Linux Permissions:

File permissions are a cornerstone of security and system management in Linux-based environments. Understanding how they work and how to manipulate them with chmod and chown is crucial for anyone managing a server, developing applications, or simply using a Linux desktop effectively. This guide will break down the essentials.

The Basics: Permission Types and User Categories

Every file and directory in Linux has associated permissions that dictate who can do what with it. These permissions are defined across three primary categories of users and three types of actions.

Permission Types:

• Read (r):

* Files: Allows viewing the file's content.
* Directories: Allows listing the contents of the directory (e.g., using ls).

• Write (w):

* Files: Allows modifying or deleting the file's content.
* Directories: Allows creating, deleting, or renaming files within the directory.

• Execute (x):

* Files: Allows running the file as a program or script.
* Directories: Allows entering the directory (e.g., using cd).

User Categories:

• Owner (u): The user who owns the file or directory.
• Group (g): Members of the group associated with the file or directory.
• Others (o): All other users on the system who are neither the owner nor part of the group.

When you run ls -l, you'll see something like this:
The first character indicates the file type (- for regular file, d for directory). The next nine characters represent the permissions in sets of three for owner, group, and others, respectively.

chmod: Changing File Permissions

The chmod command is used to change file permissions. It can be used in two main modes: symbolic mode and octal (numeric) mode.

1. Symbolic Mode

Symbolic mode uses letters and symbols to represent changes.

Syntax: chmod [who][operator][permissions] file(s)

• Who: u (user/owner), g (group), o (others), a (all – ugo combined)
• Operator: + (add permission), - (remove permission), = (set exact permission)
• Permissions: r (read), w (write), x (execute)

Examples:

• Give owner execute permission:

If it was -rw-r--r--, it becomes -rwx-r--r--.

• Remove write permission from group and others:

If it was -rw-rw-r--, it becomes -rw-r--r--.

• Set specific permissions for all:

This sets read and write for all, removing any execute permissions. Equivalent to chmod 666 myfile.txt.

• Give all users read, write, and execute for a directory (often for web server content):

The -R flag applies the changes recursively to all files and subdirectories.

2. Octal (Numeric) Mode

Octal mode uses numbers to represent permission sets. Each permission type has a numeric value:

• r (read) = 4
• w (write) = 2
• x (execute) = 1
• No permission = 0

To get the octal value for a user category, sum the values of its desired permissions.

Example:

• rwx = 4 + 2 + 1 = 7
• rw- = 4 + 2 + 0 = 6
• r-x = 4 + 0 + 1 = 5
• r-- = 4 + 0 + 0 = 4

You then combine three such numbers (one for owner, one for group, one for others) to form a three-digit octal permission code.

Syntax: chmod [owner_permissions][group_permissions][others_permissions] file(s)

Common Octal Codes:

• 777 (rwxrwxrwx): Full permissions for everyone. Generally discouraged for security reasons.
• 755 (rwxr-xr-x): Owner has full control, group and others can read and execute. Common for directories and executable scripts.
• 644 (rw-r--r--): Owner can read/write, group and others can only read. Common for regular files.
• 600 (rw-------): Owner can read/write, no access for group or others. Good for sensitive files.

Examples:

• Set rwx for owner, r-x for group and others:

• Set rw- for owner, r-- for group and others:

chown: Changing File Ownership

The chown command is used to change the owner and/or group of a file or directory.

Syntax:

• chown [new_owner] file(s)
• chown [new_owner]:[new_group] file(s)
• chown :[new_group] file(s) (only changes group)

Examples:

• Change owner of myfile.txt to john:

• Change owner to john and group to devs for myfolder/:

• Change only the group of anotherfile.txt to admins:

• Recursively change owner and group for a directory and its contents:

This is common for web server configurations where files need to be owned by the web server user.

Note on chgrp: While chown :new_group works, there's also a dedicated chgrp command specifically for changing only the group: chgrp new_group file(s).

Special Permissions (Briefly)

Beyond the basic rwx permissions, there are three special permissions:

1. SetUID (Set User ID): When set on an executable file, the file runs with the permissions of the *owner* of the file, not the user executing it. Represented by s in the owner's execute position (e.g., rws). Octal value is 4000.
2. SetGID (Set Group ID): Similar to SetUID, but the file runs with the permissions of the *group* owner. When set on a directory, new files/directories created within it inherit the parent directory's group. Represented by s in the group's execute position (e.g., rwxrwsr-x). Octal value is 2000.
3. Sticky Bit: Primarily for directories. When set, only the owner of a file (or the directory owner or root) can delete or rename files within that directory, even if they have write permission to the directory. Common on /tmp. Represented by t in the others' execute position (e.g., rwxrwxrwt). Octal value is 1000.

To apply these, you prefix the octal permission with the special permission's octal value. For example, chmod 4755 myscript.sh would set SetUID and rwxr-xr-x permissions.

Best Practices

• Least Privilege: Always grant the minimum necessary permissions. Don't use 777 unless absolutely required and understood.
• Directories vs. Files: Directories often need execute permission (x) for users to cd into them or list their contents (ls). Files usually only need x if they are executable scripts or binaries.
• Web Servers: Files and directories served by web servers (e.g., Apache, Nginx) typically need to be owned by the web server user (www-data or apache) and have 644 for files and 755 for directories.
• Sudo: Use sudo with chmod and chown when modifying files owned by root or other system users.

Mastering chmod and chown is a fundamental skill that will greatly enhance your ability to manage and secure Linux systems. Practice these commands in a safe environment to get comfortable with their usage.