Linux User Privilege Explanation

Note:

Replace dev with your username. You are advised to add the following permission configuration to the end of the sudoers file instead of the middle, to ensure that the configuration takes effect.

1. Allow the user dev to execute subsequent configuration commands with sudo privileges as the root user on any host computer.

dev     ALL=(root) /bin/sh,/bin/mkdir,/bin/rm,/bin/cp,/bin/chmod,/bin/systemctl,
/bin/kill,/usr/sbin/sysctl,/usr/bin/gpasswd,/usr/sbin/groupadd,/usr/bin/chown,
/usr/sbin/modprobe,/usr/bin/echo,/usr/bin/sed,/usr/sbin/swapoff,/usr/sbin/ip,
/bin/sudo

2. (Optional) Allow the user dev to execute commands using the sudo command without entering a password if the user still lacks permission (for example, if the prompt "[sudo] password for ubuntu:" still appears).

dev     ALL=(root) NOPASSWD:/bin/sh,/bin/mkdir,/bin/rm,/bin/cp,/bin/chmod,
/bin/systemctl,/bin/kill,/usr/sbin/sysctl,/usr/bin/gpasswd,/usr/sbin/groupadd,
/usr/bin/chown,/usr/sbin/modprobe,/usr/bin/echo,/usr/bin/sed,/usr/sbin/swapoff,
/usr/sbin/ip,/bin/sudo

Note:

Comment out the original requiretty-related content.

Ensure the user does not require a TTY session to execute sudo commands. This will allow the execution of sudo commands through scripts or remote commands.

#Defaults: requiretty

Command Description: It is used to create directories.

Application Scenario:

1. Create a temporary Docker installation directory in the user's home directory to store Docker and installation files of related components.

2. Create a permanent Docker installation directory in System directory/usr/bin to store executables of Docker and related components.

3. Create data and component directories for FineOps and projects in the specified project mounting directory to store data and configuration files of the Docker container.

Example:

• Command Example: 

mkdir -p -m 750 /home/fanruan/data

• Description: Creates a project mounting path /home/fanruan/data and sets the permission to 750.

Command Description:

It is used to change the ownership of a file or directory.

Application Scenario:

1. Change ownership of the temporary Docker installation directory to ensure proper privileges during installation.

2. Change ownership of the permanent Docker installation directory to ensure the system's and the user's access to executables.

3. Change ownership of data and component directories of FineOps and projects to ensure the Docker container's access to data and configuration files.

Example:

• Command Example: 

chown -R fanruan:fanruan /home/fanruan/data

• Description: Recursively changes the ownership of the /home/fanruan/data path and all directories and files in it to the user fanruan and the group fanruan.

Command Description: It is used to change access permissions for files or directories.

Application Scenario: 

1. Change permissions on the temporary Docker installation directory to prevent permission issues during installation.

2. Change permissions on the final Docker installation directory to ensure that the system and users can access executable files.

3. Change permissions on the data and component directories of FineOps and projects to ensure that Docker containers can access data and configuration files.

Example:

chmod 755 /home/fanruan/data

Command Description: It is used to create user groups.

Application Scenario: Create dedicated user groups for Docker service isolation and access control.

Example:

• Command Example: 

groupadd docker

• Description: Creates a user group named docker.

Command Description: It is used to manage group members.

Application Scenario: Grant a user access privileges to the Docker service by adding the user to the specified user group.

Example:

• Command Example: 

gpasswd -a $USER docker

• Description: Adds the current user to the user group docker.

Command Description: It is used to disable all swap partitions and swap files in the system.

Application Scenario: Disable swap space to improve performance.

Example:

• Command Example: 

swapoff -a

• Description: Disables all swap partitions and swap files in the system.

Command Description: It is used to load kernel modules.

Application Scenario: Load the br_netfilter module dynamically to ensure proper operation and management of the Docker network.  

Example:

• Command Example: 

modprobe br_netfilter

• Description: Loads the br_netfilter module to activate it in the kernel, enabling support for Docker's networking functionality.

Command Description: It is the system and service manager.

Application Scenario: Ensure the Docker service starts automatically on system boot.

Example:

• Command Example: 

systemctl enable docker.service

• Description: Enables the docker.service unit to start automatically on system boot.

Command Description: It sends signals to processes.

Application Scenario: Send a SIGHUP signal to the Docker daemon to reload the configuration file without stopping or restarting the Docker service.

Example:

• Command Example: 

kill -HUP 1234

• Description: Sends a SIGHUP signal to the Docker daemon (PID 1234) to apply configuration changes without service interruption.

Command Description: It allows authorized users to run specific commands as the superuser without logging in to the server with the superuser account.

Application Scenario: Automate script execution and perform operations requiring the superuser's privileges.

Example:

• Command Example: 

echo sudo_xxxx_passwd | sudo -S sh -c "systemctl start docker"

• Description: Starts the Docker service with the superuser's privileges.

Command Description: It interprets and executes command strings specified via the -c option.

Application Scenario: Execute complex operations using a single command while ensuring proper privilege context.

Example:

• Command Example: 

echo sudo_xxxx_passwd | sudo -S sh -c "systemctl start docker"

• Description: Executes the command in a new shell with the superuser's privileges.

Command Description: It is used to output a string to standard output.

Application Scenario: Output strings to other commands for automation and batch processing.

Example:

• Command Example: 

echo sudo_xxxx_passwd | sudo -S sh -c "systemctl start docker"

• Description: Pipes the standard output of echo, which contains the sudo password, to sudo -S, enabling privileged command execution without interactive password entry.

Command Description: It is used to copy files and directories.

Application Scenario: Deploy and update service files to enable the system to manage and start corresponding services.

Example:

• Command Example: 

cp -f /home/finekey/docker.service /etc/systemd/system

• Description: Copies /home/finekey/docker.service to /etc/systemd/system/ so that systemd can manage the service.

Command Description: It is used to view and modify kernel parameter configuration.

Application Scenario: View and modify specific kernel parameters such as net.bridge.bridge-nf-call-iptables, net.ipv4.conf.all.forwarding, and net.ipv4.ip_forward.

Example:

• Command Example: 

sysctl -n net.ipv4.ip_forward

• Description: Checks the status of IPv4 forwarding in the current system.

Command Description: It is used to perform search, replace, insert, and delete operations in text files.

Application Scenario: Modify configuration files, primarily the sysctl.conf file (/etc/sysctl.conf), and kernel parameter configuration. If parameter values are already the target ones, the command does not modify the file.

Example:

• Command Example: 

sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

• Description: Changes the value of the SELINUX parameter in the config file (/etc/selinux/config) from enforcing to permissive, preventing Docker service startup failures when the systemctl command is used.

Command Description: It is used to delete files and directories.

Application Scenario: Purge residual rollback-generated files after deployment failure.

Example:

• Command Example: 

rm -rf /home/fanruan/data

• Description: Recursively deletes the /home/fanruan/data path and all its contents.

Command Description: It is used to start, stop, and restart services.

Application Scenario: Ensure the Docker service starts automatically at system boot.

Command Description: It is used for unified management of network configurations, such as network interfaces, IP addresses, routing tables, and neighbor caches.

Application Scenario: View, enable, or disable network interfaces.