Linux File

Linux file permissions are a fundamental aspect of system security and administration, dictating who can read, write, or execute files and directories. Understanding them is crucial for anyone working with Linux, from developers to system administrators, ensuring data integrity and preventing unauthorized access.

The Core Concepts: Users, Groups, and Others

Every file and directory on a Linux system is associated with an owner and a group. Permissions are then defined for three distinct categories:

1. User (u): The owner of the file.
2. Group (g): The group that owns the file. Any user belonging to this group will have these permissions.
3. Others (o): All other users on the system who are not the owner and do not belong to the file's group.

Permission Types: Read, Write, Execute

For each of the above categories (User, Group, Others), three types of permissions can be granted or denied:

• Read (r):

* For files: Allows viewing the contents of the file.
* For directories: Allows listing the contents of the directory (e.g., using ls).

• Write (w):

* For files: Allows modifying or deleting the file.
* For directories: Allows creating, deleting, or renaming files within that directory.

• Execute (x):

* For files: Allows running the file as a program or script.
* For directories: Allows entering the directory (e.g., using cd) and accessing its subdirectories and files.

Understanding ls -l Output

The ls -l command is your primary tool for viewing file permissions. Let's break down its output:


The first string -rwxr-xr-- is the permission string, composed of 10 characters:

1. File Type: The first character indicates the file type.
* -: Regular file
* d: Directory
* l: Symbolic link
* c: Character device
* b: Block device
* s: Socket
* p: Named pipe
2. Permissions (User, Group, Others): The next nine characters are grouped into three sets of three, representing permissions for the owner, group, and others, respectively:
* rwx: Permissions for the file owner.
* r-x: Permissions for the group.
* r--: Permissions for others.

In our example, my_script.sh is a regular file (-). The owner (user) can read, write, and execute (rwx). The group (group) can read and execute (r-x). All other users (others) can only read (r--).

Changing Permissions with chmod

The chmod command is used to change file and directory permissions. It offers two main modes: symbolic and octal.

Symbolic Mode

Symbolic mode uses letters to represent categories (u, g, o, a for all) and permissions (r, w, x), along with operators (+ to add, - to remove, = to set exactly).

• Adding permissions:

• Removing permissions:

• Setting exact permissions:

Octal Mode (Numeric Mode)

Octal mode uses a three-digit number to represent permissions for user, group, and others. Each permission type has a numerical value:

• r (Read) = 4
• w (Write) = 2
• x (Execute) = 1

To determine the octal value for a category, sum the values of the desired permissions.

| Permission | Value |
| :--------- | :---- |
| --- | 0 |
| --x | 1 |
| -w- | 2 |
| -wx | 3 |
| r-- | 4 |
| r-x | 5 |
| rw- | 6 |
| rwx | 7 |

Common octal values:

• 777: rwxrwxrwx (Everyone has full permissions - generally discouraged)
• 755: rwxr-xr-x (Owner has full, group and others can read and execute - common for directories and executables)
• 644: rw-r--r-- (Owner can read/write, group and others can only read - common for files)

Example usage:

Changing Ownership with chown and chgrp

While chmod manages permissions, chown changes the owner and chgrp changes the group of a file or directory.

• chown:

• chgrp:

*Note: Only root or the current owner (for chgrp) can change ownership/group.*

Special Permissions: SetUID, SetGID, and Sticky Bit

These are advanced permissions that add extra layers of functionality and security.

1. SetUID (Set User ID):
* Applies to executable files.
* When an executable with SetUID is run, it executes with the permissions of the file owner, not the user running it.
* Represented by s in the owner's execute position (rws).
* Octal value: 4000 (e.g., chmod 4755).
* Example: passwd command, which allows users to change their password by temporarily gaining root privileges.

2. SetGID (Set Group ID):
* Applies to executable files: Executes with the permissions of the file's group.
* Applies to directories: New files/directories created within it automatically inherit the parent directory's group, not the creator's primary group.
* Represented by s in the group's execute position (r-s).
* Octal value: 2000 (e.g., chmod 2775).

3. Sticky Bit:
* Applies only to directories.
* Prevents users from deleting or renaming files within that directory unless they own the file or the directory itself.
* Commonly seen on /tmp directories.
* Represented by t in the others' execute position (r-t).
* Octal value: 1000 (e.g., chmod 1777).

Best Practices

• Least Privilege: Always grant the minimum necessary permissions. For example, don't use 777 unless absolutely required and understood.
• Default Permissions: Use umask to set default permissions for newly created files and directories. A common umask of 0022 results in 644 for files and 755 for directories.
• Regular Audits: Periodically review file permissions, especially for critical system files or sensitive data.

Mastering Linux file permissions is a continuous learning process, but a solid understanding of these core concepts will significantly enhance your ability to manage and secure Linux systems effectively.