Unix / Linux - File Permission

Unix / Linux - File Permissions and Access Modes

File permissions are a cornerstone of Unix security, controlling who can access files and what they can do with them. Every file and directory has associated ownership and permissions.

There are three levels of ownership:

• Owner: The user who created the file or directory. The owner typically has the most control.
• Group: A collection of users. Files belong to a group, and permissions can be set for all members of that group.
• Other (World): Any user who is not the owner and does not belong to the file’s group.

For each of these levels (Owner, Group, Other), three basic permissions can be granted or denied.

The Permission Indicators

The ls -l command provides a detailed listing, including permissions. The first column shows the file type and permissions:

$ ls -l
total 8
-rw-r--r-- 1 user staff 1024 Jul 25 10:30 report.txt
drwxr-x--- 2 user staff 4096 Jul 25 10:35 project_files

Let’s break down the first column (e.g., -rw-r--r-- or drwxr-x---):

• Character 1: File Type (- for regular file, d for directory, l for symbolic link, etc.).
• Characters 2-4: Owner Permissions (User). rw- means read and write, no execute.
• Characters 5-7: Group Permissions. r-- means read only.
• Characters 8-10: Other Permissions (World). r-- means read only.

The permissions are always in the order: read (r), write (w), execute (x). A hyphen (-) indicates the permission is denied.

File Access Modes

The meaning of the basic permissions depends slightly on whether it’s a file or a directory:

For Files:

• Read (r): Allows viewing the file’s contents.
• Write (w): Allows modifying or deleting the file’s contents. Note: Deleting the file itself often depends on the directory permissions.
• Execute (x): Allows running the file as a program or script (if it’s executable).

For Directories:

• Read (r): Allows listing the contents of the directory (filenames).
• Write (w): Allows creating, deleting, or renaming files within the directory (requires execute permission as well).
• Execute (x): Allows entering (changing into) the directory and accessing files/subdirectories within it (often called the ‘search’ or ‘traverse’ permission).

Common Pitfall: To access a file like /home/user/docs/file.txt, you need execute (x) permission on /, /home, /home/user, and /home/user/docs, plus the necessary permissions (e.g., read) on file.txt itself.

Changing Permissions with chmod

The chmod (change mode) command modifies file or directory permissions. It can be used in two ways: symbolic mode and octal (absolute) mode.

Symbolic Mode

Symbolic mode uses letters to represent who (u=user/owner, g=group, o=other, a=all), the operation (+ to add, - to remove, = to set exactly), and the permission (r, w, x).

Scope	Operator	Permission
u (user/owner)	+ (add)	r (read)
g (group)	- (remove)	w (write)
o (other)	= (set exactly)	x (execute)
a (all = ugo)

Example: Start with myfile.txt having permissions -rw-------.

$ ls -l myfile.txt
-rw------- 1 user staff 1024 Jul 25 10:40 myfile.txt

# Add read permission for group and other
$ chmod go+r myfile.txt
$ ls -l myfile.txt
-rw-r--r-- 1 user staff 1024 Jul 25 10:40 myfile.txt

# Remove write permission for owner
$ chmod u-w myfile.txt
$ ls -l myfile.txt
-r--r--r-- 1 user staff 1024 Jul 25 10:40 myfile.txt

# Set execute permission only for the owner (removes r/w for owner)
$ chmod u=x myfile.txt
$ ls -l myfile.txt
--x-r--r-- 1 user staff 1024 Jul 25 10:40 myfile.txt

# Add write for user, set group to read-execute, remove all for other
$ chmod u+w,g=rx,o= myfile.txt
$ ls -l myfile.txt
--wxr-x--- 1 user staff 1024 Jul 25 10:40 myfile.txt

Octal (Absolute) Mode

Octal mode uses numbers to represent permissions. Each permission has a value: read (4), write (2), execute (1). Sum these values for each scope (owner, group, other).

Number	Binary	Permissions	Meaning
0	000	---	No permission
1	001	—x	Execute only
2	010	-w-	Write only
3	011	-wx	Write and execute
4	100	r—	Read only
5	101	r-x	Read and execute
6	110	rw-	Read and write
7	111	rwx	Read, write, and execute

A three-digit octal number sets permissions for owner, group, and other, respectively.

• 7 = rwx (4+2+1)
• 6 = rw- (4+2+0)
• 5 = r-x (4+0+1)
• 4 = r-- (4+0+0)

Example: Set permissions to Owner=rwx, Group=rx, Other=r (rwxr-xr--)

# Owner = rwx = 7
# Group = r-x = 5
# Other = r-- = 4
$ chmod 754 script.sh
$ ls -l script.sh
-rwxr-xr-- 1 user staff 256 Jul 25 10:55 script.sh

Example: Set permissions to Owner=rw, Group=r, Other=no access (rw-r-----)

# Owner = rw- = 6
# Group = r-- = 4
# Other = --- = 0
$ chmod 640 config.dat
$ ls -l config.dat
-rw-r----- 1 user staff 102 Jul 25 11:00 config.dat

Best Practice: Apply the principle of least privilege. Only grant the permissions necessary for a user or process to perform its function.

Changing Ownership: chown and chgrp

You can change the owner and group of a file or directory using chown and chgrp.

Changing Owner (chown)

Syntax: chown new_owner file_or_directory

Syntax (change owner and group simultaneously): chown new_owner:new_group file_or_directory

# Change owner of data.csv to 'alice'
$ chown alice data.csv

# Change owner to 'bob' and group to 'editors' for report.doc
$ chown bob:editors report.doc

Note: Regular users can typically only change the ownership of files they own, and usually only to groups they are members of. The root user (superuser) can change ownership freely. Use the -R option for recursive changes on directories.

Changing Group (chgrp)

Syntax: chgrp new_group file_or_directory

# Change group of shared_script.py to 'developers'
$ chgrp developers shared_script.py

Again, permissions and group memberships apply. Use -R for recursive changes.

Special Permissions: SUID, SGID, and Sticky Bit

Beyond r, w, and x, there are special permission bits that alter execution behavior or directory interaction.

SUID (Set User ID)

When set on an executable file, the SUID bit allows a user running the file to temporarily assume the privileges of the file’s owner during execution. This is often used for commands that need elevated privileges for specific tasks, like passwd which needs to modify /etc/shadow (owned by root).

Indicated by an s in the owner’s execute permission slot (-rwsr-xr-x). If the owner doesn’t have execute permission, it shows as S.

Security Warning: SUID executables can be security risks if not carefully written, as they grant elevated privileges. Use chmod u+s file to set or chmod 4755 file (octal).

SGID (Set Group ID)

For executable files: Similar to SUID, but the process runs with the privileges of the file’s group.

For directories: When set on a directory, new files/subdirectories created within it inherit the directory’s group ownership, rather than the primary group of the creating user. This is useful for collaborative project directories.

Indicated by an s in the group’s execute permission slot (-rwxr-sr-x or drwxrwsr-x). If the group doesn’t have execute permission, it shows as S.

Use chmod g+s file_or_dir to set or chmod 2775 dir (octal for directory).

Sticky Bit

Primarily used on directories. When the sticky bit is set on a directory, users can only delete or rename files within that directory if they own the file, own the directory, or are the root user. This prevents users from deleting each other’s files in shared directories like /tmp.

Indicated by a t in the ‘other’ execute permission slot (drwxrwxrwt). If ‘other’ doesn’t have execute permission, it shows as T.

$ ls -ld /tmp
drwxrwxrwt 1 root root 4096 Jul 25 11:20 /tmp

Use chmod +t directory to set or chmod 1777 directory (octal).

Beyond Basic Permissions: Access Control Lists (ACLs)

For more fine-grained control than the standard Owner/Group/Other model allows, many Unix-like systems support Access Control Lists (ACLs). ACLs let you grant permissions to specific additional users or groups.

Common commands include getfacl (to view ACLs) and setfacl (to modify ACLs). A + sign at the end of the permissions in ls -l often indicates an ACL is present.

$ ls -l acl_example.txt
-rw-rwxr--+ 1 user staff 50 Jul 25 11:30 acl_example.txt

$ getfacl acl_example.txt
# file: acl_example.txt
# owner: user
# group: staff
user::rw-
user:alice:rw-  # Alice has specific rw permissions
group::r--
mask::rwx
other::r--

ACLs offer powerful flexibility but add complexity. They are outside the scope of basic permissions but important to be aware of. Consult your system’s documentation (man getfacl, man setfacl) for details.