# 1. 检查777权限文件
# find / -perm 777 -type f -ls 2>/dev/null | head -n 10
（输出777权限的文件）

# 2. 检查可写文件
# find /etc -perm -002 -type f -ls
（输出其他用户可写的文件）

# 3. 检查SUID程序
# find /usr -perm -4000 -type f -ls
1234567 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/sudo
1234568 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/passwd
1234569 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/su

# 4. 检查SGID程序
# find /usr -perm -2000 -type f -ls
1234570 12 -rwxr-sr-x 1 root mail 12345 Apr 2 10:00 /usr/bin/wall

# 5. 检查无主文件
# find /home -nouser -o -nogroup -ls
（输出无主文件）

# 6. 检查可执行文件权限
# find /usr/bin -perm -111 -type f -ls | head -n 10
（输出可执行文件）

# 7. 检查敏感文件权限
# ls -l /etc/shadow /etc/gshadow /etc/ssh/sshd_config
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/gshadow
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/shadow
-rw——-. 1 root root root 1234 Apr 2 10:00 /etc/ssh/sshd_config

# 8. 修复敏感文件权限
# chmod 600 /etc/shadow
# chmod 600 /etc/gshadow
# chmod 600 /etc/ssh/sshd_config

# 9. 检查目录权限
# find /var -type d -perm -002 -ls
（输出其他用户可写的目录）

# 10. 检查隐藏文件权限
# find /home -name “.*” -type f -ls | head -n 10
（输出隐藏文件权限）

# 1. 创建权限审计脚本
# cat > /tmp/permission_audit.sh << 'EOF' #!/bin/bash REPORT="/tmp/permission_audit_report.txt" echo "========================================" > $REPORT
echo “Permission Audit Report – $(date)” >> $REPORT
echo “========================================” >> $REPORT
echo “” >> $REPORT

# 1. 检查777权限文件
echo “1. Files with 777 Permission” >> $REPORT
echo “—————————–” >> $REPORT
find / -perm 777 -type f -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 2. 检查可写文件
echo “2. World-Writable Files” >> $REPORT
echo “————————” >> $REPORT
find /etc -perm -002 -type f -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 3. 检查SUID程序
echo “3. SUID Programs” >> $REPORT
echo “—————–” >> $REPORT
find /usr -perm -4000 -type f -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 4. 检查SGID程序
echo “4. SGID Programs” >> $REPORT
echo “—————–” >> $REPORT
find /usr -perm -2000 -type f -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 5. 检查无主文件
echo “5. Unowned Files” >> $REPORT
echo “—————–” >> $REPORT
find /home -nouser -o -nogroup -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 6. 检查敏感文件权限
echo “6. Sensitive File Permissions” >> $REPORT
echo “——————————” >> $REPORT
ls -l /etc/shadow /etc/gshadow /etc/ssh/sshd_config >> $REPORT
echo “” >> $REPORT

# 7. 检查可写目录
echo “7. World-Writable Directories” >> $REPORT
echo “——————————” >> $REPORT
find /var -type d -perm -002 -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 8. 检查执行权限文件
echo “8. Executable Files in /tmp” >> $REPORT
echo “—————————” >> $REPORT
find /tmp -type f -perm -111 -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

echo “Audit completed. Report saved to $REPORT”
EOF

# 2. 执行审计脚本
# chmod +x /tmp/permission_audit.sh
# /tmp/permission_audit.sh
Audit completed. Report saved to /tmp/permission_audit_report.txt

# 3. 查看审计报告
# cat /tmp/permission_audit_report.txt
========================================
Permission Audit Report – Fri Apr 2 10:00:00 CST 2026
========================================

1. Files with 777 Permission
—————————–

2. World-Writable Files
————————

3. SUID Programs
—————–
1234567 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/sudo
1234568 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/passwd
1234569 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/su

4. SGID Programs
—————–
1234570 12 -rwxr-sr-x 1 root mail 12345 Apr 2 10:00 /usr/bin/wall

5. Unowned Files
—————–

6. Sensitive File Permissions
——————————
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/gshadow
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/shadow
-rw——-. 1 root root root 1234 Apr 2 10:00 /etc/ssh/sshd_config

7. World-Writable Directories
——————————

8. Executable Files in /tmp
—————————

# 1. 设置文件权限为644
# touch file.txt
# chmod 644 file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 2. 设置文件权限为755
# chmod 755 file.txt
# ls -l file.txt
-rwxr-xr-x. 1 root root 0 Apr 2 10:00 file.txt

# 3. 设置文件权限为600
# chmod 600 file.txt
# ls -l file.txt
-rw——-. 1 root root 0 Apr 2 10:00 file.txt

# 4. 设置文件权限为700
# chmod 700 file.txt
# ls -l file.txt
-rwx——. 1 root root 0 Apr 2 10:00 file.txt

# 5. 设置目录权限为755
# mkdir dir1
# chmod 755 dir1
# ls -ld dir1
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir1

# 6. 设置目录权限为775
# chmod 775 dir1
# ls -ld dir1
drwxrwxr-x. 2 root root 6 Apr 2 10:00 dir1

# 7. 设置SUID权限
# cp /bin/cat /tmp/mycat
# chmod 4755 /tmp/mycat
# ls -l /tmp/mycat
-rwsr-xr-x. 1 root root 12345 Apr 2 10:00 /tmp/mycat

# 8. 设置SGID权限
# mkdir /tmp/shared
# chmod 2775 /tmp/shared
# ls -ld /tmp/shared
drwxrwsr-x. 2 root root 6 Apr 2 10:00 /tmp/shared

# 9. 设置SBIT权限
# chmod 1777 /tmp/test
# ls -ld /tmp/test
drwxrwxrwt. 2 root root 6 Apr 2 10:00 /tmp/test

# 10. 递归修改目录权限
# mkdir -p /tmp/test/{dir1,dir2,dir3}
# touch /tmp/test/{file1,file2,file3}
# chmod -R 755 /tmp/test
# ls -lR /tmp/test
/tmp/test:
total 0
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir1
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir2
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir3
-rwxr-xr-x. 1 root root 0 Apr 2 10:00 file1
-rwxr-xr-x. 1 root root 0 Apr 2 10:00 file2
-rwxr-xr-x. 1 root root 0 Apr 2 10:00 file3

# 11. 批量修改文件权限
# touch /tmp/{file1,file2,file3}.txt
# chmod 644 /tmp/file*.txt
# ls -l /tmp/file*.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 /tmp/file1.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 /tmp/file2.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 /tmp/file3.txt

# 12. 修改多个文件权限
# chmod 755 file1.txt file2.txt file3.txt

# 13. 使用变量设置权限
# PERM=644
# chmod $PERM file.txt

# 14. 查看权限数字
# stat -c “%a %n” file.txt
644 file.txt

# 15. 复制权限
# chmod –reference=/etc/passwd file.txt
# ls -l file.txt /etc/passwd
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt
-rw-r–r–. 1 root root 1234 Apr 2 10:00 /etc/passwd

# 符号说明：
# u – 所有者（user）
# g – 所属组（group）
# o – 其他用户（other）
# a – 所有用户（all）

# + – 添加权限
# – – 移除权限
# = – 设置权限

# 1. 为所有者添加执行权限
# touch file.txt
# chmod u+x file.txt
# ls -l file.txt
-rwxr–r–. 1 root root 0 Apr 2 10:00 file.txt

# 2. 为所属组添加写权限
# chmod g+w file.txt
# ls -l file.txt
-rwxrw-r–. 1 root root 0 Apr 2 10:00 file.txt

# 3. 为其他用户移除读权限
# chmod o-r file.txt
# ls -l file.txt
-rwxrw—-. 1 root root 0 Apr 2 10:00 file.txt

# 4. 为所有用户添加执行权限
# chmod a+x file.txt
# ls -l file.txt
-rwxrwx–x. 1 root root 0 Apr 2 10:00 file.txt

# 5. 设置所有者权限为读写执行
# chmod u=rwx file.txt
# ls -l file.txt
-rwxrwx–x. 1 root root 0 Apr 2 10:00 file.txt

# 6. 设置所属组权限为读写
# chmod g=rw file.txt
# ls -l file.txt
-rwxrw—x. 1 root root 0 Apr 2 10:00 file.txt

# 7. 设置其他用户权限为只读
# chmod o=r file.txt
# ls -l file.txt
-rwxrw-r–. 1 root root 0 Apr 2 10:00 file.txt

# 8. 同时设置多组权限
# chmod u=rwx,g=rx,o=r file.txt
# ls -l file.txt
-rwxr-xr–. 1 root root 0 Apr 2 10:00 file.txt

# 9. 移除所有用户的执行权限
# chmod a-x file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 10. 添加SUID权限
# chmod u+s file.txt
# ls -l file.txt
-rwSr–r–. 1 root root 0 Apr 2 10:00 file.txt

# 11. 添加SGID权限
# chmod g+s file.txt
# ls -l file.txt
-rwSr-Sr–. 1 root root 0 Apr 2 10:00 file.txt

# 12. 添加SBIT权限
# chmod o+t dir1
# ls -ld dir1
drwxr-xr-t. 2 root root 6 Apr 2 10:00 dir1

# 13. 移除SUID权限
# chmod u-s file.txt
# ls -l file.txt
-rw-r-Sr–. 1 root root 0 Apr 2 10:00 file.txt

# 14. 移除SGID权限
# chmod g-s file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 15. 移除SBIT权限
# chmod o-t dir1
# ls -ld dir1
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir1

# 16. 递归修改目录权限
# mkdir -p /tmp/test/{dir1,dir2}
# touch /tmp/test/{file1,file2}
# chmod -R u+rwX,go+rX /tmp/test
# ls -lR /tmp/test
/tmp/test:
total 0
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir1
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir2
-rw-r–r–. 1 root root 0 Apr 2 10:00 file1
-rw-r–r–. 1 root root 0 Apr 2 10:00 file2

# 17. 使用X权限（只对目录或已有执行权限的文件添加执行权限）
# chmod a+X file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 对目录添加执行权限
# chmod a+X dir1
# ls -ld dir1
drwxr-xr-x. 2 root root 6 Apr 2 10:00 dir1

# 18. 复制权限
# chmod –reference=/etc/passwd file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 19. 批量修改权限
# find /tmp -name “*.txt” -exec chmod 644 {} \;

# 20. 组合使用数字和符号
# chmod 644 file.txt
# chmod u+x file.txt
# ls -l file.txt
-rwxr–r–. 1 root root 0 Apr 2 10:00 file.txt

# 1. 递归修改权限（目录和文件分开处理）
# mkdir -p /tmp/app/{bin,conf,logs,data}
# touch /tmp/app/bin/{app.sh,run.sh}
# touch /tmp/app/conf/{app.conf,db.conf}

# 目录设置为755
# find /tmp/app -type d -exec chmod 755 {} \;

# 文件设置为644
# find /tmp/app -type f -exec chmod 644 {} \;

# 脚本文件设置为755
# find /tmp/app/bin -type f -exec chmod 755 {} \;

# 配置文件设置为600
# find /tmp/app/conf -type f -exec chmod 600 {} \;

# 验证权限
# ls -lR /tmp/app
/tmp/app:
total 0
drwxr-xr-x. 2 root root 6 Apr 2 10:00 bin
drwxr-xr-x. 2 root root 6 Apr 2 10:00 conf
drwxr-xr-x. 2 root root 6 Apr 2 10:00 data
drwxr-xr-x. 2 root root 6 Apr 2 10:00 logs

/tmp/app/bin:
total 0
-rwxr-xr-x. 1 root root 0 Apr 2 10:00 app.sh
-rwxr-xr-x. 1 root root 0 Apr 2 10:00 run.sh

/tmp/app/conf:
total 0
-rw——-. 1 root root 0 Apr 2 10:00 app.conf
-rw——-. 1 root root 0 Apr 2 10:00 db.conf

# 2. 批量修改权限（使用xargs）
# find /tmp -name “*.log” | xargs chmod 644

# 3. 修改权限并保留特殊权限
# chmod 4755 /tmp/app/bin/app.sh
# ls -l /tmp/app/bin/app.sh
-rwsr-xr-x. 1 root root 0 Apr 2 10:00 /tmp/app/bin/app.sh

# 4. 使用ACL设置精细权限
# setfacl -m u:fgedu:rwx /tmp/app/conf/app.conf
# getfacl /tmp/app/conf/app.conf
# file: tmp/app/conf/app.conf
# owner: root
# group: root
user::rw-
user:fgedu:rwx
group::—
mask::rwx
other::—

# 5. 批量设置ACL权限
# setfacl -R -m g:developers:rwx /tmp/app

# 6. 移除ACL权限
# setfacl -b /tmp/app/conf/app.conf

# 7. 检查权限变更
# 使用auditd监控权限变更
# auditctl -w /etc/passwd -p wa -k passwd_changes

# 查看审计日志
# ausearch -k passwd_changes

# 8. 批量修复权限
# cat > /tmp/fix_permissions.sh << 'EOF' #!/bin/bash # 修复系统文件权限 chmod 644 /etc/passwd chmod 600 /etc/shadow chmod 644 /etc/group chmod 600 /etc/gshadow chmod 600 /etc/ssh/sshd_config # 修复目录权限 find /var/log -type d -exec chmod 755 {} \; find /var/log -type f -exec chmod 644 {} \; # 修复临时目录权限 chmod 1777 /tmp chmod 1777 /var/tmp echo "Permissions fixed" EOF # 9. 权限模板应用 # cat > /tmp/apply_permission_template.sh << 'EOF' #!/bin/bash TEMPLATE_DIR="/tmp/template" TARGET_DIR="/tmp/app" # 应用权限模板 find $TEMPLATE_DIR -printf "%P\n" | while read file; do if [ -e "$TARGET_DIR/$file" ]; then chmod --reference="$TEMPLATE_DIR/$file" "$TARGET_DIR/$file" echo "Applied permission to $TARGET_DIR/$file" fi done EOF # 10. 权限备份和恢复 # 备份权限 # getfacl -R /tmp/app > /tmp/app_permissions.acl

# 恢复权限
# setfacl –restore=/tmp/app_permissions.acl

# 1. 批量设置Web目录权限
# cat > /tmp/setup_web_permissions.sh << 'EOF' #!/bin/bash WEB_ROOT="/var/www/html" # 设置目录权限 find $WEB_ROOT -type d -exec chmod 755 {} \; # 设置文件权限 find $WEB_ROOT -type f -exec chmod 644 {} \; # 设置上传目录权限 find $WEB_ROOT/uploads -type d -exec chmod 775 {} \; find $WEB_ROOT/uploads -type f -exec chmod 664 {} \; # 设置配置文件权限 find $WEB_ROOT -name "*.conf" -exec chmod 640 {} \; # 设置脚本文件权限 find $WEB_ROOT -name "*.sh" -exec chmod 750 {} \; find $WEB_ROOT -name "*.py" -exec chmod 644 {} \; # 设置缓存目录权限 find $WEB_ROOT/cache -type d -exec chmod 775 {} \; find $WEB_ROOT/cache -type f -exec chmod 664 {} \; # 设置日志目录权限 find $WEB_ROOT/logs -type d -exec chmod 775 {} \; find $WEB_ROOT/logs -type f -exec chmod 664 {} \; echo "Web permissions configured" EOF # 2. 批量设置应用目录权限 # cat > /tmp/setup_app_permissions.sh << 'EOF' #!/bin/bash APP_ROOT="/opt/app" # 创建目录结构 mkdir -p $APP_ROOT/{bin,conf,logs,data,temp} # 设置所有者 chown -R app:app $APP_ROOT # 设置目录权限 find $APP_ROOT -type d -exec chmod 755 {} \; # 设置文件权限 find $APP_ROOT -type f -exec chmod 644 {} \; # 设置脚本执行权限 find $APP_ROOT/bin -type f -exec chmod 755 {} \; # 设置配置文件权限 find $APP_ROOT/conf -type f -exec chmod 600 {} \; # 设置数据目录权限 chmod 750 $APP_ROOT/data # 设置临时目录权限 chmod 750 $APP_ROOT/temp # 设置日志目录权限 chmod 750 $APP_ROOT/logs echo "App permissions configured" EOF # 3. 批量修复用户目录权限 # cat > /tmp/fix_home_permissions.sh << 'EOF' #!/bin/bash for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)

if [ -d “$home_dir” ]; then
# 设置家目录权限
chmod 700 $home_dir

# 设置SSH目录权限
if [ -d “$home_dir/.ssh” ]; then
chmod 700 $home_dir/.ssh
chmod 600 $home_dir/.ssh/authorized_keys
chmod 600 $home_dir/.ssh/id_rsa
chmod 644 $home_dir/.ssh/id_rsa.pub
chmod 644 $home_dir/.ssh/known_hosts
fi

# 设置其他敏感文件权限
if [ -f “$home_dir/.bash_history” ]; then
chmod 600 $home_dir/.bash_history
fi

echo “Fixed permissions for $user”
fi
done
EOF

# 4. 批量设置共享目录权限
# cat > /tmp/setup_shared_permissions.sh << 'EOF' #!/bin/bash SHARED_DIR="/shared" # 创建共享目录 mkdir -p $SHARED_DIR/{projectA,projectB,projectC} # 设置SGID权限（新文件继承组） find $SHARED_DIR -type d -exec chmod 2775 {} \; # 设置组所有权 chown -R root:developers $SHARED_DIR/projectA chown -R root:ops $SHARED_DIR/projectB chown -R root:dba $SHARED_DIR/projectC # 设置文件权限 find $SHARED_DIR -type f -exec chmod 664 {} \; echo "Shared permissions configured" EOF # 5. 批量设置临时文件清理权限 # cat > /tmp/cleanup_temp_permissions.sh << 'EOF' #!/bin/bash # 清理临时文件 find /tmp -type f -mtime +7 -exec rm -f {} \; find /var/tmp -type f -mtime +30 -exec rm -f {} \; # 修复临时目录权限 chmod 1777 /tmp chmod 1777 /var/tmp # 清理空目录 find /tmp -type d -empty -delete find /var/tmp -type d -empty -delete echo "Temp cleanup completed" EOF

# 1. 系统文件权限加固
# cat > /tmp/harden_system_permissions.sh << 'EOF' #!/bin/bash echo "Hardening system permissions..." # 修复关键系统文件权限 chmod 644 /etc/passwd chmod 600 /etc/shadow chmod 644 /etc/group chmod 600 /etc/gshadow chmod 644 /etc/services chmod 600 /etc/ssh/sshd_config chmod 600 /etc/ssh/ssh_config # 修复系统目录权限 chmod 755 /bin /sbin /usr/bin /usr/sbin chmod 755 /etc /var /usr # 修复日志目录权限 chmod 755 /var/log find /var/log -type f -exec chmod 640 {} \; # 修复临时目录权限 chmod 1777 /tmp /var/tmp # 移除不必要的SUID/SGID chmod -s /usr/bin/wall chmod -s /usr/bin/write # 检查并修复 echo "System permissions hardened" EOF # 2. 检查并移除危险权限 # cat > /tmp/remove_dangerous_permissions.sh << 'EOF' #!/bin/bash # 查找并移除777权限 find / -perm 777 -type f -exec chmod 755 {} \; 2>/dev/null

# 查找并移除其他用户可写文件
find /etc -perm -002 -type f -exec chmod o-w {} \; 2>/dev/null

# 查找并移除其他用户可写目录
find /etc -perm -002 -type d -exec chmod o-w {} \; 2>/dev/null

# 查找并移除无主文件
find /home -nouser -exec chown root:root {} \; 2>/dev/null
find /home -nogroup -exec chgrp root {} \; 2>/dev/null

echo “Dangerous permissions removed”
EOF

# 3. 应用安全权限模板
# cat > /tmp/apply_security_template.sh << 'EOF' #!/bin/bash # 定义安全权限模板 declare -A PERMISSIONS=( ["/etc/passwd"]="644" ["/etc/shadow"]="600" ["/etc/group"]="644" ["/etc/gshadow"]="600" ["/etc/ssh/sshd_config"]="600" ["/etc/ssh/ssh_config"]="644" ["/etc/crontab"]="600" ["/etc/cron.d"]="700" ["/etc/cron.daily"]="700" ["/etc/cron.hourly"]="700" ["/etc/cron.monthly"]="700" ["/etc/cron.weekly"]="700" ) for file in "${!PERMISSIONS[@]}"; do if [ -e "$file" ]; then chmod ${PERMISSIONS[$file]} "$file" echo "Set ${PERMISSIONS[$file]} on $file" fi done echo "Security template applied" EOF # 4. 检查SUID/SGID程序 # cat > /tmp/check_suid_sgid.sh << 'EOF' #!/bin/bash REPORT="/tmp/suid_sgid_report.txt" echo "SUID/SGID Programs Report - $(date)" > $REPORT
echo “========================================” >> $REPORT

echo “” >> $REPORT
echo “SUID Programs:” >> $REPORT
find /usr -perm -4000 -type f -ls >> $REPORT

echo “” >> $REPORT
echo “SGID Programs:” >> $REPORT
find /usr -perm -2000 -type f -ls >> $REPORT

echo “” >> $REPORT
echo “SUID+SGID Programs:” >> $REPORT
find /usr -perm -6000 -type f -ls >> $REPORT

echo “Report saved to $REPORT”
EOF

# 5. 完整权限安全加固
# cat > /tmp/full_permission_hardening.sh << 'EOF' #!/bin/bash echo "Starting full permission hardening..." # 1. 系统文件权限加固 ./harden_system_permissions.sh # 2. 移除危险权限 ./remove_dangerous_permissions.sh # 3. 应用安全模板 ./apply_security_template.sh # 4. 检查SUID/SGID ./check_suid_sgid.sh echo "Full permission hardening completed" EOF # chmod +x /tmp/full_permission_hardening.sh # /tmp/full_permission_hardening.sh

# 案例1：用户无法访问文件
# 症状：用户提示”Permission denied”

# 排查步骤：
# 1. 检查文件权限
# ls -l file.txt
-rw——-. 1 root root 1234 Apr 2 10:00 file.txt

# 2. 检查用户身份
# id username
uid=1000(username) gid=1000(username) groups=1000(username)

# 3. 检查文件所有权
# ls -l file.txt | awk ‘{print $3, $4}’
root root

# 解决：修改文件所有权或权限
# chown username:username file.txt
# 或
# chmod 644 file.txt

# 案例2：用户无法执行脚本
# 症状：用户提示”Permission denied”

# 排查步骤：
# 1. 检查文件权限
# ls -l script.sh
-rw-r–r–. 1 root root 1234 Apr 2 10:00 script.sh

# 2. 检查文件类型
# file script.sh
script.sh: Bourne-Again shell script, ASCII text executable

# 解决：添加执行权限
# chmod +x script.sh
# ls -l script.sh
-rwxr-xr-x. 1 root root 1234 Apr 2 10:00 script.sh

# 案例3：用户无法访问目录
# 症状：用户提示”Permission denied”

# 排查步骤：
# 1. 检查目录权限
# ls -ld /app/data
drwxr-x—. 2 root app 4096 Apr 2 10:00 /app/data

# 2. 检查用户组
# id username
uid=1000(username) gid=1000(username) groups=1000(username)

# 解决：添加用户到组或修改目录权限
# gpasswd -a username app
# 或
# chmod 755 /app/data

# 案例4：SUID程序不生效
# 症状：SUID程序执行时权限不提升

# 排查步骤：
# 1. 检查SUID权限
# ls -l /usr/bin/sudo
-rwsr-xr-x. 1 root root 12345 Apr 2 10:00 /usr/bin/sudo

# 2. 检查SELinux上下文
# ls -lZ /usr/bin/sudo
-rwsr-xr-x. 1 root root system_u:object_r:sudo_exec_t:s0 12345 Apr 2 10:00 /usr/bin/sudo

# 3. 检查文件系统挂载选项
# mount | grep “on / ”
/dev/mapper/rhel-root on / type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota)

# 解决：检查是否在nosuid文件系统上
# 重新挂载文件系统
# mount -o remount,suid /

# 案例5：SGID目录不继承组
# 症状：新文件不继承目录组

# 排查步骤：
# 1. 检查目录权限
# ls -ld /shared
drwxrwsr-x. 2 root developers 4096 Apr 2 10:00 /shared

# 2. 检查新文件权限
# touch /shared/test.txt
# ls -l /shared/test.txt
-rw-r–r–. 1 username username 0 Apr 2 10:00 /shared/test.txt

# 解决：检查用户主组
# id username
uid=1000(username) gid=1000(username) groups=1000(username),1001(developers)

# SGID应该生效，检查文件系统
# mount | grep /shared

# 案例6：临时文件被删除
# 症状：/tmp下的文件被其他用户删除

# 排查步骤：
# 1. 检查/tmp权限
# ls -ld /tmp
drwxrwxrwt. 10 root root 4096 Apr 2 10:00 /tmp

# 2. 检查SBIT权限
# stat /tmp | grep “Access: (”
Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root)

# SBIT已设置，检查文件权限
# ls -l /tmp/file.txt
-rw-r–r–. 1 username username 1234 Apr 2 10:00 /tmp/file.txt

# 解决：SBIT只防止删除其他用户的文件，检查是否是同一用户删除

# 案例7：ACL权限不生效
# 症状：ACL设置的权限不生效

# 排查步骤：
# 1. 检查ACL权限
# getfacl file.txt
# file: file.txt
# owner: root
# group: root
user::rw-
user:fgedu:rwx
group::r–
mask::rwx
other::r–

# 2. 检查文件系统是否支持ACL
# tune2fs -l /dev/mapper/rhel-root | grep “Default mount options”
Default mount options: user_xattr acl

# 3. 检查SELinux
# getenforce
Enforcing

# 解决：检查SELinux上下文
# ls -lZ file.txt
-rw-r–r–. 1 root root unconfined_u:object_r:admin_home_t:s0 1234 Apr 2 10:00 file.txt

# 案例8：权限修改失败
# 症状：chmod命令执行失败

# 排查步骤：
# 1. 检查文件系统是否只读
# mount | grep “on / ”
/dev/mapper/rhel-root on / type xfs (ro,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota)

# 解决：重新挂载为读写
# mount -o remount,rw /

# 案例9：特殊权限显示异常
# 症状：SUID/SGID显示为大写S

# 排查步骤：
# 1. 检查文件权限
# ls -l file.txt
-rwSr–r–. 1 root root 1234 Apr 2 10:00 file.txt

# 大写S表示SUID已设置但没有执行权限
# 解决：添加执行权限
# chmod u+x file.txt
# ls -l file.txt
-rwsr–r–. 1 root root 1234 Apr 2 10:00 file.txt

# 案例10：权限继承问题
# 症状：新创建的文件权限不符合预期

# 排查步骤：
# 1. 检查umask
# umask
0022

# 2. 检查默认权限
# touch test.txt
# ls -l test.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 test.txt

# 解决：修改umask
# umask 0002
# touch test2.txt
# ls -l test2.txt
-rw-rw-r–. 1 root root 0 Apr 2 10:00 test2.txt