![Linux 所有者文件的权限被拒绝](https://linux22.com/image/1536877/Linux%20%E6%89%80%E6%9C%89%E8%80%85%E6%96%87%E4%BB%B6%E7%9A%84%E6%9D%83%E9%99%90%E8%A2%AB%E6%8B%92%E7%BB%9D.png)
我有一个同事遇到了一个非常奇怪的问题。我们使用一个脚本,该脚本会自动将我们放入工作目录中,然后我们创建的所有文件都属于我们所属的某个组(我不知道代码,也不允许我分享它,但顺便说一句,这不是问题所在)。直到 3 周前,它一直运行良好。问题是:创建文件时,很明显该人是文件的所有者,并且该组中的每个人(包括他)都可以访问它。但是,如果他随后su
对自己的用户名执行“ ”,并且不再被视为该组的成员,那么即使他仍然是所有者(这适用于工作目录中的每个文件),他也将无法再访问他的文件。即使有chmod 777
。这怎么可能呢?
(其他信息:selinux 似乎已被禁用,我们设置了相同的环境变量)
添加的信息:这是getfacl
对我的文件进行的操作:
$ getfacl 01_EP_Tool_CB65RHS_Douglas.dat
# file: 01_EP_Tool_CB65RHS_Douglas.dat
# owner: my_username
# group: gr-st_name
user::rw-
group::rw-
other::---
另一个文件也一样:
$ getfacl resultat_001.xls
# file: resultat_001.xls
# owner: other_username
# group: gr-st_name
user::rwx
group::rwx
other::---
现在ls -ld
:
$ ll -ld 01_EP_Tool_CB65RHS_Douglas.dat
-rw-rw---- 1 my_username gr-st_name 2957222 Jul 27 11:28 01_EP_Tool_CB65RHS_Douglas.dat
$ ls -ld resultat_001.xls
-rwxrwx--- 1 other_username gr-st_name 3014 Jul 27 16:50 resultat_001.xls
id
现在连接后,这是&的结果groups
:
$ id
uid=47910(other_username) gid=147910(pgr-other_username) groups=1605(other_group8),2657(other_group9),2999(other_group1),3002(other_group2),3148(other_group3),3161(other_group4),3185(other_group5),3586(other_group6),3588(other_group7),3589(other_group10),3590(other_group11),3591(other_group12),3595(other_group1_d),3792(other_group13),3818(other_group14),3837(other_group14-2),3931(other_group13_s),**3972(gr-st_name)**,4007(other_group15),60419(other_group16),61055(other_group17),61115(other_group18),61123(other_group19),61127(other_group20),147910(pgr-other_username)
$ groups
pgr-other_username other_group8 other_group9 other_group1 other_group2 other_group3 other_group4 other_group5 other_group6 other_group7 other_group10 other_group11 other_group12 other_group1_d other_group13 other_group14 other_group14-2 other_group13_s **gr-st_name** other_group15 other_group16 other_group17 other_group18 other_group19 other_group20
然后进入工作环境之后:
$ id
uid=47910(other_username) **gid=3972(gr-st_name)** groups=1605(other_group8),2657(other_group9),2999(other_group1),3002(other_group2),3148(other_group3),3161(other_group4),3185(other_group5),3586(other_group6),3588(other_group7),3589(other_group10),3590(other_group11),3591(other_group12),3595(other_group1_d),3792(other_group13),3818(other_group14),3837(other_group14-2),3931(other_group13_s),3972(gr-st_name),4007(other_group15),60419(other_group16),61055(other_group17),61115(other_group18),61123(other_group19),61127(other_group20),147910(pgr-other_username)
$ groups
**gr-st_name** other_group8 other_group9 other_group1 other_group2 other_group3 other_group4 other_group5 other_group6 other_group7 other_group10 other_group11 other_group12 other_group1_d other_group13 other_group14 other_group14-2 other_group13_s other_group15 other_group16 other_group17 other_group18 other_group19 other_group20 pgr-other_username
然后su other_username
:
$ id
uid=47910(other_username) gid=147910(pgr-other_username) groups=1605(other_group8),2657(other_group9),2999(other_group1),3002(other_group2),3148(other_group3),3161(other_group4),3185(other_group5),3586(other_group6),3588(other_group7),3589(other_group10),3590(other_group11),3591(other_group12),3595(other_group1_d),3792(other_group13),3818(other_group14),3837(other_group14-2),3931(other_group13_s),**3972(gr-st_name)**,4007(other_group15),60419(other_group16),61055(other_group17),61115(other_group18),61123(other_group19),61127(other_group20),147910(pgr-other_username)
$ groups
pgr-other_username other_group8 other_group9 other_group1 other_group2 other_group3 other_group4 other_group5 other_group6 other_group7 other_group10 other_group11 other_group12 other_group1_d other_group13 other_group14 other_group14-2 other_group13_s **gr-st_name** other_group15 other_group16 other_group17 other_group18 other_group19 other_group20
关于 SELinux,他有:
$ cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted
至于为什么他要用自己的名字来苏,那只不过是一种退团的方式,留在原地而已。
一些新的和可能有趣的信息。即使用户总是使用其他用户名登录后,还存在另一个也属于他的帐户:yet_another_username。如果我finger
对它们执行上述操作,它们都会提供完全相同的信息(就像它们是同步的一样):
$ finger other_username
Login: other_username Name: some_email_address
Directory: /home/other_username Shell: /bin/bash
On since Fri Jul 28 10:34 (CEST) on pts/36 from some_machine
48 minutes 30 seconds idle
On since Fri Jul 28 09:36 (CEST) on pts/82 from some_other_machine
19 minutes 49 seconds idle
On since Fri Jul 28 10:35 (CEST) on pts/150 from localhost:28.0
47 minutes 53 seconds idle
On since Fri Jul 28 10:39 (CEST) on pts/170 from localhost:28.0
44 minutes 25 seconds idle
(messages off)
No mail.
No Plan.
$ finger yet_another_username
Login: other_username Name: some_email_address
Directory: /home/other_username Shell: /bin/bash
On since Fri Jul 28 10:34 (CEST) on pts/36 from some_machine
48 minutes 46 seconds idle
On since Fri Jul 28 09:36 (CEST) on pts/82 from some_other_machine
20 minutes 5 seconds idle
On since Fri Jul 28 10:35 (CEST) on pts/150 from localhost:28.0
48 minutes 9 seconds idle
On since Fri Jul 28 10:39 (CEST) on pts/170 from localhost:28.0
44 minutes 41 seconds idle
(messages off)
No mail.
No Plan.
答案1
组数限制为 16 个,超过此限制,NFS 就无法判断您是否属于该组,而我们正在查看的组是第 18 个组,因此出现了问题。
由于我们不是该系统的 root 权限用户,因此我们无法执行如下操作rpc.mountd -g
(请参见此处http://www.xkyle.com/solving-the-nfs-16-group-limit-problem/) 或者usermod
。
因此,我们可以使用不太美观但实用的解决方案,newgrp
将其放在.bashrc