File Permissions — Access Control in Linux

🎯 Learning Objectives

• Understand the rwx permission model (owner, group, others)
• Use chmod with symbolic and octal notation
• Change file ownership with chown
• Set default permissions with umask
• Understand special permissions (setuid, setgid, sticky bit)

1. The rwx Permission Model

bash
$ ls -l
-rwxr-xr--  1 alice developers  1024 Jan 15 10:30 script.sh

javascript
Run Inline
-    rwx    r-x    r--
│    └┬┘    └┬┘    └┬┘
│     │      │      └── Others permissions (read)
│     │      └───────── Group permissions (read + execute)
│     └──────────────── Owner permissions (read + write + execute)
└────────────────────── File type (-=file, d=directory, l=link)

2. Changing Permissions — chmod

2.1 Symbolic Mode

bash
# Add permissions
chmod u+x file.sh       # Add execute for owner (user)
chmod g+w file.txt      # Add write for group
chmod o+r file.txt      # Add read for others
chmod a+x file.sh       # Add execute for all (owner+group+others)
# Remove permissions
chmod u-x file.sh       # Remove execute from owner
chmod g-w file.txt      # Remove write from group
chmod o-r file.txt      # Remove read from others
# Set exact permissions
chmod u=rwx file.sh     # Owner: rwx
chmod g=rx file.sh      # Group: r-x
chmod o=r file.sh       # Others: r--
# Combine
chmod u+rwx,g+rx,o+r file.sh

2.2 Octal Mode

bash
chmod 755 script.sh      # Owner: rwx (7), Group: r-x (5), Others: r-x (5)
chmod 644 file.txt        # Owner: rw- (6), Group: r-- (4), Others: r-- (4)
chmod 700 private/        # Owner: rwx (7), Others: --- (0)
chmod 600 secret.txt      # Owner: rw- (6), Others: --- (0)
chmod 777 public.sh       # ⚠️ Everyone: rwx (7) — dangerous!

2.3 Recursive Changes

bash
chmod -R 755 directory/    # Apply to directory and all contents
chmod -R u+rwX directory/  # Add read/write, execute only for directories

3. Changing Ownership — chown

bash
# Change owner
chown alice file.txt        # Set owner to alice
chown alice:developers file.txt  # Set owner:group
chown :developers file.txt  # Set group only
# Recursive
chown -R alice:developers /home/alice/
# Need sudo for most chown operations
sudo chown root:root system_file

4. Default Permissions — umask

bash
umask           # Show current umask (e.g., 0022)
umask 022       # Set umask (files: 644, dirs: 755)
umask 077       # Restrictive (files: 600, dirs: 700)

• Default file: 666, umask 022 → 666 - 022 = 644 (rw-r--r--)
• Default dir: 777, umask 022 → 777 - 022 = 755 (rwxr-xr-x)

5. Special Permissions

5.1 setuid (SUID) — 4xxx

bash
chmod u+s executable     # Symbolic: add SUID
chmod 4755 executable    # Octal: 4 = SUID
# Example: /usr/bin/passwd has SUID (rwsr-xr-x)

5.2 setgid (SGID) — 2xxx

• File: Runs with group privileges
• Directory: New files inherit the directory's group

bash
chmod g+s directory/     # Symbolic: add SGID
chmod 2755 directory/    # Octal: 2 = SGID

5.3 Sticky Bit — 1xxx

bash
chmod +t shared_dir/     # Symbolic: add sticky bit
chmod 1777 shared_dir/   # Octal: 1 = sticky bit
# /tmp typically has permissions drwxrwxrwt

6. Practice Questions

Q1: What does permission -rwxr--r-- mean?

Answer: File type: - (regular file). Owner: rwx (read, write, execute). Group: r-- (read only). Others: r-- (read only). Q2: What does chmod 755 script.sh do?

Answer: Sets permissions to rwxr-xr-x: owner has read/write/execute (7), group and others have read/execute (5). Q3: What is the difference between u, g, and o in chmod?

Answer: u = owner (user), g = group, o = others (everyone else). a = all three combined. Q4: What does umask 077 mean?

Answer: New files get permissions 666 - 077 = 600 (rw-------). New directories get 777 - 077 = 700 (rwx------). This is a restrictive umask for privacy. Q5: Why is chmod 777 dangerous?

Answer: It gives read, write, and execute permissions to everyone (owner, group, others). Any user on the system can modify or execute the file, which is a security risk. Q6: What does the sticky bit do?

Answer: On a directory with sticky bit (/tmp), users can only delete their own files, even if they have write permission on the directory. Shown as t in the permissions (e.g., /tmp: drwxrwxrwt). Q7: How do you set permissions so owner can read/write, others can only read?

Answer: chmod 644 file.txt or chmod u=rw,go=r file.txt Q8: What does chown alice:staff file.txt do?

Answer: Changes the owner to alice and the group to staff. Both owner and group are set in one command.

📐 Key Concepts

🔗 Cross-References

• Next: Text Processing Join Discord Previous2.1 File OperationsNext4.1 Text Processing