linux权限控制

对文件所属用户、组、其它分别设置读、写、执行权限。

这里只提下，=ls=需要目录有执行权限.

一个统一权限认证接口，其它程序通过PAM来进行权限认证。

Acess Control List。可以针对某一用户单一文件、单一目录进行rwx权限控制。ACL来自文件系统支持。

ACL支持需要在挂载时指定挂载参数(mount options)支持，目前流行的ext2,ext3,ext4, xfs, ReiserFS都支持。

这里提下判断顺序，分为两步，先检查ACL条目，再检查基本权限.

If
    the user ID of the process is the owner, the owner entry determines access

else if
    the user ID of the process matches the qualifier in one of the named user entries, this entry determines access

else if
    one of the group IDs of the process matches the owning group and the owning group entry contains the requested permissions, this entry determines access

else if
    one of the group IDs of the process matches the qualifier of one of the named group entries and this entry contains the requested permissions, this entry determines access
else if
    one of the group IDs of the process matches the owning group or any of the named group entries, but neither the owning group entry nor any of the matching named group entries contains the requested permissions, this determines that access is denied

else
    the other entry determines access.

If
    the matching entry resulting from this selection is the owner or other entry and it contains the requested permissions, access is granted

else if
    the matching entry is a named user, owning group, or named group entry and this entry contains the requested permissions and the mask entry also contains the requested permissions (or there is no mask entry), access is granted

else
    access is denied.

更改和查看acl通过=setfacl=和=getfacl=实现。

传统的权限控制是控制使用者的行为，SELinux则是控制程序的行为。SELinux功能实现在内核部分。

程序有什么行为时，SELinux先进行判断，如果有权限再交给传统的权限控制机制判断。

详细请参考鸟哥的SELinux 管理原则

后来看到这个了https://www.centos.org/docs/5/html/Deployment_Guide-en-US/selg-overview.html

还是红帽厉害……SELinux User's and Administrator's Guide

还有gentoo的维基

• How do UNIX file permissions work?
• POSIX Access Control Lists on Linux
• 第十七章、程序管理与 SELinux 初探