Linux中的文件锁定

Question

First question:

Can users lock files in Linux/Unix from reading or writing?

Second question:

Can users burn locked files onto any optical medium? Afterwards, will it correspond with any operating system?

Third question:

If a file is locked for reading or writing and is burned onto any optical medium, can the user try to rip it? If so, afterwards, can any operating system kernel create an error message that denies any user except for the root user to perform that task?

If the file is prevented from reading, then users cannot copy, open, or read it. If the file is prevented from writing, then users can move it within the desktop, but it may not be burned to any optical medium.

And one more thing, there is no such thing as cp permissions. I have just found out earlier.

Since I am knowledgeable in C/C++ programming, I may likely to create a library in C/C++ if any operating system kernel does not support what I am trying to say. cC Afterwards, if it's possible, make it a library file and include it in the C/C++ library.

In order to perform that task I would have to make all variables declared in static data types, so that it can be retained whenever their operating system kernels respond to it.

Would that be an idea?

Another idea is to implement the noncopyable library, which is only compatible with the Embarcadero C/C++ compiler, which is not freeware or shareware. Users would have to purchase from their website online.

I may be mistaken since that topic relates to C/C++ version 11. Maybe Microsoft updated its Visual Studio for 2013 and will continue to do so in later years.

JohnDB

Answer 1

The answer to your overall question here is "no". You can get POSIX permissions on optical media, but effective data security pretty much goes out the window as soon as you start distributing removable media.

There are two major filesystems used for optical media:

• ISO 9660 , the old CD format.

  The original version of this format didn't support permissions at all. Access control was up to the kernel, which decided en masse which single permission set to assign to all files on the disc.

  The Rock Ridge extensions added a POSIX-compatible permission scheme, but this is full of problems:

  1. You can give the norock mount option in Linux to make it ignore the permissions.

     Keep in mind that this is a removable optical medium. If you're sending the disc out to people you don't have any control over, or the disc drive is physically accessible to the end user, they'll be able to defeat your permission scheme.

  2. Permissions are based on user and group IDs, not names, so you're going to have the old problems of synchronizing user and group tables if you want users and groups on the target system to have some access.

     About the only thing you can count on across systems that aren't managed under a single administrator or organization is that a file marked as owned by user ID 0 and group ID 0 will be read-only to root if it's set to mode 440 or 400.

  3. Non-Linux OSes will interpret the permissions differently.

     In my testing of this last year , Windows ignores optical disc permissions entirely.

     OS X also ignores optical disc permissions by default when you simply insert the disc in the computer and let it auto-mount. I imagine you could make the OS obey permissions by manually mounting the disc, but that's really no security at all.

     This plays into problem #1 above, because it means defeating your permissions scheme is as simple as putting the disc in a Mac or Windows box.

  4. You asked about disc ripping, at which point all permissions go out the window, regardless of OS. The presumption with ripping is that you have complete read access to the disc, which means you have complete access to the data. You can do whatever you want with the data from that point on.

• UDF , the effective replacement for ISO 9660 for CD-RW, DVD, and BluRay media.

  UDF has POSIX file permissions from the start, so in that sense it is like ISO 9660 with the Rock Ridge extensions. Unfortunately, the Linux implementation is no more secure, since you can mount the disc with uid=ignore,gid=ignore and it will behave just like norock with an ISO 9660 disc.

  Everything else above applies just as well to UDF.

The bottom line is that you're trying to disregard a key principle of data security: physical access is complete access. An unavoidable prerequisite for keeping people out of a system is to restrict their physical access to it. That means you have to make them come to you for the files, not ship them discs and hope their OS kernel does what you want with the 1's and 0's on that disc.

Answer 2

You can lock the file from any user to use it by running:

sudo chmod 000 <file>

This means that the owner, the group and others can't read, write or execute the file. Note that root can always set the file permissions back to something else, so the file is not locked forever after running that command.

Typically will not be able to burn the file as you can't read from it and even if you would be able to, it would not properly keep its file permissions after writing it to a CD as that file system(CDFS) does not support them.

You can learn more about file permissions here .

Answer 3

If you are having vim package then you can encrypt the file

:set key=your_key

So that next time you open the file it will ask for the key

Answer 4

Short Version:

1) Yes

2) No

3) See question 2's long-answer.

Longer version:

Of course. Users have an ownership on files. These can be modified, of course. Files have three different permission "types" read, write and execute. Each file has these attributes either set or unset, to three different groups. User, group, and everyone.

This modification is done using the chmod command, usually followed by a string of characters, or a 3 digit octal symbol (0xxx).

I'd suggest looking into the chmod command in the man pages, as they cover how to use it pretty effectively.

As for the second question, no. Unfortunately optical media uses a file format that is effectively a data dump on a disc. The file system supports permissions, it's not an actual attribute of the file itself. As a result of this, the optical disc is just a solid copy of the data, nothing special with permissions. That means, whenever the disc is used on ANY system, the permissions are always completely open.

Edit: Just to clarify. you cannot burn a file to a disc when you do not have read permission to the file. Sorry if that caused any confusion.