Managing File Permissions

Unix-like operating systems are by nature multi-user, which means that more than one user can be operating the computer at the same time.

For example, if the computer is attached to a local network or the Internet, remote users can log in via a secure shell and operate the computer.

In order to make this practical, a method had to be devised to protect the users from each other, as after all, we wouldn't want the actions of one user to crash the computer, nor would we allow one user to interfere with the files belonging to another user.

File permissions

File permissions, also called file mode, refers to the settings that determine who can read, write, and execute a particular file or directory.

These permissions apply to three groups of users on the system, including:

• The owner, which is the user who owns the file/directory.
• The group, which is a group of users who share certain permissions on the file/directory.
• The others, which are all the other users who are not the owner nor part of the specified group.

For each user entity in the aforementioned order, permissions are represented by a set of three characters called the symbolic notation:

rwx rwx rwx

Where:

• r represents the read permission.
• w represents the write permission.
• x represents the execute permission.
• - represents the absence of permission.

Permissions for files

Permissions for files allow the following actions:

• The read permission allows users to open and view the contents of a file.
• The write permission allows users to modify the contents of a file or delete the file.
• The execute permission allows users to run the file as a program if it contains executable code, such as a shell script or a compiled binary.

Example

Let's consider the following permissions:

rwx r-x r--

Which translate to:

• The owner can read, write, and execute the file.
• The group can read and execute the file.
• The others can only read the file.

Permissions for directories

In Unix, permissions for directories have a slightly different meaning than for files:

• The read permission allows users to list the contents of a directory.
• The write permission allows users to create, rename, delete, or modify files within the directory.
• The execute permission, combined with the read permission, allows users to enter the directory.

Example

Let's consider the following permissions:

rwx r-x r--

Where:

• The owner can list, rename, create and delete files in the directory, and also enter it.
• The group can list the files in the directory and also enter it.
• The others can only list the files in the directory.

Checking file permissions

To display detailed information about a file, including its permissions, you can use the ls command with the -l flag as follows:

$ ls -l [file ...]

Where:

• file ... is an optional list of paths to the files you want to check the permissions of.

For each file, this command will produce a similar output:

<type><permissions> <links> <owner> <group> <size> <modification> <name>

Where:

• type is the file type (i.e., - for a regular file, d for a directory, l for a soft link, etc).
• permissions is the file permissions in the symbolic notation (e.g., rwxr-xr--).
• links is the number of hard links pointing to the file.
• owner is the name of the file's owner.
• group is the name of the file's group.
• size is the file size in bytes. For directories, this field typically shows the size occupied by the directory metadata rather than the actual size of the contents.
• modification is the latest modification date and time.
• name is the name of the file.

Note: For directories, you'll have to specify the path to the parent directory, as the ls command will otherwise list the content of the target directory.

Example

This command will display extended information about all the files and directories located in the current working directory:

$ ls -l
-rw-r--r--  1 razvan  staff   0 Apr 22 16:18 script.sh
drwxr-xr-x  2 razvan  staff  64 Apr 22 16:18 tests

Note: The first character of the permissions string represents the entry type, where - represents a regular file, d represents a directory, l represents a symbolic link, and so on (e.g., drw-r--r--).

Modifying file permissions

To change the permissions of a file or directory, you can use the chmod command as follows:

$ chmod permissions entry ...

Where:

• permissions is the list of permissions in the octal or symbolic notation.
• entry ... is the paths to the files or directories you want to change the permissions of.

Defining permissions using the octal notation

The octal notation is a numeric representation of file permissions in the form of a three-digit number (e.g., 660, 755), where each digit represents a permission set for the owner, the group, and the others.

In this notation, each individual permission is assigned a numeric value:

• 4 represents the read permission.
• 2 represents the write permission.
• 1 represents the execute permission.
• 0 represents the absence of permission.

And then added up to create an individual permission set.

For example:

• 7 is the equivalent of the rwx permission set (4 + 2 + 1).
• 6 is the equivalent of the rw- permission set (4 + 2 + 0).
• 5 is the equivalent of the r-x permission set (4 + 0 + 1).
• 3 is the equivalent of the -wx permission set (0 + 2 + 1).

Example

For example, this command will change the permissions of the script.sh file:

$ chmod 754 script.sh

Where:

• The owner can read, write, and execute the file.
• The group can read and execute the file.
• The others can only read the file.

Which can be verified using the ls command:

$ ls -l script.sh
-rwxr-xr--  1 razvan  staff   0 Apr 22 16:18 script.sh

Defining permissions using the symbolic notation

The symbolic notation is a representation of file permissions in the form of symbols, that allow to modify permissions relative to the existing ones using the following format:

<who><operator><permissions>

Where:

• who represents who you want to change permissions for, where u stands for owner, g for group, o for others, and a for all.
• operator indicates the operation to perform, where + is used to add permissions, - to remove permissions, and = to set exact permissions.
• permissions specifies the permissions to add, remove, or set, where r stands for read, w for write, and x for execute.

Note that this syntax allows to combine multiple operations in a single command, by chaining them with a comma character (,):

<who><operator><permissions>[,<who><operator><permissions>]

Example

This command will add execute permission to the owner of the file:

$ chmod u+x script.sh

This command will set read and execute permissions to the owner and the group, and will remove write and execute permissions to the others:

$ chmod ug=rx,o-wx script.sh

Overriding permissions using the sudo command

As a reminder, the sudo command allows a permitted user to execute commands with unrestricted access.

To perform specific actions on files and directories regardless of their defined permissions — and without having to change them — you can prepend your command with sudo as follows:

$ sudo command

Note: You can also use the sudo command to change the permissions of any files and directories on the system, regardless of who they belong to. However, you should keep in mind that this could lead to potential security issues and unexpected system behavior.

Temporarily becoming the superuser

The command to become the superuser is su — which stands for substitute user.

When running this command on its own, we are prompted with a password request to log in as the root user.

If we try to input our own password, chances are we'll get the following error message:

$ su
Password:
su: Sorry 

The reason for that, is that by default, modern distributions don't set a root account password in order to prevent any user from logging in as the root user directly, as it would cause a major security issue.

That being said, if your user has superuser privileges, you can still access a root shell by running the su command combined with the -i flag using your own password.

$ su -i
root#

Once successfully logged in, the prompt will change to indicate you that you're now using a root shell.

Whenever you're done, simply run the exit command to come back to your regular user session — but try to keep in mind that the usage of this root shell must be kept to a real minimum.

Best practices

As a rule of thumb, you should only grant permissions to users and groups based on what they need to accomplish, which implies:

• Limiting read access to sensitive files containing confidential information.
• Limiting write access to critical files to prevent accidental or malicious modifications.
• Using groups to grant access to users with similar roles in your organization.
• Avoiding modifying the permissions of system files owned by the root user.

Summary

Here's a summary of what you've learned in this lesson:

• File permissions are settings that determine who can read, write, and execute a particular file or directory.
• File permissions are defined for the owner, the group, and the others.
• File permissions can be expressed in two different notations: symbolic and octal.
• In the symbolic notation, r is for read, w is for write, x is for execute, and - is for none.
• In the octal notation, 4 is for read, 2 is for write, 1 is for execute, and 0 is for none.
• The ls -l command is used to list files in the extended format.
• The chmod command is used to change the permissions of files and directories.
• The sudo command is used to temporarily override file permissions without changing them.