Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Mail Systems
Eclipse Documentation

How To Guides
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Problem Solutions




NOTE: CentOS Enterprise Linux 5 is built from the Red Hat Enterprise Linux source code. Other than logo and name changes CentOS Enterprise Linux 5 is compatible with the equivalent Red Hat version. This document applies equally to both Red Hat and CentOS Enterprise Linux 5.

26.4. Making Files Accessible From the Console

The default settings for individual device classes and permission definitions are defined in /etc/security/console.perms.d/50-default.perms. To edit file and device permissions, it is advisable to create a new default file in /etc/security/console.perms.d/ containing your preferred settings for a specified set of files or devices. The name of the new default file must begin with a number higher than 50 (for example, 51-default.perms) in order to override 50-default.perms.

To do this, create a new file named 51-default.perms in /etc/security/console.perms.d/:

touch /etc/security/console.perms.d/51-default.perms

Open the original default perms file, 50-default.perms. The first section defines device classes, with lines similar to the following:

<floppy>=/dev/fd[0-1]* \
          /dev/floppy/* /mnt/floppy* 
<sound>=/dev/dsp* /dev/audio* /dev/midi* \         
	  /dev/mixer* /dev/sequencer \         
	  /dev/sound/* /dev/beep \ 	
<cdrom>=/dev/cdrom* /dev/cdroms/* /dev/cdwriter* /mnt/cdrom*

Items enclosed in brackets name the device; in the above example, <cdrom> refers to the CD-ROM drive. To add a new device, do not define it in the default 50-default.perms file; instead, define it in 51-default.perms. For example, to define a scanner, add the following line to 51-default.perms:

<scanner>=/dev/scanner /dev/usb/scanner*

Of course, you must use the appropriate name for the device. Ensure that /dev/scanner is really your scanner and not some other device, such as your hard drive.

Once you have properly defined a device or file, the second step is to specify its permission definitions. The second section of /etc/security/console.perms.d/50-default.perms defines this, with lines similar to the following:

<console> 0660 <floppy> 0660 root.floppy 
<console> 0600 <sound>  0640 root 
<console> 0600 <cdrom>  0600 root.disk

To define permissions for a scanner, add a line similar to the following in 51-default.perms:

<console> 0600 <scanner> 0600 root

Then, when you log in at the console, you are given ownership of the /dev/scanner device with the permissions of 0600 (readable and writable by you only). When you log out, the device is owned by root, and still has the permissions 0600 (now readable and writable by root only).


You must never edit the default 50-default.perms file. To edit permissions for a device already defined in 50-default.perms, add the desired permission definition for that device in 51-default.perms. This will override whatever permissions are defined in 50-default.perms.

  Published under the terms of the GNU General Public License Design by Interspire