![]() |
![]() |
|
|
Introduction to UNIX Part 2 |
|
Contents9. File Security 9.1 File Permission Overview 9.2 The ls Command 9.3 Examining File Permissions 9.4 Modifying File Permissions 9.5 Altering the Group of a File/Directory 9.6 Default Permissions 9.7 Quotas 10. File Management 10.1 The mv Command 10.2 The cp Command 10.3 The rm Command 10.4 The file Command Core Files 11. Manipulating Files 11.1 The cat Command 11.2 The more Command 11.3 The head Command 11.4 The tail Command 12. Jobs, Pipes, and Input/Output 12.1 Multitasking Support The jobs Command The ; and & Operators The <Control>-Z Keystroke The fg and bg Commands The kill Command (Part i) 12.2 Pipes 12.3 Input/Output Redirection The <, >, and >> Operators The >& and >>& Operators 13. Obtaining Hard-copy Output 13.1 Hard-copy Devices 13.2 The devices Command 13.3 The lpr Command 13.4 The lpq Command 13.5 The lprm Command 14. Miscellaneous Operations 14.1 Finding files 14.2 Managing Processes The ps Command The kill Command (Part ii) The nice and renice Commands 14.3 Logging a Session, the script Command 14.4 HELP! Its gone crazy, how do I kill it? The <Control>-C Keystroke The <Control>-Z Keystroke and the kill Command Logging in Elsewhere Seeking Outside Help 15. Exercises 9. File Security9.1 File Permission OverviewUnix holds two pieces of information on each user: the user's username, and his/her group membership details. The username uniquely identifies a particular person, while the group membership details are a list of user groups to which that user belongs. Through the use of groups, several users may be collected together and treated as one. Groups are typically used to control access to programs or directories for departments or classes (as elaborated upon below). Unix file and directory access control is quite simple. A Unix file has an owner (usually the creator of the file), and a group (which is derived from the creator or the parent directory). Essentially only three permissions may be manipulated, for files: read , write, execute, and for directories: list contents, create and remove files, attach to the directory. These permissions are displayed using a form of the ls command. 9.2 The ls CommandThe ls command is the Unix command which lists the contents of directories and displays information about files. Its syntax is of the form: ls [ -options ] [ filename1 ... ] There are a number of useful ls options:
For example: sesame[csh]%ls mbox training sesame[csh]% sesame[csh]% ls -a . .cshrc .logout mbox .. .login .profile training sesame[csh]% sesame[csh]% ls -F mbox training/ sesame[csh]% sesame[csh]% ls -lg total 16 -rw------- 1 smith zd164542 3415 Jun 23 13:34 mbox drwx------ 2 smith zd164542 24 Jun 23 14:52 training sesame[csh]% sesame[csh]% ls -R mbox training training: sesame[csh]% 9.3 Examining File PermissionsTo examine a file/directory's access modes, specify the long format and display group
options of the ls command, -rw------- 1 smith zd164542 3415 Jun 23 13:34 junk drwx------ 2 smith zd164542 24 Jun 23 14:52 training The column at the extreme left indicates the file type (in this case "-" for a normal file, "d" for a directory, and "l" for a symbolic link). The next nine columns from the left display the access modes for the file's owner, members of the file's group, and everyone else on the system respectively. For example, the entry for "junk" is a file (-) is readable and writeable (rw-) for the owner. A further example is "training". It is a directory (d) owned by "smith" who has all access (rwx), and members of the file's group and all other users have no access to the file. 9.4 Modifying File PermissionsAccess modes can be altered by using the chmod command, although only the owner of the file/directory may change its mode. The general form for chmod is: chmod [ -R ] { u | g | o | a }{ + | - }{ r | w | x } filename ... i.e. change the mode for {the owner (user), the group, and/or everyone else (others), or all}{add or subtract}{read, write, and/or execute permissions} on the file with name filename . For example to allow execution of the file "junk" by the owner the following should be typed: sesame[csh]% chmod u+x mbox 9.5 Altering the Group of a File/DirectoryThe owner of a file may change the group to which the file belongs using the chgrp command. The syntax of chgrp is: chgrp [ -R ] groupname filenameNote that this doesn't change the files within the directory, it just changes the directory itself. To recursively change all entries within the directory, the "R" option of chgrp is required. Users can only change the group of a file/directory to a group to which they belong. To see which groups you belong to, use the groups command. For example: sesame[csh]% groups zd164542 sesame[csh]% 9.6 Default PermissionsThe ownership of a file is set to the username of the person who creates that file and can only be changed by the superuser (so that quota restrictions cannot be subverted). The group membership of a file is derived from the group of its creator or from the file's parent directory, but may be changed using chgrp as illustrated above. The default access mode for new files and directories can be set using the umask command, or can be derived from the mode of the parent directory. The argument to umask is a three digit number representing the Ôopposite' of the mode to have placed on the file. With no arguments, umask displays the current value. Three common examples are:
sesame[csh]% umask 77 sesame[csh] % touch new_file sesame[csh] % ls -l new_file -rw------- 1 smith 0 Jun 26 09:21 new_file sesame[csh]%
sesame[csh]% umask 027 sesame[csh]% touch new_file2 sesame[csh]% ls -l new_file2 -rw-r----- 1 smith 0 Jun 26 09:26 new_file2 sesame[csh]% and;
sesame[csh]% umask 022 sesame[csh]% touch new_file3 sesame[csh]% ls -l new_file3 -rw-r--r-- 1 smith 0 Jun 26 09:28 new_file3 sesame[csh]% umask is typically executed in the "~/.login " file. See the manuals for chmod(1) and umask (1) for more information. 9.7 QuotasUsers of computer systems are often given quotas (an amount of disk space which can't be exceeded). To examine the quota limits and current usage, the quota command should be used with the "-v" (verbose) option: sesame[csh]% quota -v Disk quotas for smith (uid 1531): Filesystem usage quota limit timeleft files quota limit timeleft sesame[csh]% Of interest here are the "usage", "quota", "limit", and "timeleft" fields on the left. The "usage" field shows the current disk usage of the user in Kilobytes. If this figure should reach the "quota" figure the opewrating system will emit a warning that the quota has been exceeded but will allow the further creation of files. This is called the soft limit. The hard limit is displayed under the "limit" column and the operating system strictly enforces this limit. When the soft limit is reached a timer is started. If the user is above the soft limit for the duration of the timer (typically seven days) the soft limit becomes the hard limit, and no more disk space can be consumed. If no figures are given when the quota command is used the user does not have a quota. A similar command to quota is du. du displays the disk usage of the nominated directory or directories, for example: sesame[csh]% du 8 ./training 56 . sesame[csh]% Shown is a list of the disk space occupied by all subdirectories together with subtotals for the nominated directories. To obtain the subtotals only, the "-s" option should be specified: sesame[csh]% du -s bin src bin: No such file or directory 0 bin src: No such file or directory 0 src sesame[csh]% 10. File Management10.1 The mv CommandThe mv command is used to move and/or rename files/directories and has the following syntax: mv filename1 filename2 mv directory1 directory2 mv filename1 [ filename2 ... ] directory The first form renames existing file "filename1" with new name "filename2". The second form renames existing directory "directory1" with new name "directory2" if directory " directory2" doesn't already exist. If a directory with name "directory2" already exists then the next form applies. The last form of mv moves all named files into the existing directory "directory". When moving directories, the destination directory must reside on the same physical partition (top level directory) as the source. If this is not the case, the files must be copied (using cp) and then deleted (using rm). 10.2 The cp CommandThe cp command is similar in form and use to mv but copies files rather
than renaming them. cp filename1 filename2 cp -r directory1 directory2 cp [ -r ] filename ... directory The first form copies the named file naming the copy " filename2 ". The second form recursively copies the specified directory (" directory1") into directory "directory2 " if it exists or as "directory2" if it does not. The third form (optionally recursively) copies all specified files and directories into directory "directory" which must already exist. 10.3 The rm CommandThe rm command is used to remove (delete) files. It has a number of options, but the most useful is "-i" which causes rm to prompt the user for confirmation before deleting files. The default is to silently delete all files specified. Some examples of rm are: sesame[csh]% rm junk sesame[csh]% rm -i new* rm: remove new_file1? y rm: remove new_file2? y rm: remove new_file3? y sesame[csh]% rm also has a recursive option which can be used to delete directories and their contents. This should be used with extreme caution. 10.4 The file CommandSometimes it is not apparent what a file is. It is obvious from ls whether or
not the file is a plain file, a directory, or a symbolic link, but in the case of plain
files, it is not obvious if it is a text file, some kind of binary file, a command, an
executable shell script, or a manual. file can often discern the difference. For
example: sesame[csh]% file* junk: commands text mbox: commands text training: directory sesame[csh]% As illustrated, file was able to provide information about the kind of each file. Using this information, appropriate commands may be used to examine/modify each file. Core FilesSometimes extenuating circumstances cause programs to go wrong. When this happens, they often save an image of the computer's memory (into a file called "core") for programmers to debug and determine what caused the problem and how to fix it. These files are called core files. Programs will often abort with a message similar to: Segmentation fault (core dumped) sesame[csh]% file should be able to tell the user which command created the file. This information may be important to the system administrators. sesame[csh]% file core core: core file from 'dig' sesame[csh]% ls -l core -rw-r--r-- 1 smith 8434096 Feb 11 17:23 core sesame[csh]% Core files will almost always be very large and users should always delete a file called "core" if they find one in their home directory. sesame[csh]% rm core sesame[csh]% 11. Manipulating FilesSo far we have edited files, and discussed how we can determine what files we possess and what kind of files they are, but we haven't as yet examined the contents of any files (apart from using vi). This section introduces some commands for examining files. 11.1 The cat Commandcat lists the contents of files (usually) to the screen. Its syntax is: cat filename ... and can be used to concatenate files when multiple filenames are given. 11.2 The more CommandOne drawback when using the cat command is that files are listed without pausing after each screenful appears, and there is no ability to either go backwards, or search for text in a file. If any of these functions are required, the morecommand should be used. more displays the contents of the file one screen at a time and then prompts with --More--(38%) more displays the progress through the file (as a percentage) and then waits for a command. Some of the more useful commands (many of which may be prefixed with a number, k) are:
more is the command used to display manual pages, hence these commands are also available when the man command is used. cat and more are excellent commands for browsing files. Often though, only the first few lines or the last few lines of a file need to be examined. There are two commands to do this: head and tail. 11.3 The head Commandhead displays the top n lines of a file. Its syntax is: head -n filename If n is not specified, it defaults to ten. 11.4 The tail Commandtail displays the bottom of a file. Its syntax is: tail { + | - }n filename If "+n" is specified, the lines from line nonwards are displayed, otherwise the bottom n lines of the specified file are displayed. If no option is given "-10" is assumed. 12. Jobs, Pipes, and Input/OutputUnix is an extrememly powerful and flexible operating system which places three powerful facilities at the user's disposal:
12.1 Multitasking SupportAs indicated above, Unix allows users to execute multiple commands simultaneously. There are a number of commands and keystrokes to facilitate this and these will now be discussed. Note that there is no job control in the Bourne shell. The jobs CommandThe jobs command displays all multitasked jobs that are running or suspended. For example: sesame[csh]% jobs [1] - Stopped (tty output) man man [2] + Stopped finger [3] Running users sesame[csh]% As shown, operating system numbers the jobs that the user has and shows their status. In the example, there are three jobs, two are suspended and one is running. The ; and & OperatorsThe user can initiate a number of commands from the same command line. These can be separated by either a semi-colon (;) or by an ampersand (&). If a semi-colon is used, the commands are executed in sequence whereas if an ampersand is used the commands are executed in parallel. For example: sesame[csh]% pwd;ls /mnt1/smith junk mbox training sesame[csh]% and, sesame[csh]% pwd & ls [1] 5249 mnt1/smith [1] 5249 [1] Done pwd junk mbox training sesame[csh]% In the sequential example, once pwd finishes its output ls starts, and then when ls completes the shell offers its prompt once again. In the parallel example, the shell fires a parallel process (with process id 5249) to perform the pwd which corresponds to job number 1, and starts the ls. At this point there are two commands going simultaneously and the output could be confusing:
In the example, ls completed before the pwd. To avoid simultaneous output, output redirection can be used. This is discussed below. The <Control>-Z KeystrokeTo suspend a job, the <Control>-Z keystroke should be used. This will suspend the foreground job and return you to the shell. For example: sesame[csh]% jobs sesame[csh]% man man ^Z Suspended sesame[csh]% jobs [1] + Suspended man man sesame[csh]% At this point, the job can be restarted in the foreground, restarted in the background, killed, or left suspended until a later time. The fg and bg CommandsOnce a job has been suspended it can either be continued or killed. If it is to be continued, this can be done in the foreground (using fg) or in the background (using bg). The difference is simply that if continued in the foreground, the shell prompt will not return until the job is finished, whereas if the job is continued in the background the shell prompt will return immediately. For example: sesame[csh]% fg man man will recommence the job suspended earlier. sesame[csh]% bg [1] + man man & sesame[csh]% [1] + Suspended (tty output) man man sesame[csh]% fg and bg both take an optional argument of the form "%j" where j is the number of the job to foreground or background. Note that one job in the list returned by jobs has a plus (+) following it, this job will be the default job for fg and bg if no job number is given (as shown above). (In the example above, the background job suspended itself since it needed to interact with the user). The kill Command (Part i)A suspended job can be killed (stopped) using the kill command. To kill a job, its job number should be supplied. For example: sesame[csh]% jobs [1] + Suspended (tty output) man man sesame[csh]% kill %1 sesame[csh]% [1] Terminated man man sesame[csh]% The jobs command now will show no suspended jobs. More will be said about kill later. 12.2 PipesThe philosophy of the Unix operating system is for users to combine existing commands to create new commands rather than writing new commands from scratch. This can be done using pipes. Pipes join the output of one command and the input of another. The best way to explain pipes is with examples. The examples will use the following data file. sesame[csh]% cat datafile This is a sample file of names Daniel Mary Allan Mark Jane Judith sesame[csh]% The first example (below) sorts the file (by simply passing the output of cat to the sort command which sorts the file). sesame[csh]% cat datafile|sort Allan Daniel Jane Judith Mark Mary This is a sample file of names sesame[csh]% The second example displays the number of people in the file whose surname begins with a "J" (by passing the output of cat to the grep command which extracts only those lines beginning with "J" and then passing that output to the word count command, wc, which with the "-l" option displays the number of input lines). sesame[csh]% cat datafile | grep "^J" | wc -l 2 sesame[csh]% 12.3 Input/Output RedirectionThe <, >, and >> OperatorsMost commands assume that input will come from the keyboard and that output should be sent to the screen. These are actually two data streams called standard input and standard output respectively. Using redirections, the input to commands can come from files (using <) or commands (using | ), and the output to commands can go to files (using > and >>) or commands (using |). The difference between the single angle bracket and double angle brackets is that:
Some examples of input/output redirection now follow. This example creates a file called "Jdatafile" comprising those people from the original file whose surnames begin with "J". sesame[csh]% cat datafile | grep "^J" > Jdatafile sesame[csh]% cat Jdatafile Jane Judith sesame[csh]% The >& and >>& OperatorsIn addition to the standard output stream, there is also a standard error stream which Unix commands use to report error messages across. To illustrate this point consider the following examples (the file "not_there" doesn't exist). sesame[csh]% ls -lg not_there > ls.out not_there not found sesame[csh]% sesame[csh]% cat ls.out sesame[csh]% The standard output of ls was redirected to the file "ls.out" but this file is empty since the file "not_there" didn't exist. Note that the error message was not redirected since it was on the standard error stream. The following example also redirects the standard error stream to the file "ls.err". sesame[csh]% ( ls -lg not_there > ls.out ) >& ls.err sesame[csh]% cat ls.out sesame[csh]% cat ls.err not_there not found sesame[csh]% Note that a sub-shell (the parenthesized command) was required since the >& operator redirects both standard output and standard error streams. This is not required in the Bourne shell. 13. Obtaining Hard-copy Output13.1 Hard-copy DevicesThe Convex has a number of printers available to it. There is a consistent naming scheme: location_typen.domain where: location is an abbreviated location; type is an abbreviated device type, e.g. (lp for line-printer, plot for plotter, and psfor Postscript); n indicates the number of that device; and domain indicates the department in which the printer resides. Some examples include: op_ps.cc - a LaserWriter in the Computing Centre's Operations Room; and op_lp2.cc - a line printer in the Computing Centre's Operations Room. 13.2 The devices CommandNOTE: This command is not available on the Convex The devices command displays the list of printers defined in the University, unfortunately it does not indicate whether the printer is available from the local machine. 13.3 The lpr Commandlpr [ -Pprinter ] [ file ... ] lpr sends files (or the standard input) to the specified printer. If no printer is specified, "lp" is assumed. 13.4 The lpq CommandTo examine the line printer queues, the lpq command is used. Its syntax is: lpq [ -Pprinter ] 13.5 The lprm CommandSometimes it is necessary to remove files from the printing queue that have been submitted for printing. When this is the case, the job number from lpq is necessary. The syntax for lprm is: lprm [ -Pprinter ] job_number ... 14. Miscellaneous Operations14.1 Finding filesThere is a command available to users to search for files. find recursively descends the specified directory searching for the specified files and performs the specified actions. It is a quite complex and powerful command but its syntax can be usefully abbreviated to: find directory ... expression ... expression can be any/all of the following:
For example (from find(1)) to find all the files called "intro.ms" starting from the current directory: Caveat (from the find(1) manual): 14.2 Managing ProcessesThe ps CommandWhenever a command is to be executed, Unix creates a process to execute it. (The id of this process is the number indicated when a job is started in the background). To examine all the processes that a user is executing, the ps command should be used. This has three useful options:
The output from the ps command with these options are illustrated below. sesame[csh]% ps PID TT STAT TIME COMMAND 8337 p1 S 0:01 -csh[smith] 8445 p1 R 0:00 ps sesame[csh]% This illustrates a login shell, a sub-shell, and a running ps command. The "PID" column indicates the process id, the "TT" column indicates the terminal, "STAT" displays the status of the process, "TIME" indicates the time in minutes:seconds that the process has accumulated, and "COMMAND" indicates the command being executed. With the "-u" option much more information is displayed including the percentage of CPU and memory being occupied and the time the process started. sesame[csh]% ps -u USER PID %CPU %MEM SZ RSS TT STAT TIME COMMAND smith 8337 0.4 0.1 728 216 p1 S 0:01 -csh[smith] smith 8448 0.0 0.1 5284 232 p1 R 0:00 ps -u sesame[csh]% In addition to these columns, the "-j" option also displays job control information including "PPID", "PID", "PGID" and "SID" columns. The "PID" column shows the process id of the process as given by other forms of ps. The "PPID" column shows the process id of the parent process. The "PGID" column shows the process group id. Lastly, the "SID" column shows the process id of the log in session to which the process belongs. This output is discussed in more detail below. sesame[csh]% ps -j PID TT STAT TIME COMMAND 8337 p1 S 0:02 -csh[smith] 8578 p1 R 0:00 ps -j sesame[csh]% The kill Command (Part ii)kill is the command used to communicate with running processes. The most common use of kill is to stop a running process. Consider the following: sesame[csh]% yes > /dev/null & [2] 8585 sesame[csh]% This will cause the yes command (see yes(1)) to run in the background, writing its output to "/dev/null " which is a sink. To stop this process we need to know its process id. This was shown by the shell when the job started, but we shall ignore this for the point of the exercise. Using ps we can discover: sesame[csh]% ps PID TT STAT TIME COMMAND 8337 p1 S 0:02 -csh[smith] 8585 p1 R 0:38 yes 8588 p1 R 0:00 ps sesame[csh]% The process id of the process is 8585. We use this number as an argument to kill.
kill [ -9 ] process_id ... Without the "-9" option kill sends the terminate signal to the specified processes which should cause them to abort. If they do not, sending the "-9" (kill signal) will. (kill accepts as its option a signal but "-9" is the only relevant signal for users). sesame[csh]% kill 8585 sesame[csh]% [2] Terminated yes > /dev/null sesame[csh]% The nice and renice CommandsWhenever users initiate commands, they compete with all other active processes for system resources and processor time. When users have large jobs to execute, or have jobs that are not urgent, they should be initiated with a lower scheduling priority. The nice command informs the system that the associated command should be executed with a lower than normal scheduling priority. For example: sesame[csh]% nice yes > /dev/null & [1] 8591 sesame[csh]% This executes the yes command in the background at a lower scheduling priority than normal. The fact that the process has been niced shows up in the output of ps: sesame[csh]% ps -u USER PID %CPU %MEM SZ RSS TT STAT TIME COMMAND smith 8591 67.0 0.0 48 16 p1 R N 0:48 yes smith 8337 0.1 0.1 728 216 p1 S 0:02 -csh[smith] smith 8663 0.0 0.1 5284 232 p1 R 0:00 ps -u sesame[csh]% sesame[csh]% kill %1 sesame[csh]% [1] Terminated yes > /dev/null sesame[csh]% The "N" under the "STAT" column of process 8591 shows that it has been niced. If a process has been started and it is desirable to lower its scheduling priority, it can be reniced. The syntax of the renice command is: renice priority [ -p pid ... ] [ -g gpid ... ] where:
14.3 Logging a Session, the script Command The script command logs all input and output of a user's session to a file. Its syntax is: script [ -a ] [ filename ] If no filename is specified "typescript" is used. All input and output is written to the file (overwriting an existing file unless "-a" is used in which case scriptappends the output to the file) until exit(or <Control>-D) is typed. At this point the log file is closed. For example: sesame[csh]% script saved_output Script started, file is saved_output sesame[csh]% sesame[csh]% ls Jdatafile junk ls.out saved_output datafile ls.err mbox training sesame[csh]% exit exit Script done, file is saved_output sesame[csh]% sesame[csh]% cat saved_output Script started on Mon Jun 26 13:46:31 1995 sesame[csh]% ls Jdatafile junk ls.out saved_output datafile ls.err mbox training sesame[csh]% exit exit script done on Mon Jun 26 13:47:27 1995 sesame[csh]% ^C Note: script works by creating a subshell, hence the user's .cshrc file is executed when the script file is opened. 14.4 HELP! Its gone crazy, how do I kill it?The <Control>-C KeystrokeThe first method for killing a foreground job is to use the interrupt keystroke -
<Control>-C. The <Control>-Z Keystroke and the kill CommandIf <Control>-C doesn't work, perhaps the job can be suspended (with a ^z) and killed. Logging in ElsewhereIf the process still won't die, log in from another terminal and obtain the process id(s) using ps. It may be that a group of processes is responsible, rather than a single process. Seeking Outside HelpIf all else fails, contact the Information Technology Services Help Desk (4000) or contact the system administrator. 15. ExercisesTo find out the mode of a file, what command should be used? What do the following permissions mean?-rwxr-xr-x 1 news news 417792 Feb 3 15:14 /usr/local/nn/bin/nn What kind of file is it? What command would you use to remove read access for all people other than the owner of
the following file: What is your current umask? What command did you use to determine this? Examine your quota restrictions. What command did you use? How much disk space is used in your home directory? What command did you use to determine this? Copy your "~/.cshrc" and "~/.login" files to the directory "training" in your home directory. How did you do it? Remove the ".login" file from the "training" directory in your home directory. What command did you use? What kind of file is "/bin/write"? How did you determine this? Is this a command? Why/why not? Examine the last five lines of the "~/training/.cshrc" file. How did you do it? Reformat the csh and man manuals in the background. How did you do it? Examine your job list using the jobs command. Bring the man manual to the foreground. What command did you use? Suspend the manual page. How did you do it? Display (using the grep command) the line in the "~/training/.cshrc" file that sets the "path" variable. What did you type to achieve this? Redirect this to the file "~/training/csh_path" and verify that it is the same. What commands did you use? Append the output of "echo $path" to the "~/training/csh_path" file. What did you type to do this? Kill your first job. What command did you use? What is in the line printer queue? What command did you use to examine the queue? Print out your "~/.login" file on the default printer. What did you type? Check the line printer queue again. Use the ps command to find the process group responsible for your second background job. What did you type? What did you look for in the output? Stop the process group shown above by ps. What did you type? Verify that you have no background jobs. What command did you use? Start a script in the "~/training" directory of the current session, execute some commands, and close the script. How did you do this? Examine the contents of the log file. What command did you use? Log in again (without logging out), and log the first session off from the second session. What commands did you type? |