Mastering the Linux Command Line and System Logic
File Security
Who Can Do What?
In Linux, everything is a file, and every file has a set of rules attached to it. These rules, called permissions, dictate who can read, write to, or execute the file. It’s like a digital bouncer for your data.
Permissions are broken down into three basic types:
- Read (r): The ability to view the contents of a file or list the contents of a directory.
- Write (w): The ability to change a file's content or to create/delete files within a directory.
- Execute (x): The ability to run a file (if it's a program or script) or enter a directory (to access its contents).
These permissions are assigned to three different classes of users:
- Owner: The user who created the file.
- Group: A collection of users who share a set of permissions.
- Others: Everyone else on the system.
When you use ls -l, you see these permissions listed as a string of ten characters, like -rwxr-x--x. The first character tells you the file type (- for a file, d for a directory). The next nine characters are three sets of rwx, showing the permissions for the owner, the group, and others, respectively. In this example, the owner can read, write, and execute; the group can read and execute; and others can only execute.
Changing Permissions with `chmod`
The chmod (change mode) command is your tool for modifying file permissions. You can use it in two ways: symbolic mode, which is more readable, and numeric mode, which is faster once you get the hang of it.
Symbolic mode uses letters to represent users (
ufor owner,gfor group,ofor others,afor all) and permissions (r,w,x). You use+to add a permission,-to remove it, and=to set it exactly.
# Let's start with a file with permissions rw-r--r--
# Add execute permission for the owner (user)
chmod u+x script.sh
# Remove write permission for the group
chmod g-w shared_document.txt
# Set permissions for others to be read-only
chmod o=r data.log
# Add write permission for both user and group
chmod ug+w config.ini
Numeric mode, also called mode, is more concise. It represents each permission set (owner, group, others) with a single digit. Each permission type has a numeric value:
- read (r) = 4
- write (w) = 2
- execute (x) = 1
To get the number for a permission set, you just add the values together. For example, rwx is $4+2+1=7$, and r-x is $4+0+1=5$. A full permission set like rwxr-x--x becomes 751.
| Permission | Binary | Octal Digit |
|---|---|---|
--- | 000 | 0 |
--x | 001 | 1 |
-w- | 010 | 2 |
-wx | 011 | 3 |
r-- | 100 | 4 |
r-x | 101 | 5 |
rw- | 110 | 6 |
rwx | 111 | 7 |
Using numeric mode is straightforward. You provide chmod with the three-digit number representing the permissions for the owner, group, and others.
# Set permissions to rwxr-xr-x (owner can do everything, group and others can read/execute)
chmod 755 script.sh
# Set permissions to rw-r----- (owner can read/write, group can read, others have no access)
chmod 640 sensitive_data.txt
# Give full permissions to everyone (not recommended for most files!)
chmod 777 temporary_file
Changing Ownership
Sometimes changing permissions isn't enough. You need to change who owns the file. This is common in system administration when managing files for different users or services.
The chown (change owner) command changes the owner of a file or directory. You can also use it to change the group at the same time by specifying user:group.
The chgrp (change group) command changes only the group ownership.
# Change the owner of report.pdf to the user 'alice'
chown alice report.pdf
# Change the group of a shared directory to 'developers'
chgrp developers /var/www/project/
# Change both the owner to 'bob' and the group to 'editors'
chown bob:editors article.docx
Most users can only change the ownership of files they already own. To change the ownership of any file, you need special privileges. This is where the comes in. The root user is the superuser, an account with unrestricted access to the entire system. Because of its power, you should only use the root account when absolutely necessary, typically by prefixing commands with sudo (superuser do).
Special Permissions
Beyond the basic rwx, there are three special permissions that handle more advanced scenarios. You’ll see them pop up in the execute permission slot for the owner, group, or others.
-
SUID (Set User ID): When a file with SUID is executed, it runs with the permissions of the file's owner, not the user who ran it. This is often used for programs that need temporary elevated privileges, like the
passwdcommand, which needs to modify a protected file (/etc/shadow) to change your password. It appears as ansin the owner's execute slot. -
SGID (Set Group ID): Similar to SUID, an executable with SGID runs with the group permissions of the file's group. When set on a directory, any new files or subdirectories created inside it will inherit the group ownership of the parent directory, which is useful for shared project folders.
-
: This permission has evolved over time. Today, when the sticky bit is set on a directory, it means that only the file's owner (or the root user) can delete or rename a file within that directory, even if others have write permissions. You'll find this on shared directories like
/tmp. It appears as atin the others' execute slot.
# Add the SUID bit (numeric: 4000)
chmod u+s /usr/bin/some_tool
chmod 4755 /usr/bin/some_tool
# Add the SGID bit (numeric: 2000)
chmod g+s /data/shared
chmod 2775 /data/shared
# Add the sticky bit (numeric: 1000)
chmod +t /tmp
chmod 1777 /tmp
Default Permissions with umask
Tired of setting permissions every time you create a file? That's what umask (user mask) is for. It sets the default permissions for newly created files and directories.
The umask value is a three-digit octal number that is 'subtracted' from the base permissions. For files, the base permission is 666 (rw-rw-rw-). For directories, it's 777 (rwxrwxrwx).
A common umask is 022. Let's see how it works:
- For a new directory:
777-022=755(rwxr-xr-x) - For a new file:
666-022=644(rw-r--r--)
You can check your current umask by simply typing umask and change it for your current session by providing a new value, like umask 077 to create private files by default.
Now that you understand how to control access to your files, let's test your knowledge.
What are the permissions for a file if the octal notation is 644?
Which command is used to change only the group ownership of a file?
Mastering permissions is a fundamental step toward becoming a proficient Linux administrator. It's the lock and key for your entire system.