Access control and least privilege · 访问控制与最小权限
This page needs a recent browser (with SharedArrayBuffer support). Please update Chrome, Edge, Firefox or Safari to the latest version. · 此页面需较新浏览器（支持 SharedArrayBuffer）。请升级 Chrome、Edge、Firefox 或 Safari 至最新版本。
English
Least privilege
- A core security rule: give every person and program only the access they need — no more.
- If an account is broken into, least privilege means the attacker can reach less.
中文
最小权限
- 一条核心的安全准则:只给每个人和每个程序他们所需要的访问权限 —— 不多给。
- 一旦某个账户被攻破,最小权限意味着攻击者能触及的东西更少。
English
Access control on files
- On Linux, file permissions are access control in action (you met these in the Linux course).
ls -lshows who can read, write, and execute, for the owner, the group, and everyone else.
中文
文件上的访问控制
- 在 Linux 上,文件权限正是访问控制的体现(你在 Linux 课程里见过它们)。
ls -l会显示对所有者、用户组和其他所有人来说,谁可以读(r)、写(w)和执行(x)。
ls -l secret.txt
English
Locking down a secret
- A file holding a password or key should be readable by its owner only.
chmod 600gives the owner read+write, and nothing to anyone else:
6= read+write for the owner;0and0= no access for group and others.
中文
锁定一个机密
- 存放密码或密钥的文件,应当只对它的所有者可读。
chmod 600给所有者读 + 写权限,而对其他任何人什么都不给:
chmod 600 secret.txt
6= 所有者可读 + 可写;两个0= 用户组和其他人没有任何权限。
English
Your turn
- Lock down
secret.txtso only its owner can touch it. Good permissions are a simple, powerful defence.
Covers: A-Level 6.1 (access levels / security measures).
中文
轮到你了
- 锁定
secret.txt,让只有它的所有者才能碰它。良好的权限设置是一种简单而强大的防御。
涵盖:A-Level 6.1(访问级别 / 安全措施)。
English
Common mistakes
- Give each user only the access they need (least privilege).
- Do not use an administrator account for everyday work.
中文
常见错误
- 只给每个用户所需的权限(最小权限)。
- 不要用管理员账户做日常工作。
Explore · 探索
Least privilege · 最小权限
Give each user only the rwx they need — nothing more. · 只给每个用户所需的 rwx——不多给。
secret.txt is currently readable by everyone. Lock it down so only its owner can read and write it, with chmod 600 secret.txt. The check shows ls -l. · secret.txt 目前人人可读。用 chmod 600 secret.txt 把它锁定,让只有所有者能读写它。检查时会显示 ls -l。
Least privilege is not always 600. Your team should read team-notes.txt, but not change it — and outsiders get nothing. Use chmod 640 team-notes.txt (6 = owner read+write, 4 = group read-only, 0 = others none). · 最小权限并不总是 600。你的团队应当能读 team-notes.txt,但不能改 —— 外人则什么都不给。用 chmod 640 team-notes.txt(6 = 所有者读写,4 = 组只读,0 = 其他人无权限)。