[SFS] What's in a UID.
Maxwell Spangler
maxlists@maxwellspangler.com
Sat, 01 Feb 2014 19:25:30 -0700
--=-KK0ngxu/IONmlZXogpuk
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
On Sat, 2014-02-01 at 18:13 -0700, David L. Anselmi wrote:
> During class today David mentioned working like UIDs don't matter. So I understand that you use
> names instead of IDs everywhere you can. But is the rest a matter of using software that doesn't
> care, or tricks to hide the differences, or ...?
Was this in reference to puppet, iow: tell it a file should be
'danselmi' not danselmi's UID of 1705? It's better to say a user
danselmi should exist as 1705 and then specify 'danselmi' as the owner
for inline documentation.
>
> For example, suppose the USB disk I use to move data between machines uses ext4. I guess mount(8)
> might have a way to make all the files belong to the user that's mounting it. But if I want to let
> people own files and control permissions on that disk they'd have to have the same UID on the
> various machines, right? Admittedly that might be an unusual use case.
All mount does is attach and present a filesystem, it shouldn't be
involved in setting or changing permissions.
If you have a file on a filesystem set so only user 600, group 600 can
access it, then you need a user 600 or group 600 on the host to access
it, or use root. Root can always get to things.
> Does root still own everything or does selinux let me label some files on removable media so root
> can't see them? (With a properly configured host of course. Which may be moot if you plug into a
> machine without selinux. Obviously the right approach is to encrypt whatever you don't want others
> to mess with.)
Root is still the all-powerful root on an SELinux system. It can see
all the data it wants and change security labels all it wants.
SELinux is used to limit not-root programs, users and processes in what
they can do.
Encryption is the only solution to prevent a root user from seeing
something you don't want them to see.
--
Maxwell Spangler
========================================================================
Linux & Open Source Systems Engineer
Fort Collins, Colorado, USA
http://www.maxwellspangler.com/
--=-KK0ngxu/IONmlZXogpuk
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.6.6">
</HEAD>
<BODY>
On Sat, 2014-02-01 at 18:13 -0700, David L. Anselmi wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
During class today David mentioned working like UIDs don't matter. So I understand that you use
names instead of IDs everywhere you can. But is the rest a matter of using software that doesn't
care, or tricks to hide the differences, or ...?
</PRE>
</BLOCKQUOTE>
<BR>
Was this in reference to puppet, iow: tell it a file should be 'danselmi' not danselmi's UID of 1705? It's better to say a user danselmi should exist as 1705 and then specify 'danselmi' as the owner for inline documentation.
<BLOCKQUOTE TYPE=CITE>
<PRE>
For example, suppose the USB disk I use to move data between machines uses ext4. I guess mount(8)
might have a way to make all the files belong to the user that's mounting it. But if I want to let
people own files and control permissions on that disk they'd have to have the same UID on the
various machines, right? Admittedly that might be an unusual use case.
</PRE>
</BLOCKQUOTE>
<BR>
<BR>
All mount does is attach and present a filesystem, it shouldn't be involved in setting or changing permissions.<BR>
<BR>
If you have a file on a filesystem set so only user 600, group 600 can access it, then you need a user 600 or group 600 on the host to access it, or use root. Root can always get to things.<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
Does root still own everything or does selinux let me label some files on removable media so root
can't see them? (With a properly configured host of course. Which may be moot if you plug into a
machine without selinux. Obviously the right approach is to encrypt whatever you don't want others
to mess with.)
</PRE>
</BLOCKQUOTE>
<BR>
Root is still the all-powerful root on an SELinux system. It can see all the data it wants and change security labels all it wants.<BR>
<BR>
SELinux is used to limit not-root programs, users and processes in what they can do.<BR>
<BR>
Encryption is the only solution to prevent a root user from seeing something you don't want them to see.<BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
Maxwell Spangler<BR>
========================================================================<BR>
Linux & Open Source Systems Engineer<BR>
Fort Collins, Colorado, USA<BR>
http://www.maxwellspangler.com/
</TD>
</TR>
</TABLE>
</BODY>
</HTML>
--=-KK0ngxu/IONmlZXogpuk--