File Permissions

🎯 Learning Objective

Master the Linux permission model to understand how access control works for files and directories, interpret ls -l output, and diagnose permission-related issues in multi-user systems.

📚 Concept Introduction

Every file and directory in Linux has a built-in security system that controls who can access them and what they can do. Think of it like a sophisticated lock system on a building - some people have keys to certain rooms, others can only look through windows, and some can't enter at all.

This permission system is fundamental to Linux security and enables multiple people to work on the same system safely without interfering with each other's files or accessing sensitive information they shouldn't see.

📁 Pre-created for this unit:

• readable_file.txt - File for practicing read permission analysis
• executable_script.sh - Script for practicing execute permission analysis
• restricted_dir/ - Directory for practicing access control analysis

👥 The Three Access Levels: User, Group, Other (UGO)

◆ Understanding Who Gets What Access

Linux organizes access control around three categories of people, commonly called UGO:

User (u): The file owner - the person who created the file or was assigned ownership. Think of this as the homeowner who has the master key.

Group (g): A collection of users who share common access needs. Like family members who all have keys to the house.

Other (o): Everyone else on the system - all the users who aren't the owner and don't belong to the file's group. These are like visitors who may or may not be allowed inside.

This three-tier system gives you precise control: you can set different rules for yourself, your team, and everyone else.

🔐 The Three Permission Types: Read, Write, Execute

◆ Understanding What Actions Are Allowed

Each of the three access levels can be granted three types of permissions. What these permissions mean depends on whether you're dealing with a file or a directory:

Key insight for directories: The execute permission is what lets you actually "go into" a directory. Without it, you can't cd into the directory even if you can see it exists.

📄 Reading Permissions with ls -l

◆ Decoding the Permission Display

The ls -l command reveals the permission details for every file and directory. It's like reading the access card permissions for each room in a building.

ls -l

Example output for a file:

-rw-r--r-- 1 laborant laborant 45 May 22 10:30 readable_file.txt

Example output for a directory:

drwxr-xr-x 2 laborant laborant 4096 May 22 10:31 restricted_dir

◆ Understanding the 10-Character Code

Let's decode that cryptic-looking permission string (-rw-r--r--):

Reading tip: Think of it as three groups of three characters each, after the file type indicator.

◆ The Numeric Shorthand

Each permission has a numeric value that makes calculations quick:

You add the numbers for each group. So rwx = 4+2+1 = 7, and r-- = 4+0+0 = 4.

Examples:

• rwxr-xr-x becomes 755 (7 for user, 5 for group, 5 for other)
• rw-r--r-- becomes 644 (6 for user, 4 for group, 4 for other)

📋 Essential Command Reference

💡 Key Takeaways

Linux permissions operate on three levels: User (owner), Group, and Other, each with Read, Write, and Execute capabilities. The ls -l command reveals these permissions in a 10-character format where the first character indicates file type and the remaining nine show UGO permissions. Understanding both symbolic (rwx) and numeric (755) notation helps you quickly assess and communicate about file access rights. This permission model forms the foundation of Linux security and enables safe multi-user collaboration.

🎯 Learning Objective

Master the chmod command to change file and directory permissions, using both symbolic and numeric modes to apply precise access control rules.

📚 Concept Introduction

Now that you can read permissions, it's time to take control and change them. The chmod (change mode) command is like having a master key that lets you rewrite the access rules for any file or directory you own.

Whether you need to make a script executable, protect a sensitive file, or give your team collaborative access to a project folder, chmod gives you the precision tools to set exactly the right permissions for every situation.

📁 Pre-created for this unit:

• readable_file.txt - A file with standard read permissions (rw-r--r--)
• private_file.dat - A file with restricted owner-only permissions (rw-------)
• shared_script.sh - A script with overly permissive rights to be fixed (rwxrwxrwx)

✍️ Symbolic Mode: Precise Permission Surgery

Symbolic mode is like using a scalpel - it lets you make precise changes to specific permissions without affecting anything else. This approach is intuitive and perfect when you know exactly what you want to adjust.

◆ The Symbolic Toolkit

The format follows a logical structure: [Who][Operator][Permission]

◆ Practical Scenarios: Surgical Permission Changes

Let's work through real-world situations using the files in your directory.

Making a file collaborative: Your team needs to edit readable_file.txt, but currently only you can modify it. Grant write access to your group without changing anything else:

chmod g+w readable_file.txt

This surgically adds write permission for the group, changing rw-r--r-- to rw-rw-r--. Your permissions and others' permissions remain untouched.

Tightening security: The shared_script.sh file is too open - everyone can read, write, and execute it. Remove all access for "others" to make it more secure:

chmod o-rwx shared_script.sh

This strips away all permissions from "others," changing rwxrwxrwx to rwxrwx---. Now only you and your group can access it.

Setting exact permissions: Sometimes you want to set precise permissions regardless of what was there before. The = operator replaces rather than modifies:

chmod g=r readable_file.txt

This sets the group permissions to exactly read-only, regardless of what they were before.

🔢 Numeric Mode: Complete Permission Blueprints

Numeric mode is like architectural blueprints - it defines the complete permission structure in one precise specification. This approach is faster when you know exactly what the final permissions should look like.

◆ Understanding the Numbers

Each permission has a numeric value that you add together:

Add the values for each group (User, Group, Other) to create a three-digit code.

◆ Common Permission Blueprints

700 - Private executable script (rwx------): Perfect for personal scripts that contain sensitive information:

chmod 700 shared_script.sh

• User: rwx (7) - You have complete control
• Group: --- (0) - Your group has no access
• Other: --- (0) - Everyone else is locked out

664 - Collaborative document (rw-rw-r--): Ideal for project files where you and your team can edit, but others can only read:

chmod 664 readable_file.txt

• User: rw- (6) - You can read and write
• Group: rw- (6) - Your team can read and write
• Other: r-- (4) - Others can only read

755 - Standard executable (rwxr-xr-x): The classic permission for programs and scripts that others should be able to run:

• User: rwx (7) - You control everything
• Group: r-x (5) - Group can read and execute, but not modify
• Other: r-x (5) - Others can read and execute, but not modify

🌀 Recursive Permission Changes

When you need to apply permissions to a directory and everything inside it, use the -R (recursive) flag:

chmod -R 755 /path/to/directory

Important consideration: Be careful with recursive changes, especially with the write permission. You might accidentally make files writable that should be read-only, or remove execute permission from directories (making them inaccessible).

📋 Essential Command Reference

💡 Key Takeaways

The chmod command gives you precise control over file and directory permissions using two approaches: symbolic mode for targeted changes and numeric mode for complete permission blueprints. Symbolic mode (u+x, g-w) is perfect for making specific adjustments, while numeric mode (755, 644) quickly sets complete permission structures. Understanding both methods allows you to efficiently manage access control whether you need surgical precision or comprehensive restructuring. Always consider the security implications of your changes, especially when using recursive operations on directories.

🎯 Learning Objective

Master the umask command to understand and control the default permissions assigned to newly created files and directories, ensuring your system follows security best practices.

📚 Concept Introduction

Have you ever wondered why new files don't automatically get full permissions when you create them? This is thanks to umask - a security feature that acts like a permission filter, automatically removing certain permissions to keep your new files from being too open by default.

Think of umask as a security template that automatically applies sensible restrictions to everything you create. It's working behind the scenes every time you use touch, mkdir, or save a file, making sure you start with reasonable security settings rather than wide-open permissions.

🎭 Understanding the Mask Concept

The umask isn't a set of permissions to grant - it's a filter that specifies which permissions to remove from new files and directories. It's like a security stencil that blocks certain permissions from being applied.

◆ The Permission Starting Points

Linux begins with theoretical maximum permissions that would be applied without any filtering:

For new files: 666 (rw-rw-rw-)

• Files don't get execute permission by default (security feature - prevents accidental execution)

For new directories: 777 (rwxrwxrwx)

• Directories need execute permission to be accessible, so they start with full permissions

The umask then subtracts from these starting points to create the actual permissions.

◆ How the Filtering Works

If your umask is 022, here's what happens:

• The 0 means don't remove any permissions from the user (owner)
• The 2 means remove write permission from the group
• The 2 means remove write permission from others

So new files become 644 (rw-r--r--) and directories become 755 (rwxr-xr-x).

🔍 Viewing Your Current umask

Understanding your current umask setting helps you predict what permissions new files will have.

View the numeric umask:

umask

You'll typically see output like 0022 or 0002. The leading zero can usually be ignored - it's there for technical reasons.

View the symbolic umask (more intuitive):

umask -S

Example output:

u=rwx,g=rx,o=rx

This shows what permissions are allowed for each group, making it easier to understand than the numeric version.

➗ Understanding umask Mathematics

The umask value is subtracted from the base permissions. Let's work through the common umask of 022:

For a new file:

• Base permissions: 666 (rw-rw-rw-)
• Minus umask: 022 (removes write from group and others)
• Result: 644 (rw-r--r--)

For a new directory:

• Base permissions: 777 (rwxrwxrwx)
• Minus umask: 022 (removes write from group and others)
• Result: 755 (rwxr-xr-x)

◆ Practical Examples of Different umask Values

🔧 Changing Your umask

You can temporarily change your umask for the current session, which affects all new files and directories you create.

◆ Setting a New umask

For collaborative work (allow group writing):

umask 002

This lets your group members edit files you create, perfect for team projects.

For high security (private files only):

umask 077

This makes all new files and directories accessible only to you.

Back to standard security:

umask 022

This returns to the common default where others can read but not modify your files.

🌐 Making umask Changes Permanent

umask changes only last for your current terminal session. To make them permanent, you need to add the umask command to your shell's configuration file.

◆ Common Configuration Files

• Bash: ~/.bashrc or ~/.bash_profile
• Zsh: ~/.zshrc
• System-wide: /etc/profile

Add a line like umask 002 to your chosen file, and it will apply every time you log in.

📋 Essential Command Reference

💡 Key Takeaways

The umask acts as a security filter that automatically removes specified permissions from newly created files and directories. It works by subtracting values from base permissions (666 for files, 777 for directories) to create sensible defaults. Understanding umask helps you predict and control the permissions of new content, ensuring appropriate security levels whether you're working alone, collaborating with a team, or handling sensitive data. Changes to umask only affect new files created after the change, and the setting lasts only for your current session unless made permanent in your shell configuration.