List/table of linux permissions

# ssh-copy-id takes care of adding your key in the right place

ssh-copy-id -i "user@hostname.example.com -p2222"

# If you don't use -i all of your public keys will be copied over.
# Also a alias for the host can be used if configured in your ssh config.

# You will be asked for the password and after that all should be taken care of.

# Create user with access only to specific directory

adduser --home /restricted/directory restricted_user

# Make user owner of directory and grant write access

chown restricted_user:user_group /restricted/directory
chmod 755 /restricted/directory

# Check if 'webmasters' group exist

cat /etc/group | grep webmasters

# Create 'webmasters' group

sudo addgroup webmasters

# Add users to 'webmasters' group

sudo usermod -a -G webmasters username

# Group assignment changes won't take effect
# until the users log out and back in.


# Change group owner of the directory to webmaster user

sudo chgrp -R webmasters /etc/nginx/
  
# Give write permission to the group

sudo chmod -R g+w /etc/nginx/
  
# Create file as different user

sudo -u username touch /etc/nginx/test.txt

# When using a number mask for permission representation there are only a few basic permissions

4: Read
2: Write
1: Execute

# Combined you get this table

+-----+---+--------------------------+
| rwx | 7 | Read, write and execute  |
| rw- | 6 | Read, write              |
| r-x | 5 | Read, and execute        |
| r-- | 4 | Read,                    |
| -wx | 3 | Write and execute        |
| -w- | 2 | Write                    |
| --x | 1 | Execute                  |
| --- | 0 | no permissions           |
+------------------------------------+
  
# The permissions for user, group and other are listet after each other when looking them up

+------------+------+-------+
| Permission | Octal| Field |
+------------+------+-------+
| rwx------  | 700  | User  |
| ---rwx---  | 070  | Group |
| ------rwx  | 007  | Other |
+------------+------+-------+
  
# This boils down to this
  
  +------------------------+-----------+
| chmod u=rwx,g=rwx,o=rx | chmod 775 | For world readable directories
|                        |           |   Members of group can change files
| chmod u=rwx,g=rx,o=    | chmod 750 | For group readable directories
|                        |           |   Members of group can change files
| chmod u=rwx,go=        | chmod 700 | For private direcories
+------------------------+-----------+

private fun askPermissions(){
        Dexter.withContext(this)
                .withPermissions(
                        Manifest.permission.ACCESS_FINE_LOCATION,
                        Manifest.permission.ACCESS_COARSE_LOCATION
                )
                .withListener(object : MultiplePermissionsListener {
                    override fun onPermissionsChecked(report: MultiplePermissionsReport?) {
                        if (report!!.areAllPermissionsGranted()) {
                            // TODO (STEP 7: Call the location request function here.)
                        }

                        if (report.isAnyPermissionPermanentlyDenied) {
                            Toast.makeText(
                                    this@MainActivity,
                                    "You have denied location permission. Please allow it is mandatory.",
                                    Toast.LENGTH_SHORT
                            ).show()
                        }
                    }

                    override fun onPermissionRationaleShouldBeShown(
                            permissions: MutableList<PermissionRequest>?,
                            token: PermissionToken?
                    ) {
                        showRationalDialogForPermissions()
                    }
                }).onSameThread()
                .check()

    }

# Deal with sudo authentication errors on back up
# two write permissions errors on backup restore:
# 1. check chown and chmod of sudo 
# 2. sudo: /usr/bin/sudo must be owned by uid 0 
# 3. and have the setuid bit set

# 1. sudo ownership
chown root:root /usr/bin/sudo && chmod 4755 /usr/bin/sudo

# 2. UID ownership
grep root /etc/passwd
# the default root should be set to:
# root:x:0:0:root:/root:/bin/bash
# if not sudoedit as above.

# 3. setuid bit
# check /usr/bin for setuid bit errors (vs. clean normal installation of distro)
# (for debian 11) incorrect configuration includes su and sudo and 8 other executables
# Incorrect format is (compare first 4 permsissions) 
# -rwxr-xr-x 1 root root 179K Feb 27 2021 sudo
# correct format is 
# -rwsr-xr-x 1 root root 182600 Feb 27  2021 /usr/bin/sudo
# prefer pkexec to nake changes 
pkexec chmod a=rx,u+ws /usr/bin/sudo
pkexec chmod a=rx,u+ws /usr/bin/su
# compare vs. a unmodified fresh virtual install of your system
# in Debian 11 8 further files need modifying

# bonus. on your way out check permissing in  /usr/lib/sudo/ and compare with base install.

# In Crosh
# Ctrl + Alt + t
vmc start termina
 lxc launch ubuntu:18.04 owo
  lxc file pull owo/usr/bin/lxc /tmp/lxc
  lxc file push /tmp/lxc penguin/usr/local/bin/
  lxc delete owo -f
  lxc config set core.https_address :8443
  lxc config set core.trust_password "a'really,good;password:^)"

# in container terminal
  lxc remote add chronos $(ip route show | awk '{print $3}' | head -n 1)
  lxc remote set-default chronos

# have fun
lxc exec container_name -- bash