UNIX Tutorial Five

5.1 File system security (access permissions)

In your unixstuff directory, type

% ls -l

You will see that you now get lots of details about the contents of your directory, similar to the example below.

% ls -l
total 8384
-rw-rw-r-- 1 smith students 3764489 Jun 29 02:00 box_turtle.jpg
-rw-rw-r-- 1 smith students 4805803 Jun 24 23:21 eastern_phoebe.jpg
-rw-r--r-- 1 smith students 7767 Jun 29 01:55 science.txt
drwxrwxr-x 2 smith students 4096 Jun 29 09:19 telescopes

Each line in the list starts with a group of 10 characters. If the first character, is a 'd, then the line describes a directory. If the first character is a '-', then the line describes an ordinary file. The next 9 characters describe a set of access permissions associated with the file or directory listed.

Permissions for Files

The 9 characters are organized in groups of 3 character. Within each group of 3 characters:

The letters will always appear in the order rwx. If a permission is not granted, then a '-' character appears in the corresponding position. For example, the string r-- indicates permission to read only.

The three groups of characters refer to the owner, group, and anyone respectively. UNIX supports the concept of groups to facilitate collaboration. Each group is simply a list of users as specified in the system's configuration. For many systems, the definitions of the system's groups is found in the file /etc/groups. Depending on a system's configuration, a system may ignore the file /etc/groups and receive it's group information from a server running an information service such as LDAP.

In the example above, the file science.txt can be both read and written by the file owner. Notice the file owner does not have permission to execute the file; that's a good thing because the file science.txt does not contain executable code. Group members and other users have permission to read the file, but not to change (write) nor run it as if it were a program (execute).

Permissions for Directories

So, in order to read a file, you must have execute permission on the directory containing that file, and hence on any directory containing that directory as a subdirectory, and so on, up the tree.

Some examples

-rwxrwxrwx a file that everyone can read, write and execute (and delete).
-rw------- a file that only the owner can read and write - no-one else
can read or write and no-one has execution permission (e.g. your
mailbox file).

Other Information Provided by ls -l

After the 10 character field describing permissions, we see several other bits of information. For example, consider the file named science.txt:

-rw-r--r-- 1 smith students 7767 Jun 29 10:42 science.txt

The information provided indicates:


5.2 Changing access permissions

chmod (changing a file mode)

Only the owner of a file can use chmod to change the permissions of a file. The options of chmod are as follows

Symbol Meaning
u
user
g
group
o
other
a
all
r
read
w
write (and delete)
x
execute (and access directory)
+
add permission
-
take away permission

For example, to remove read write and execute permissions on the file biglist for the group and others, type

% chmod go-rwx biglist

This will leave the other permissions unaffected.

To give read and write permissions on the file biglist to all,

% chmod a+rw biglist

Exercise 5a

Try changing access permissions on the file science.txt and on the directory backups

Use ls -l to check that the permissions have changed.

5.3 Processes and Jobs

A process is an executing program identified by a unique PID (process identifier). To see information about your processes, with their associated PID and status, type

% ps

A process may be in the foreground, in the background, or be suspended. In general the shell does not return the UNIX prompt until the current process has finished executing.

Some processes take a long time to run and hold up the terminal. Backgrounding a long process has the effect that the UNIX prompt is returned immediately, and other tasks can be carried out while the original process continues executing.

Running background processes

To background a process, type an & at the end of the command line. For example, the command sleep waits a given number of seconds before continuing. Type

% sleep 10

This will wait 10 seconds before returning the command prompt %. Until the command prompt is returned, you can do nothing except wait.

To run sleep in the background, type

% sleep 10 &

[1] 6259

The & runs the job in the background and returns the prompt straight away, allowing you do run other programs while waiting for that one to finish.

The first line in the above example is typed in by the user; the next line, indicating job number and PID, is returned by the machine. The user is be notified of a job number (numbered from 1) enclosed in square brackets, together with a PID and is notified when a background process is finished. Backgrounding is useful for jobs which will take a long time to complete.

Backgrounding a current foreground process

At the prompt, type

% sleep 100

You can suspend the process running in the foreground by holding down the [control] key and typing [z] (written as ^Z) Then to put it in the background, type

% bg

Note: do not background programs that require user interaction e.g. pine

5.4 Listing suspended and background processes

When a process is running, backgrounded or suspended, it will be entered onto a list along with a job number. To examine this list, type

% jobs

An example of a job list could be

[1] Suspended sleep 100
[2] Running netscape
[3] Running nedit

To restart (foreground) a suspended processes, type

% fg %jobnumber

For example, to restart sleep 100, type

% fg %1

Typing fg with no job number foregrounds the last suspended process.

5.5 Killing a process

kill (terminate or signal a process)

It is sometimes necessary to kill a process (for example, when an executing program is in an infinite loop)

To kill a job running in the foreground, type ^C (control c). For example, run

% sleep 100
^C

To kill a suspended or background process, type

% kill %jobnumber

For example, run

% sleep 100 &
% jobs

If it is job number 4, type

% kill %4

To check whether this has worked, examine the job list again to see if the process has been removed.

ps (process status)

Alternatively, processes can be killed by finding their process numbers (PIDs) and using kill PID_number

% sleep 100 &
% ps

PID TT S TIME COMMAND
20077 pts/5 S 0:05 sleep 100
21563 pts/5 T 0:00 netscape
21873 pts/5 S 0:25 nedit

To kill off the process sleep 100, type

% kill 20077

and then type ps again to see if it has been removed from the list.

If a process refuses to be killed, uses the -9 option, i.e. type

% kill -9 20077

Note: It is not possible to kill off other users' processes !!!

5.6 Unix Signals

Unix supports the concept of sending a signal to a process. The basic idea is that we can interrupt a running process and assert immediate control over that process. There are 19 different types of signals, each of which can be specified either by signal name, or by signal number. The kill command can be used to send any type of signal, but by default it sends the SIGTERM (terminate) signal. It is beyond the scope of this tutorial to cover all of signals in detail; we mention just a few types.

Some signals are generated by the CPU when certain computational conditions arise. For example, division by zero will result in the delivery of a SIGFPE signal, to indicate a floating point exception has occurred. Other types of signals such as SIGSTOP or SIGTERM are usually generated from the user's keyboard to control a process.

A programmer can setup a signal handler for some types of signals (including SIGFPE and SIGTERM); a signal handler is a special function that will be called in the event that a particular signal is delivered to the process. A programmer can write an application so that it handles or corrects errors when they arise at run-time, and subsequently continues normal operation. Text editors, for example, need to catch the SIGTERM signal, so that work-in-progress can be saved to permanent storage before the editor exits.

A programmer can also write his application so that it blocks or ignores certain types signals.

The SIGTERM signal can be caught or blocked, thus creating the possibility that a rogue process could refuse to die. To prevent the possibility of a process that can not be controlled, the SIGKILL signal is specially designated so that it can not be caught, blocked, or ignored. SIGKILL unambiguously terminates a process; the number associated with the SIGKILL signal is 9. That's why:

% kill -9 20077

will kill process number 20077 without exception. The option -9 specifies that SIGKILL is sent.

Summary

ls -al list access permissions for all files
chmod [options] file change access permissions for named file
command & run command in background
^C kill the job running in the foreground
^Z suspend the job running in the foreground
bg background the suspended job
jobs list current jobs
fg %1 foreground job number 1
kill %1 kill job number 1
ps list current processes
kill 26152 kill process number 26152

Continue with the Tutorial

 

M.Stonebank@surrey.ac.uk, 9th October 2000