FilePermissions
845
Comment:
|
6568
edits & formatting
|
Deletions are marked like this. | Additions are marked like this. |
Line 3: | Line 3: |
||<tablestyle="float:right; font-size: 0.9em; width:40%; background:#F1F1ED; margin: 0 0 1em 1em;" style="padding:0.5em;">'''Contents'''[[BR]][[TableOfContents]]|| |
|
Line 6: | Line 8: |
In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a linux system has permissions that allow or prevent others from viewing, modifying or executing. The super user "root" has the ability to access any file on the system. | In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a system have permissions that allow or prevent others from viewing, modifying or executing. If the file is of type Directory then it restricts different actions than files and device nodes. The super user "root" has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are refered to as bits. |
Line 8: | Line 10: |
Each file has access and user restrictions. | To change or edit files that are owned by root, '''sudo''' must be used - please see RootSudo for details. |
Line 10: | Line 12: |
Three types of access restrictions. | If the owner read & execute bit are on, then the permissions are: {{{ -r-x------ }}} There are three types of access restrictions: || '''Permission'''|| '''Action'''|| '''chmod option'''|| || read|| (view) ||r = 4|| || write|| (edit) ||w = 2|| || execute|| (execute) ||x = 1|| |
Line 13: | Line 25: |
read write execute |
There are also three types of user restrictions: || '''User'''|| '''''ls'' output'''|| || owner||-rwx--``--``--|| || group||--``--rwx---|| || other||--``--``---rwx|| |
Line 18: | Line 33: |
Three types of user restrictions. | Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes. || '''Permission'''|| '''Action'''|| chmod option'''|| || read|| (view contents, i.e. ls command) ||r = 4|| || write|| (create or remove files from dir) ||w = 2|| || execute|| (cd into directory) ||x = 1|| |
Line 21: | Line 41: |
owner group other |
* read restricts or allows viewing the directories contents, i.e. ''ls'' command * write restricts or allows creating new files or deleting files in the directory. (Caution: write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!) * execute restricts or allows changing into the directory, i.e. ''cd'' command |
Line 26: | Line 46: |
The command to use when modifying permissions is chmod. | |
Line 28: | Line 47: |
== Permissions in Action == {{{ user@host:/home/user$ ls -l /etc/hosts -rw-r--r-- 1 root root 288 2005-11-13 19:24 /etc/hosts user@host:/home/user$ }}} Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group. What are the permissions from the above /etc/hosts ls output? {{{ -rw-r--r-- owner = Read & Write (rw-) group = Read (r--) other = Read (r--) }}} == Changing Permissions == The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access. {{{ user@host:/home/user# ls -l /etc/shadow -rw-r----- 1 root shadow 869 2005-11-08 13:16 /etc/shadow user@host:/home/user# Permissions: owner = Read & Write (rw-) group = Read (r--) other = None (---) Ownership: owner = root group = shadow }}} === chmod with Letters === Here are a few examples of chmod usage with letters (try these out on your system): First create some empty files: {{{ user@host:/home/user$ touch file1 file2 file3 file4 user@host:/home/user$ ls -l total 0 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file4 }}} Add owner execute bit: {{{ user@host:/home/user$ chmod u+x file1 user@host:/home/user$ ls -l file1 -rwxr--r-- 1 user user 0 Nov 19 20:13 file1 }}} Add other write & execute bit: {{{ user@host:/home/user$ chmod o+wx file2 user@host:/home/user$ ls -l file2 -rw-r--rwx 1 user user 0 Nov 19 20:13 file2 }}} Remove group read bit: {{{ user@host:/home/user$ chmod g-r file3 user@host:/home/user$ ls -l file3 -rw----r-- 1 user user 0 Nov 19 20:13 file3 }}} Add read, write and execute to everyone: {{{ user@host:/home/user$ chmod ugo+rwx file4 user@host:/home/user$ ls -l file4 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 user@host:/home/user$ }}} === chmod with Numbers === Here are a few examples of chmod usage with numbers (try these out on your system): First create some empty files: {{{ user@host:/home/user$ touch file1 file2 file3 file4 user@host:/home/user$ ls -l total 0 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file4 }}} Add owner execute bit: {{{ user@host:/home/user$ chmod 744 file1 user@host:/home/user$ ls -l file1 -rwxr--r-- 1 user user 0 Nov 19 20:13 file1 }}} Add other write & execute bit: {{{ user@host:/home/user$ chmod 647 file2 user@host:/home/user$ ls -l file2 -rw-r--rwx 1 user user 0 Nov 19 20:13 file2 }}} Remove group read bit: {{{ user@host:/home/user$ chmod 604 file3 user@host:/home/user$ ls -l file3 -rw----r-- 1 user user 0 Nov 19 20:13 file3 }}} Add read, write and execute to everyone: {{{ user@host:/home/user$ chmod 777 file4 user@host:/home/user$ ls -l file4 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 user@host:/home/user$ }}} === chmod with sudo === Changing permissions on files that you do not have ownership of: ('''Note''' that changing permissions the wrong way on the wrong files can quickly mess up your system a great deal! Please be careful when using '''sudo'''!) {{{ user@host:/home/user$ ls -l /usr/local/bin/somefile -rw-r--r-- 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile user@host:/home/user$ user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile user@host:/home/user$ ls -l /usr/local/bin/somefile -rw-r--r-x 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile user@host:/home/user$ }}} For more information see: * ''man chmod'' * ''man chown'' * ''man chgrp'' == ToDo == * sticky bit * umask * Recursive chmod with -R |
ContentsBRTableOfContents |
Understanding and Using File Permissions
In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a system have permissions that allow or prevent others from viewing, modifying or executing. If the file is of type Directory then it restricts different actions than files and device nodes. The super user "root" has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are refered to as bits.
To change or edit files that are owned by root, sudo must be used - please see RootSudo for details.
If the owner read & execute bit are on, then the permissions are:
-r-x------
There are three types of access restrictions:
Permission |
Action |
chmod option |
read |
(view) |
r = 4 |
write |
(edit) |
w = 2 |
execute |
(execute) |
x = 1 |
There are also three types of user restrictions:
User |
ls output |
owner |
-rwx------ |
group |
----rwx--- |
other |
-------rwx |
Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes.
Permission |
Action |
chmod option |
read |
(view contents, i.e. ls command) |
r = 4 |
write |
(create or remove files from dir) |
w = 2 |
execute |
(cd into directory) |
x = 1 |
read restricts or allows viewing the directories contents, i.e. ls command
- write restricts or allows creating new files or deleting files in the directory. (Caution: write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!)
execute restricts or allows changing into the directory, i.e. cd command
Permissions in Action
user@host:/home/user$ ls -l /etc/hosts -rw-r--r-- 1 root root 288 2005-11-13 19:24 /etc/hosts user@host:/home/user$
Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group.
What are the permissions from the above /etc/hosts ls output?
-rw-r--r-- owner = Read & Write (rw-) group = Read (r--) other = Read (r--)
Changing Permissions
The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access.
user@host:/home/user# ls -l /etc/shadow -rw-r----- 1 root shadow 869 2005-11-08 13:16 /etc/shadow user@host:/home/user# Permissions: owner = Read & Write (rw-) group = Read (r--) other = None (---) Ownership: owner = root group = shadow
chmod with Letters
Here are a few examples of chmod usage with letters (try these out on your system):
First create some empty files:
user@host:/home/user$ touch file1 file2 file3 file4 user@host:/home/user$ ls -l total 0 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file4
Add owner execute bit:
user@host:/home/user$ chmod u+x file1 user@host:/home/user$ ls -l file1 -rwxr--r-- 1 user user 0 Nov 19 20:13 file1
Add other write & execute bit:
user@host:/home/user$ chmod o+wx file2 user@host:/home/user$ ls -l file2 -rw-r--rwx 1 user user 0 Nov 19 20:13 file2
Remove group read bit:
user@host:/home/user$ chmod g-r file3 user@host:/home/user$ ls -l file3 -rw----r-- 1 user user 0 Nov 19 20:13 file3
Add read, write and execute to everyone:
user@host:/home/user$ chmod ugo+rwx file4 user@host:/home/user$ ls -l file4 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 user@host:/home/user$
chmod with Numbers
Here are a few examples of chmod usage with numbers (try these out on your system):
First create some empty files:
user@host:/home/user$ touch file1 file2 file3 file4 user@host:/home/user$ ls -l total 0 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file4
Add owner execute bit:
user@host:/home/user$ chmod 744 file1 user@host:/home/user$ ls -l file1 -rwxr--r-- 1 user user 0 Nov 19 20:13 file1
Add other write & execute bit:
user@host:/home/user$ chmod 647 file2 user@host:/home/user$ ls -l file2 -rw-r--rwx 1 user user 0 Nov 19 20:13 file2
Remove group read bit:
user@host:/home/user$ chmod 604 file3 user@host:/home/user$ ls -l file3 -rw----r-- 1 user user 0 Nov 19 20:13 file3
Add read, write and execute to everyone:
user@host:/home/user$ chmod 777 file4 user@host:/home/user$ ls -l file4 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 user@host:/home/user$
chmod with sudo
Changing permissions on files that you do not have ownership of: (Note that changing permissions the wrong way on the wrong files can quickly mess up your system a great deal! Please be careful when using sudo!) For more information see: man chmod man chown man chgrp
user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-- 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$
user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile
user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-x 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$
ToDo
FilePermissions (last edited 2008-08-06 16:27:42 by localhost)