Commands
In this article, we will compare Btrfs and LVM and determine which filesystem is better. This should be an interesting read…why you ask? Table of
Learn how implementing and managing File Access Policies (FAP) in Linux enhances security. This guide covers permissions, ACLs, SELinux, and audit logs with commands and examples for comprehensive access control.
Ensuring secure file access in a Linux environment is essential for preventing unauthorized data access and protecting system integrity. This guide will help you understand and implement File Access Policy (FAP) strategies on Linux, from standard permissions to advanced tools like Access Control Lists (ACLs) and SELinux.
Understanding File Access Policies in Linux |
Linux File Access Policies (FAP) define who can access what files or directories, how they can interact with them, and ensure system security by restricting unauthorized access. Linux typically enforces file access policies through basic permissions and extended features such as Access Control Lists (ACLs) and SELinux.
Standard Linux File Permissions |
The traditional approach to file access control in Linux involves the permission model that assigns read (r), write (w), and execute (x) permissions for three categories:
| Category | Description |
|---|---|
| Owner | The user who owns the file or directory |
| Group | The group associated with the file or directory |
| Others (World) | Any user not part of the owner or group category |
Each file or directory has a 10-character string that represents permissions, as seen in ls -l output:
-rwxr-xr--
| Character | Meaning |
|---|---|
| 1st (File Type) | - (file), d (directory), l (link) |
| 2-4 (Owner) | Read, write, execute for the owner |
| 5-7 (Group) | Read, write, execute for the group |
| 8-10 (Others) | Read, write, execute for others |
Permissions can be modified using the chmod command.
Assigning Read and Write Permission to Owner |
chmod u+rw filename
Removing Execute Permission from Group and Others |
chmod go-x filename
Setting Exact Permissions with Octal Notation |
chmod 755 filename
| Octal Code | Permissions |
|---|---|
| 7 | Read, write, and execute (rwx) |
| 5 | Read and execute (r-x) |
| 4 | Read only (r–) |
| 0 | No permissions (—) |
Advanced Access Control with ACLs |
Access Control Lists (ACLs) provide finer-grained control over file access by allowing specific permissions for individual users or groups beyond the owner, group, and others categories.
Enable ACL Support on Filesystems |
Use the following command to check if ACL support is enabled:
mount | grep acl
Setting ACLs for a User |
setfacl -m u:username:rw filename
Viewing ACLs for a File |
getfacl filename
| Command | Description |
|---|---|
setfacl -m | Modify ACL entry for user/group |
getfacl | View ACL entries for a file or directory |
setfacl -b | Remove all ACL entries |
Enforcing Policies with SELinux |
Security-Enhanced Linux (SELinux) provides a robust security model for enforcing mandatory access control (MAC). SELinux assigns labels to files and defines access based on security contexts rather than traditional ownership.
Check SELinux Status |
sestatus
Set File Contexts |
sudo semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
Applying the New Context |
sudo restorecon -R /web
| SELinux Command | Description |
|---|---|
semanage fcontext | Define file context |
restorecon | Apply defined context to files |
sestatus | Display SELinux status |
Using Audit Logs for FAP Monitoring |
Audit Logs in Linux help monitor and verify FAP by logging access events for critical files and directories.
Installing Auditd |
sudo dnf install audit
Adding a Watch on Sensitive Files |
sudo auditctl -w /etc/passwd -p rwxa -k passwd_changes
Viewing Audit Logs |
sudo ausearch -k passwd_changes
| Audit Command | Description |
|---|---|
auditctl | Set up file watches |
ausearch | Search audit logs based on keywords |
audispd | Dispatch audit events to specific logs |
In this article, we will compare Btrfs and LVM and determine which filesystem is better. This should be an interesting read…why you ask? Table of
Discover 25 essential Linux commands for efficient storage management. Learn how to monitor disk usage, manage partitions, create filesystems, and optimize storage performance with detailed