Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've set up my very first Ubuntu server and immediately logged in (as myuser) to begin customizing it. I go to /opt and run mkdir sandbox.

mkdir: Cannot create directory 'sandbox' : Permission denied

Permission denied?!? Okay. So I run sudo -i and enter myuser's password. Re-run the mkdir command, and voila! The directory is created. I log out.

I log back in as myuser and navigate to /opt and run ls: nothing! No visible directories inside /opt! What!?!?

So I sudo again with sudo -i and re-run ls. Now it sees sandbox/.

I think I'm missing some fundamental Linux knowledge with respect to users and roots. During the server configuration/installation, it asked me to create a user, which I did (myuser). I assumed this would also be the root user (with full admin privs) since it was not only the user I created during installation, its the very first user in the system!

So why is it that myuser can't:

  • Create directories outside of /home/myuser without sudo-ing?
  • See directories created when in "sudo mode"

I'm also vague on the difference between sudo, su and the root user.

Ultimately, in addition to fully understanding these basics, I'd like to have a bunch of server software installed under /opt/sandbox/ that can be running around the clock and interacting with the local filesystem. Now I'm not sure if I should be installing these applications while logged in simply as myuser, sudoed as myuser, or something else.

These servers are inside a secured, private home LAN so I don't need "real admin" and crazy security controls. I'm just setting up a simple dev enviroment for a small software tool I'm writing. Thanks in advance for any help with the questions above.

share|improve this question
    
Which shell did you use? Was it one of those who need a manual command to rehash? –  Hennes Aug 21 '12 at 17:20
add comment

2 Answers 2

up vote 1 down vote accepted

/opt by default is owned by user root and group root.

Try l / and you will see that the folder /opt is owned by "root root" which are the user and group respectively.

If you really want to create and modify files inside of /opt with a non-root user, you will need to create a folder in there and modify it's permissions so that it can be freely accessed by a non-root user.

Example:

sudo mkdir /opt/sandbox
sudo chown myuser:users /opt/sandbox

The first command creates the folder, but it is owned by root and group root
The second command changes the ownership (chown) to your user named myuser and makes it part of the group users (which myuser is a part of).

share|improve this answer
    
Thanks @SaultDon (+1) - just out of curiosity, how do software applications (installed either under /opt or /usr/local) access areas of the file system that are not under /home/myuser or owned by myuser? Are they creating their own users/groups under the hood and utilizing this sudo chown command that you give an example of? Or is something else going on? Thanks again! –  pnongrata Aug 21 '12 at 20:23
1  
There is definitely something else going on, but I am limited in knowledge in that area. A lot of programs access the files needed to run in "read" mode. Certain programs can require a separate user to function properly, like database programs. But in those cases, they are considered a "service" and services (like a database) usually require a separate user or group to function properly. A user (swerdna) from the openSUSE community has my fav page for learning about permissions (swerdna.net.au/sambaserver/modes.html) and what those crazy "drwxr...." options mean! –  SaultDon Aug 21 '12 at 20:34
1  
@zharvey cont'd: Usually, when the program is installed the needed user/group permissions are created. They usually don't change permissions when the program is launched or running, this is probably because of security reasons. –  SaultDon Aug 21 '12 at 20:36
1  
@zharvey You can see this in action, how you can read a file owned by root, but not another! Try ls /bin and that will work because your user has "read" access to that folder. But try ls /root and you may be surprised that only the root user has read access to that folder (if it exists). –  SaultDon Aug 21 '12 at 20:38
add comment

So why is it that myuser can't: ...

Try

ls -l sandbox
getfacl sandbox

If the output of those isn't clear or doesn't explain what you are seeing, cut & paste output into an edit of your question.

I'm also vague on the difference between sudo, su and the root user.

sudo gives you elevated root (i.e. administrator) privileges for one command only. There is a config file for sudo in which you can control which users are allowed to do what.

su gives you elevated priviliges for multiple commands by giving you a new shell session with an effective user-id of root.

The root user is a special user named root that you can see in /etc/passwd. There are a dozen or so other users you always get in an Unix or Linux system. People usually have an ordinary account and use that for all work except the actions that absolutely require root privileges (e.g. installing software for use by all users on the system). This makes it harder for malware to do bad stuff and makes it harder for you to make irrecoverable mistakes.

I'd like to have a bunch of server software installed

I find it best to use the system's package manager to install packages. I would prefer not to create folders in /opt by hand, that would be my very last choice.

share|improve this answer
    
Thanks @RedGrittyBrick (+1) - great answer! When I run ls -l sandbox I get: ls: cannot access sandbox: no such file or directory. And getfacl isn't even installed on my system (I'd have to run apt-get install, but I seem to be having some network issues as well (outside the scope of this question), so for now it's not something I can run. I now understand the diff between sudo, su and root (so thankyou!) and like your idea about letting package managers do all the hard work for me... –  pnongrata Aug 21 '12 at 17:51
    
...but there are some apps and things I'd like to be able to install under /opt so that they are visible outside of myuser. In those cases, I assume I have to either be root or sudoed from myuser to have root-like privs. But that still doesn't make them "visible" to myuser! Can you explain why this is so, and what I need to be able to do to make them visible/accessible? Thanks again! –  pnongrata Aug 21 '12 at 17:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.