31;47m Red \e[0m 0;31m \t\t \e[1;31;40m Dark Red \e[0m 1;31m"
echo -e " \e[0;32;47m Green \e[0m 0;32m \t\t \e[1;32;40m Dark Green \e[0m 1;32m"
echo -e " \e[0;33;47m Brown \e[0m 0;33m \t\t \e[1;33;40m Yellow \e[0m 1;33m"
echo -e " \e[0;34;47m Blue \e[0m 0;34m \t\t \e[1;34;40m Dark Blue \e[0m 1;34m"
echo -e " \e[0;35;47m Magenta \e[0m 0;35m \t\t \e[1;35;40m Dark Magenta\e[0m 1;35m"
echo -e " \e[0;36;47m Cyan \e[0m 0;36m \t\t \e[1;36;40m Dark Cyan \e[0m 1;36m"
echo -e " \e[0;37;47m Light Gray\e[0m 0;37m \t\t \e[1;37;40m White \e[0m 1;37m"

----------------------------------------end of script---------------------------------------------

Run the following shellscript on a console and also in a terminal and see the difference.
#!/bin/bash
clear
echo -e " \033[30m* 30 black forground *\033[0m"
echo -e " \033[31m* 31 red forground *\033[0m"
echo -e " \033[32m* 32 green forground *\033[0m"
echo -e " \033[33m* 33 yellow forground *\033[0m"
echo -e " \033[34m* 34 blue forground *\033[0m"
echo -e " \033[35m* 35 magenta forground *\033[0m"
echo -e " \033[36m* 36 cyan forground *\033[0m"
echo -e " \033[37m* 37 white forground *\033[0m"

echo -e "\033[33;40m 33;40 yellow text on black background\033[0m"
echo -e "\033[33;41m 33;41 yellow text on red background\033[0m"
echo -e "\033[33;42m 33;42 yellow text on green background\033[0m"
echo -e "\033[33;44m 33;44 yellow text on blue background\033[0m"
echo “ Note that 33 will display as brown in console and as yello in terminal”
echo -e "\033[33;45m 33;45 yellow text on magenta background\033[0m"
echo -e "\033[33;46m 33;46 yellow text on cyan background\033[0m"
echo -e "\033[33;47m 33;47 yellow text on white background\033[0m"

echo -e " \033[35;5m * 35 magenta text with slow blink*\033[0m"
echo -e "\033[1;4;33;44m 1;4;33;44 Bold yellow underlined text on blue background\033[0m"

Thus we can conclude
Colors:
\033[30m set foreground color to black
\033[31m set foreground color to red
\033[32m set foreground color to green
\033[33m set foreground color to yellow
\033[34m set foreground color to blue
\033[35m set foreground color to magenta (purple)
\033[36m set foreground color to cyan
\033[37m set foreground color to white
\033[40m set background color to black

\033[41m set background color to red
\033[42m set background color to green
\033[43m set background color to yellow
\033[44m set background color to blue
\033[45m set background color to magenta (purple)
\033[46m set background color to cyan
\033[47m set background color to white

\033[1;30m set foreground color to dark gray
\033[1;31m set foreground color to light red
\033[1;32m set foreground color to light green
\033[1;33m set foreground color to yellow
\033[1;34m set foreground color to light blue
\033[1;35m set foreground color to light magenta (purple)
\033[1;36m set foreground color to light cyan
\033[1;37m set foreground color to white

\033[1;40m set background color to dark gray
\033[1;41m set background color to light red
\033[1;42m set background color to light green
\033[1;43m set background color to yellow
\033[1;44m set background color to light blue
\033[1;45m set background color to light magenta (purple)
\033[1;46m set background color to light cyan
\033[1;47m set background color to white

For other features:

\033[0m reset; clears all colors and styles (to white on black)
\033[1m bold on
\033[3m italics on
\033[4m underline on
\033[5m blink on
\033[7m reverse video on
\033[8m nondisplayed (invisible)
\033[x;yH moves cursor to line x, column y
\033[xA moves cursor up x lines
\033[xB moves cursor down x lines
\033[xC moves cursor right x spaces
\033[xD moves cursor left x spaces
\033[2J clear screen and home cursor