26.4. Making Files Accessible From the Console

26.4. Making Files Accessible From the Console

The default settings for individual device classes and permission definitions are defined in /etc/security/console.perms.d/50-default.perms. To edit file and device permissions, it is advisable to create a new default file in /etc/security/console.perms.d/ containing your preferred settings for a specified set of files or devices. The name of the new default file must begin with a number higher than 50 (for example, 51-default.perms) in order to override 50-default.perms.

To do this, create a new file named 51-default.perms in /etc/security/console.perms.d/:

touch /etc/security/console.perms.d/51-default.perms

Open the original default perms file, 50-default.perms. The first section defines device classes, with lines similar to the following:

<floppy>=/dev/fd[0-1]* \
          /dev/floppy/* /mnt/floppy* 
<sound>=/dev/dsp* /dev/audio* /dev/midi* \         
	  /dev/mixer* /dev/sequencer \         
	  /dev/sound/* /dev/beep \ 	
<cdrom>=/dev/cdrom* /dev/cdroms/* /dev/cdwriter* /mnt/cdrom*

Items enclosed in brackets name the device; in the above example, <cdrom> refers to the CD-ROM drive. To add a new device, do not define it in the default 50-default.perms file; instead, define it in 51-default.perms. For example, to define a scanner, add the following line to 51-default.perms:

<scanner>=/dev/scanner /dev/usb/scanner*

Of course, you must use the appropriate name for the device. Ensure that /dev/scanner is really your scanner and not some other device, such as your hard drive.

Once you have properly defined a device or file, the second step is to specify its permission definitions. The second section of /etc/security/console.perms.d/50-default.perms defines this, with lines similar to the following:

<console> 0660 <floppy> 0660 root.floppy 
<console> 0600 <sound>  0640 root 
<console> 0600 <cdrom>  0600 root.disk

To define permissions for a scanner, add a line similar to the following in 51-default.perms:

<console> 0600 <scanner> 0600 root

Then, when you log in at the console, you are given ownership of the /dev/scanner device with the permissions of 0600 (readable and writable by you only). When you log out, the device is owned by root, and still has the permissions 0600 (now readable and writable by root only).


You must never edit the default 50-default.perms file. To edit permissions for a device already defined in 50-default.perms, add the desired permission definition for that device in 51-default.perms. This will override whatever permissions are defined in 50-default.perms.

Note: This documentation is provided {and copyrighted} by Red Hat®, Inc. and is released via the Open Publication License. The copyright holder has added the further requirement that Distribution of substantively modified versions of this document is prohibited without the explicit permission of the copyright holder. The CentOS project redistributes these original works (in their unmodified form) as a reference for CentOS-5 because CentOS-5 is built from publicly available, open source SRPMS. The documentation is unmodified to be compliant with upstream distribution policy. Neither CentOS-5 nor the CentOS Project are in any way affiliated with or sponsored by Red Hat®, Inc.