本文目录导读：
我来详细说明如何实现权限校验脚本,这里提供几种常见场景的实现方案：
基础权限校验（Python版本）
import os
import stat
import sys
def check_file_permissions(filepath):
"""检查文件权限"""
try:
# 获取文件状态
file_stat = os.stat(filepath)
mode = file_stat.st_mode
# 检查各种权限
permissions = {
'owner_read': bool(mode & stat.S_IRUSR),
'owner_write': bool(mode & stat.S_IWUSR),
'owner_execute': bool(mode & stat.S_IXUSR),
'group_read': bool(mode & stat.S_IRGRP),
'group_write': bool(mode & stat.S_IWGRP),
'group_execute': bool(mode & stat.S_IXGRP),
'other_read': bool(mode & stat.S_IROTH),
'other_write': bool(mode & stat.S_IWOTH),
'other_execute': bool(mode & stat.S_IXOTH)
}
return permissions
except FileNotFoundError:
print(f"文件 {filepath} 不存在")
return None
except PermissionError:
print(f"没有权限访问 {filepath}")
return None
def check_user_permissions(username, resource):
"""检查用户对资源的权限"""
# 这里可以实现基于用户组的权限检查
authorized_users = ['admin', 'root', username]
if username in authorized_users:
return True
return False
# 使用示例
if __name__ == "__main__":
# 检查文件权限
perms = check_file_permissions("/etc/passwd")
if perms:
print("文件权限:")
for key, value in perms.items():
print(f" {key}: {'✓' if value else '✗'}")
RBAC（基于角色的访问控制）实现
from enum import Enum
from typing import Set, Dict, List
class Permission(Enum):
READ = "read"
WRITE = "write"
DELETE = "delete"
EXECUTE = "execute"
ADMIN = "admin"
class Role:
def __init__(self, name: str, permissions: Set[Permission]):
self.name = name
self.permissions = permissions
def has_permission(self, permission: Permission) -> bool:
return permission in self.permissions
class RBACSystem:
def __init__(self):
# 预定义角色
self.roles = {
'admin': Role('admin', {Permission.READ, Permission.WRITE,
Permission.DELETE, Permission.EXECUTE,
Permission.ADMIN}),
'editor': Role('editor', {Permission.READ, Permission.WRITE,
Permission.EXECUTE}),
'viewer': Role('viewer', {Permission.READ})
}
# 用户到角色的映射
self.user_roles: Dict[str, List[str]] = {}
def assign_role(self, username: str, role_name: str):
"""为用户分配角色"""
if role_name not in self.roles:
raise ValueError(f"角色 {role_name} 不存在")
if username not in self.user_roles:
self.user_roles[username] = []
if role_name not in self.user_roles[username]:
self.user_roles[username].append(role_name)
def check_permission(self, username: str, permission: Permission) -> bool:
"""检查用户是否有指定权限"""
if username not in self.user_roles:
return False
for role_name in self.user_roles[username]:
role = self.roles[role_name]
if role.has_permission(permission):
return True
return False
def revoke_role(self, username: str, role_name: str):
"""撤销用户的角色"""
if username in self.user_roles and role_name in self.user_roles[username]:
self.user_roles[username].remove(role_name)
# 使用示例
rbac = RBACSystem()
rbac.assign_role("张三", "editor")
print(rbac.check_permission("张三", Permission.WRITE)) # True
print(rbac.check_permission("张三", Permission.DELETE)) # False
基于令牌的权限校验（JWT）
import jwt
import time
from functools import wraps
from flask import request, jsonify
class JWTAuth:
def __init__(self, secret_key, algorithm='HS256'):
self.secret_key = secret_key
self.algorithm = algorithm
def create_token(self, user_id, role, permissions, expiry=3600):
"""创建JWT令牌"""
payload = {
'user_id': user_id,
'role': role,
'permissions': permissions,
'exp': int(time.time()) + expiry,
'iat': int(time.time())
}
return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)
def verify_token(self, token):
"""验证令牌"""
try:
payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm])
return payload
except jwt.ExpiredSignatureError:
return None
except jwt.InvalidTokenError:
return None
def require_permission(self, required_permission):
"""权限校验装饰器"""
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
token = request.headers.get('Authorization', '').replace('Bearer ', '')
if not token:
return jsonify({'error': '未提供令牌'}), 401
payload = self.verify_token(token)
if not payload:
return jsonify({'error': '令牌无效或已过期'}), 401
# 检查权限
if required_permission not in payload.get('permissions', []):
return jsonify({'error': '权限不足'}), 403
# 将用户信息传递给视图函数
request.user = payload
return f(*args, **kwargs)
return decorated_function
return decorator
# Flask应用示例
from flask import Flask
app = Flask(__name__)
auth = JWTAuth('your-secret-key')
@app.route('/api/admin')
@auth.require_permission('admin')
def admin_panel():
return jsonify({'message': '欢迎管理员', 'user': request.user})
@app.route('/api/login')
def login():
# 模拟登录
token = auth.create_token(
user_id=1,
role='admin',
permissions=['read', 'write', 'admin']
)
return jsonify({'token': token})
Linux系统脚本（Shell版本）
#!/bin/bash
# 权限校验脚本
check_permissions() {
local file_path=$1
local required_perms=$2 # 格式: rwx
if [ ! -e "$file_path" ]; then
echo "错误: 文件 $file_path 不存在"
return 1
fi
# 获取当前文件权限
local file_perms=$(stat -c "%A" "$file_path" | cut -c2-10)
echo "当前权限: $file_perms"
# 检查权限
local missing_perms=""
[[ "$required_perms" == *"r"* && ! "$file_perms" == *"r"* ]] && missing_perms+="r"
[[ "$required_perms" == *"w"* && ! "$file_perms" == *"w"* ]] && missing_perms+="w"
[[ "$required_perms" == *"x"* && ! "$file_perms" == *"x"* ]] && missing_perms+="x"
if [ -n "$missing_perms" ]; then
echo "缺少权限: $missing_perms"
return 1
fi
echo "权限检查通过"
return 0
}
# 用户权限检查
check_user_access() {
local username=$1
local resource=$2
# 检查用户是否存在
if ! id "$username" &>/dev/null; then
echo "用户 $username 不存在"
return 1
fi
# 检查是否是root
if [ "$(id -u "$username")" -eq 0 ]; then
echo "root用户拥有所有权限"
return 0
fi
# 检查文件所有者
local owner=$(stat -c '%U' "$resource")
if [ "$username" == "$owner" ]; then
echo "用户是文件所有者"
return 0
fi
# 检查用户组
local group=$(stat -c '%G' "$resource")
if groups "$username" | grep -q "\b$group\b"; then
echo "用户属于文件所在组"
return 0
fi
echo "用户没有访问权限"
return 1
}
# 主函数
main() {
local action=$1
case $action in
"file")
check_permissions "$2" "$3"
;;
"user")
check_user_access "$2" "$3"
;;
*)
echo "用法: $0 {file|user} <参数>"
exit 1
;;
esac
}
main "$@"
数据库权限校验
import sqlite3
from contextlib import contextmanager
class DatabasePermissions:
def __init__(self, db_path):
self.db_path = db_path
self.init_database()
def init_database(self):
"""初始化权限表"""
with self.get_connection() as conn:
conn.execute('''
CREATE TABLE IF NOT EXISTS permissions (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id INTEGER,
resource_type TEXT,
resource_id TEXT,
permission_type TEXT,
granted INTEGER DEFAULT 1,
UNIQUE(user_id, resource_type, resource_id, permission_type)
)
''')
conn.execute('''
CREATE TABLE IF NOT EXISTS user_roles (
user_id INTEGER,
role_name TEXT,
PRIMARY KEY (user_id, role_name)
)
''')
conn.execute('''
CREATE TABLE IF NOT EXISTS role_permissions (
role_name TEXT,
permission_name TEXT,
PRIMARY KEY (role_name, permission_name)
)
''')
conn.commit()
@contextmanager
def get_connection(self):
conn = sqlite3.connect(self.db_path)
try:
yield conn
finally:
conn.close()
def check_permission(self, user_id, resource_type, resource_id, permission_type):
"""检查用户是否有特定权限"""
with self.get_connection() as conn:
# 检查直接权限
cursor = conn.execute('''
SELECT granted FROM permissions
WHERE user_id = ? AND resource_type = ?
AND resource_id = ? AND permission_type = ?
''', (user_id, resource_type, resource_id, permission_type))
result = cursor.fetchone()
if result:
return bool(result[0])
# 检查角色权限
cursor = conn.execute('''
SELECT COUNT(*) FROM user_roles ur
JOIN role_permissions rp ON ur.role_name = rp.role_name
WHERE ur.user_id = ? AND rp.permission_name = ?
''', (user_id, permission_type))
return cursor.fetchone()[0] > 0
def grant_permission(self, user_id, resource_type, resource_id, permission_type):
"""授予权限"""
with self.get_connection() as conn:
conn.execute('''
INSERT OR REPLACE INTO permissions
(user_id, resource_type, resource_id, permission_type, granted)
VALUES (?, ?, ?, ?, 1)
''', (user_id, resource_type, resource_id, permission_type))
conn.commit()
# 使用示例
db_perms = DatabasePermissions('permissions.db')
db_perms.grant_permission(1, 'file', 'document.txt', 'read')
print(db_perms.check_permission(1, 'file', 'document.txt', 'read')) # True
通用权限校验装饰器
from functools import wraps
from typing import Callable, Any
class PermissionChecker:
def __init__(self):
self.permission_handlers = {}
def register_handler(self, permission_type: str, handler: Callable):
"""注册权限处理函数"""
self.permission_handlers[permission_type] = handler
def require(self, permission_type: str, *args, **kwargs):
"""权限校验装饰器"""
def decorator(func: Callable) -> Callable:
@wraps(func)
def wrapper(*func_args, **func_kwargs) -> Any:
if permission_type in self.permission_handlers:
handler = self.permission_handlers[permission_type]
if not handler(*args, **kwargs):
raise PermissionError(f"缺少 {permission_type} 权限")
else:
raise ValueError(f"未知的权限类型: {permission_type}")
return func(*func_args, **func_kwargs)
return wrapper
return decorator
# 权限处理器示例
def admin_permission_check(user_id: int) -> bool:
return user_id == 1 # 假设用户ID为1的是管理员
def file_permission_check(user_id: int, filename: str, action: str) -> bool:
# 实现文件权限检查逻辑
authorized_users = {1: ['read', 'write'], 2: ['read']}
if user_id in authorized_users and action in authorized_users[user_id]:
return True
return False
# 使用通用权限校验
checker = PermissionChecker()
checker.register_handler('admin', admin_permission_check)
checker.register_handler('file', file_permission_check)
@checker.require('admin', user_id=1)
def admin_function():
return "管理员功能"
@checker.require('file', user_id=2, filename='test.txt', action='read')
def read_file():
return "读取文件成功"
关键设计原则
- 最小权限原则：只授予必要的最小权限
- 职责分离：不同的操作需要不同的权限
- 默认拒绝：除非明确授权，否则拒绝访问
- 权限分级：建立清晰的权限层级
- 审计日志：记录权限变更和访问记录
根据你的具体需求选择合适的实现方案，如果是简单的脚本，推荐使用Python的装饰器方式；如果是系统级别的,建议使用RBAC或JWT方案。
