ult permission of
644 means the file owner has read and write
permission, while the group owner and other have read-only permission.
For example, to give everyone execute permission on a file, use the
chmod a+x command. The
a represents all, the plus sign
+) represents add, and
x means execute. Likewise, if the
application is a server service, you should ensure only authorized
accounts have access to execute the service.
If an application is capable of running under standard user account permissions but only those in a particular group need access to use it, you can set the group owner permission to executable and add the users to a group.
Getting even more specific, you can also set access control list (ACL)
permissions on an executable file to allow a particular user or group the
permission to run the application. Use the
setfacl utility to set ACL permissions.
For those applications, such as server services, that need to start the process as root user, you have a few options. Table 1 summarizes various options that allow users to execute server services that require root privileges.
Table 1. Options to run applications that require root privileges
|As root user||Not recommended for server services. Acceptable for applications when users already know the root password and the compromise of the application is not a primary concern.|
|Not recommended due to security issues.
|Commonly used and considered a good practice.
|Standard user account with file permissions||Set execute permission on a file for the user owner, group owner, or other (everyone). This is a common way to grant users who do not require root privileges permission to execute an application.|
|Standard user account with ACL permissions||Less commonly used, but a viable solution when you don't want to
grant a user |
Running from the command line
Running an application from the command line is an essential task when managing Linux servers. A lot of applications have shell scripts—similar to Windows batch files (.bat)—that start the applications and perform other tasks such as setting variables and assigning processes to other users. For example, an application may need a Java™ Virtual Machine (JVM) to execute. In that case, shell scripts can set the appropriate environment variables and then execute the Java command to run the Java Archive (JAR) or class file. This holds true for applications using Perl, Python, and even C#. (Yes, C# compiled applications can run on Linux!)
You can execute a command from the command line or shell prompt with just the file name if the command is a part of the shell’s built in commands, or if the command’s directory location is included in the PATH variable. Commands such as "ls" and "cd" are examples of commands that are generally included in the PATH by default as they typically reside in the /usr/local/bin or /usr/bin directories. But if the file location is not set in the PATH, you must include the pathname to the file. For example, if the executable myapp resides in the /usr/share/scripts directory, type
/usr/share/scripts/myapp to execute the script. You can also use the relative path by adding the dot (.) and slash (/) before the file name and type
./myapp. The dot (.) in the shell specifies the "current directory." (Windows includes the working directory on the execution path and some system administrators have been known to include the dot (.) in the PATH to emulate this, but this is not advisable for security reasons.) Likewise, you can precede the file name with the language environment such as:
More often though, packaged applications have shell scripts that set the
environment variables and provide the runtime executable path of the language
#! symbol, such as
#!/usr/bin/python. You should become familiar
with this approach as well.
Listing 1 uses the
catalina.sh default script to start the Apache
Tomcat application server using the
approach. Then it starts the server using the
sh approach. Since the default port is 8080, no
special modifications are required to start the service as a standard
Listing 1. Executin