Controlling Access to Files
The Solaris OS is a multiuser environment. In a multiuser environment, all the
users who are logged in to a system can read files that
belong to other users. With the appropriate file permissions, users can also use
files that belong to other users. For more discussion, see Chapter 7, Controlling Access to Files (Tasks). For step-by-step instructions
on setting appropriate permissions on files, see Protecting Files (Task Map).
Protecting Files With Encryption
You can keep a file secure by making the file inaccessible to
other users. For example, a file with permissions of 600 cannot be read except
by its owner and by superuser. A directory with permissions of 700 is
similarly inaccessible. However, someone who guesses your password or who discovers the root
password can access that file. Also, the otherwise inaccessible file is preserved on a
backup tape every time that the system files are backed up to
The Solaris Cryptographic Framework provides digest, mac, and encrypt commands to protect files. For
more information, see Chapter 13, Solaris Cryptographic Framework (Overview).
Using Access Control Lists
ACLs, pronounced “ackkls,” can provide greater control over file permissions. You add ACLs
when traditional UNIX file protections are not sufficient. Traditional UNIX file protections provide
read, write, and execute permissions for the three user classes: owner, group, and
other. An ACL provides finer-grained file security.
ACLs enable you to define the following file permissions:
Owner file permissions
File permissions for the owner's group
File permissions for other users who are outside the owner's group
File permissions for specific users
File permissions for specific groups
Default permissions for each of the previous categories
For more information about using ACLs, see Using Access Control Lists to Protect Files.
Sharing Files Across Machines
A network file server can control which files are available for sharing. A
network file server can also control which clients have access to the files,
and what type of access is permitted for those clients. In general, the
file server can grant read-write access or read-only access either to all clients
or to specific clients. Access control is specified when resources are made available
with the share command.
The /etc/dfs/dfstab file on the file server lists the file systems that
the server makes available to clients on the network. For more information about
sharing file systems, see Automatic File-System Sharing in System Administration Guide: Network Services.
Restricting root Access to Shared Files
In general, superuser is not allowed root access to file systems that are
shared across the network. The NFS system prevents root access to mounted
file systems by changing the user of the requester to the user nobody
with the user ID 60001. The access rights of user nobody are the
same as those access rights that are given to the public. The user
nobody has the access rights of a user without credentials. For example, if
the public has only execute permission for a file, then user nobody can only
execute that file.
An NFS server can grant superuser capabilities on a shared file system on
a per-host basis. To grant these privileges, use the root=hostname option to
the share command. You should use this option with care. For a discussion
of security options with NFS, see Chapter 6, Accessing Network File Systems (Reference), in System Administration Guide: Network Services.