Edit

Permissions

In this section, you will learn how to set Linux permissions on files and directories. Permissions specify what a particular person can or cannot do with respect to a file or directory.

As such, permissions are important in creating a secure environment. For instance, you use permissions when you don't want other people to change your files, or you want system files to be safe from damage, either accidental or deliberate.

Linux permissions

Linux permissions dictate the three things you can do with a file—read, write, and execute. In Linux, they are each referred to by a single letter.

• r (read)—you can view the contents of the file.
• w (write)—you can change the contents of the file.
• x (execute)—you can execute or run the file if it is a program or script.

For every file, you define three sets of people for whom we can specify permissions.

• owner—a single person who owns the file. Typically, it is the person who created the file, but ownership can be granted to someone else by specific users.
• group—every file belongs to a single group.
• others—everyone else who is not in the group or is not the owner.

Three permissions and three groups of people— that's about all there is to permissions. Now, let's see how we can view and change them.

Viewing permissions

To view permissions for a file, use the long listing option for the ls command.

ls -l [path]

Example:

user@bash: ls -l /home/ryan/linuxtutorialwork/frog.png
-rwxr----x 1 harry users 2.7K Jan 4 07:32 /home/ryan/linuxtutorialwork/frog.png
user@bash:

In the above example, the first ten characters of the output are what you look at to identify permissions.

• The first character identifies the file type. If it is a dash (-), then it is a normal file. If it is d, then it is a directory.
• The following three characters represent the permissions for the owner. The letter represents the presence of permission and the dash (-)—the absence of that. In this example, the owner has all permissions—read, write, and execute.
• The following three characters represent the permissions for the group. In this example, the group can read but not write or execute. Note that the order of permissions is always read, write, and then execute.
• The last three characters represent the permissions for others, or everyone else. In this example, they have only the execute permission.

Changing permissions

To change permissions on a file or directory, use a command called chmod. It stands for change file mode bits.

chmod [permissions] [path]

The chmod command has permission arguments comprising the following three components:

• Who are you changing the permission for? [ugoa]—user (or owner), group, others, all

• Are you granting or revoking the permission?

  This is indicated with either a plus (+) or minus (-).

• Which permission are you setting?

  • read (r)
  • write (w)
  • execute (x)

The following examples make their usage clearer.

Example 1

Grant the execute permission to the group. Then, remove the write permission for the owner.

user@bash: ls -l frog.png
-rwxr----x 1 harry users 2.7K Jan 4 07:32 frog.png
user@bash: chmod g+x frog.png
ls -l frog.png
-rwxr-x--x 1 harry users 2.7K Jan 4 07:32 frog.png
user@bash: chmod u-w frog.png
ls -l frog.png
-r-xr-x--x 1 harry users 2.7K Jan 4 07:32 frog.png
user@bash:

Example 2

Assign multiple permissions at once.

user@bash: ls -l frog.png
-rwxr----x 1 harry users 2.7K Jan 4 07:32 frog.png
chmod g+wx frog.png
user@bash: ls -l frog.png
-rwxrwx--x 1 harry users 2.7K Jan 4 07:32 frog.png
chmod go-x frog.png
user@bash: ls -l frog.png
-rwxrw---- 1 harry users 2.7K Jan 4 07:32 frog.png
user@bash:

Though it may seem odd that, as the owner of a file, you can remove our ability to read, write and execute that file, but there are valid reasons you may wish to do this. Maybe, you have a file with data in it you wish, for instance, not to change accidentally. While you may remove these permissions, you may not remove the ability to set those permissions. Thus, you always have control over every file under your ownership.

Setting permissions shorthand

The method outlined above is not too hard for setting permissions, but it can be a little tedious if you have a specific set of permissions you would like to apply regularly to certain files, for instance, scripts. Luckily, there is a shorthand way to specify permissions.

To understand how the shorthand method works, you first need a little background in number systems. A typical number system is decimal. It is a base ten-number system with ten symbols—from 0 to 9.

Another number system is octal, which uses eight numbers—from 0 to 7. Now it just so happens that with three permissions, each being on or off, you have eight possible combinations (2^3). You can also represent numbers using binary, which only has two symbols—0 and 1. The mapping of octal to binary is in the table below.

Octal	Binary
0	0 0 0
1	0 0 1
2	0 1 0
3	0 1 1
4	1 0 0
5	1 0 1
6	1 1 0
7	1 1 1

Note that you can only represent all eight octal values with three binary bits, and every possible combination of 1 and 0 is included in it. So, you have three bits, and you also have three permissions. If you think of 1 as representing on and 0—off, a single octal number can be used to represent a set of permissions for a set of people. Three numbers—and you can specify permissions for the user, group, and others.

Let's see some examples. Refer to the table above to see how they match.

user@bash: ls -l frog.png
-rw-r----x 1 harry users 2.7K Jan 4 07:32 frog.png
user@bash: chmod 751 frog.png
user@bash: ls -l frog.png
-rwxr-x--x 1 harry users 2.7K Jan 4 07:32 frog.png
user@bash: chmod 240 frog.png
user@bash: ls -l frog.png
--w-r----- 1 harry users 2.7K Jan 4 07:32 frog.png

People often remember commonly used number sequences for different types of files and find this method quite convenient. For example, 755 or 750 are commonly used for scripts.

Setting permissions for directories

The same series of permissions can be used for directories, but they have slightly different behavior.

• r—you have the ability to read the contents of the directory, which means to run ls.
• w—you have the ability to write to the directory, which means to create files and directories.
• x—you have the ability to enter that directory, which means to run cd.

Let's see some of these in action:

user@bash: ls testdir
file1 file2 file3
user@bash: chmod 400 testdir
user@bash: ls -ld testdir
dr-------- 1 ryan users 2.7K Jan 4 07:32 testdir

user@bash: cd testdir
user@bash: cd: testdir: Permission denied
user@bash: ls testdir
file1 file2 file3


user@bash: chmod 100 testdir
user@bash: ls -ld testdir
---x------ 1 ryan users 2.7K Jan 4 07:32 testdir

user@bash: ls testdir
user@bash: cd testdir
user@bash: pwd
/home/ryan/testdir
ls: cannot open directory testdir/: Permission denied
user@bash:

On lines 5 and 14 above, run ls with the -d option included, which stands for directory. Normally, if you give ls an argument, which is a directory, it lists the contents of that directory. In this case, however, you are interested in the directory permissions directly, and the -d option allows you to obtain that.

Remember, these permissions are for the directory itself, not the files within. For example, you can have a directory for which you don't have the read permission. It can include files for which you do have the read permission. As long as you know that the file exists and its name, you can still read the file.

user@bash: ls -ld testdir
--x------- 1 ryan users 2.7K Jan 4 07:32 testdir
user@bash: cd testdir
user@bash: ls
ls: cannot open directory .: Permission denied
user@bash: cat samplefile.txt
Kyle 20
Stan 11
Kenny 37
user@bash:

Root user

In a Linux system, there are usually only two people who can change the permissions of a file or directory—the file or directory owner and the root user.

The root user is a superuser who is allowed to do anything and everything in the system. Typically, system administrators would be the only ones who have access to the root account and would use it to maintain the system. Normal users would mostly have access only to the files and directories in their home directory and maybe a few others to share and collaborate. This helps to maintain the security and stability of the system.

Basic security

Your home directory is your own personal space on the system. You should make sure that it stays that way.

Most users would give themselves full read, write and execute permissions for their home directory and no permissions for the group or others. However, for various reasons, some people can have a slightly different setup.

For optimal security, you should not give either the group or others write access to your home directory. Execute without read can come in handy sometimes. This allows people to get into your home directory without letting them see what is there. For instance, you can use this for personal web pages.

It is typical for a system to run a web server and allow users to each have their own webspace. A common setup is that if you place a directory in your home directory called public_html, the webserver reads and displays its contents. The webserver runs as a different user to you, but by default, it will not have access to get in and read those files. This is a situation where it is necessary to grant execute on your home directory so that the webserver user can access the required resources.

Activities for practicing

Let's play with some permissions:

• First off, take a look at the permissions of your home directory, then at those for various files in there.

• Now, let's navigate to the linuxtutorialwork directory and change the permissions for some files in there. Make sure you use both the shorthand and longhand form for setting permissions, as well as a variety of absolute and relative paths. Try removing the read permission from a file and then reading it or removing the write permission and then opening it in Vim.

• Let's play with directories now. Create a directory and put some files into it. Now, play about with removing various permissions from yourself on that directory and see what you can and can't do.

• Finally, explore the system and see what the general permissions are for files in other system directories, such as /etc and /bin.