How do commands determine whether we have the necessary privileges to perform an action?

Big_Duck

1/4/24, 5:51 PM

Ubuntu newbie here!

I can't seem to figure out what mechanism determines whether to execute a command or to display a 'Permission denied' error.

For example, assuming that we are using a regular user account, 'chown --help' get executed and works just fine, but actually changing owners returns a 'Permissions denied' error. What gives?

Using ls -l on /bin/chown tells us that regular users (others) have the execute permission.

ls -l /bin/chown
-rwxr-xr-x 1 root root 59904 Feb  7  2022 /bin/chown

Doesn't the fact that we can execute this command at all mean that we can use it any way we want?

If not for file permissions, is there another mechanism that commands use to determine whether we have the necessary privileges?

1 + 2

permissions

root

sudo

users

groups

steeldriver

1/4/24, 5:59 PM

You're not being denied permission to execute the command - you are being denied permission to modify the attributes of the target file.

Big_Duck

1/4/24, 6:08 PM

That makes sense! Thank you guys!

Score:0

Ubuntu

sean

1/4/24, 6:04 PM

The system doesn't just check if you can execute the command, there are many commands you can execute. The OS checks if whether you have the rights to make the change you're trying to make. If you do not, then the program you're trying to run is sent an error after it tries to do the operation.

For example, if you want to run the chmod command on someone else's files and you have no group permissions and the file isn't +w for the "a", so something like rw-r--r--, then there is simply no way for you to edit or modify the permissions with the command if it's "jim"'s file and you're "joe". The operating system is preventing the action, it's not the program itself. The program will only be reporting the message back to you. In fact, the command probably actually try to do what you asked... even though it cannot.

Basically, Linux has a file security infrastructure like this:

Root > Owner > Group > All Others

So, someone who is "more left" in that list has rights to change the permissions or data of anyone to the right of them where the "All Others" have none.

But, then you have a more complex issue... People can run a program as "setuid", "setgid", or whatever. That means the program runs as the user/group combination that is attached to the file. It's sometimes used to give someone access to a program. (Not recommend to use, what is recommended is giving the user adequate permissions.)

Anyway, just because you can run any program doesn't mean you can do anything with it. :D

+ 1

Big_Duck

1/4/24, 6:12 PM

That explains it! Thank you so much!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How do commands determine whether we have the necessary privileges to perform an action?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.