FilePermissions

Differences between revisions 1 and 3 (spanning 2 versions)
Revision 1 as of 2005-11-20 02:40:41
Size: 845
Editor: adsl-69-109-188-174
Comment:
Revision 3 as of 2005-11-20 04:38:13
Size: 5393
Editor: adsl-69-109-188-174
Comment:
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
||<tablestyle="float:right; font-size: 0.9em; width:40%; background:#F1F1ED; margin: 0 0 1em 1em;" style="padding:0.5em;">'''Contents'''[[BR]][[TableOfContents]]||
Line 6: Line 8:
In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a linux system has permissions that allow or prevent others from viewing, modifying or executing. The super user "root" has the ability to access any file on the system. In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a linux system have permissions that allow or prevent others from viewing, modifying or executing. The super user "root" has the ability to access any file on the system. Each file has access restrictions, user restrictions and have an owner/group association. Permissions are refered to as bit's.
Line 8: Line 10:
Each file has access and user restrictions. If the owner read & execute bit are on the permission will look like this:
{{{
-r-x------
}}}
Line 12: Line 17:

read
write
execute
|| '''Permission'''|| '''Action'''|| '''chmod option'''||
|| read|| (view) ||r = 4||
|| write|| (edit) ||w = 2||
|| execute|| (execute) ||x = 1||
Line 20: Line 25:
|| '''User'''|| '''''ls'' output'''||
|| owner||-rwx--``--``--||
|| group||--``--rwx---||
|| other||--``--``---rwx||
Line 21: Line 30:
owner
group
other
== Permissions in Action ==

{{{
user@host:/home/user$ ls -l /etc/hosts
-rw-r--r-- 1 root root 288 2005-11-13 19:24 /etc/hosts
user@host:/home/user$
}}}

Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group.

What are the permissions from the above /etc/hosts ls output?

{{{
-rw-r--r--

owner = Read & Write (rw-)
group = Read (r--)
other = Read (r--)
}}}
Line 26: Line 51:
The command to use when modifying permissions is chmod. === Changing Permissions ===
Line 28: Line 53:
The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access.

{{{
user@host:/home/user# ls -l /etc/shadow
-rw-r----- 1 root shadow 869 2005-11-08 13:16 /etc/shadow
user@host:/home/user#

Permissions:
owner = Read & Write (rw-)
group = Read (r--)
other = None (---)

Ownership:
owner = root
group = shadow
}}}


==== chmod with Letters ====

Here are a few examples of chmod usage with letters (try these out on your system):

''First create some empty files:''
{{{
user@host:/home/user$ touch file1 file2 file3 file4
user@host:/home/user$ ls -l
total 0
-rw-r--r-- 1 user user 0 Nov 19 20:13 file1
-rw-r--r-- 1 user user 0 Nov 19 20:13 file2
-rw-r--r-- 1 user user 0 Nov 19 20:13 file3
-rw-r--r-- 1 user user 0 Nov 19 20:13 file4
}}}
''Add owner execute bit:''
{{{
user@host:/home/user$ chmod u+x file1
user@host:/home/user$ ls -l file1
-rwxr--r-- 1 user user 0 Nov 19 20:13 file1
}}}
''Add other write & execute bit:''
{{{
user@host:/home/user$ chmod o+wx file2
user@host:/home/user$ ls -l file2
-rw-r--rwx 1 user user 0 Nov 19 20:13 file2
}}}
''Add group read bit:''
{{{
user@host:/home/user$ chmod g-r file3
user@host:/home/user$ ls -l file3
-rw----r-- 1 user user 0 Nov 19 20:13 file3
}}}
''Add read, write and execute to everyone:''
{{{
user@host:/home/user$ chmod ugo+rwx file4
user@host:/home/user$ ls -l file4
-rwxrwxrwx 1 user user 0 Nov 19 20:13 file4
user@host:/home/user$
}}}


==== chmod with Numbers ====

Here are a few examples of chmod usage with numbers (try these out on your system):

''First create some empty files:''
{{{
user@host:/home/user$ touch file1 file2 file3 file4
user@host:/home/user$ ls -l
total 0
-rw-r--r-- 1 user user 0 Nov 19 20:13 file1
-rw-r--r-- 1 user user 0 Nov 19 20:13 file2
-rw-r--r-- 1 user user 0 Nov 19 20:13 file3
-rw-r--r-- 1 user user 0 Nov 19 20:13 file4
}}}
''Add owner execute bit:''
{{{
user@host:/home/user$ chmod 744 file1
user@host:/home/user$ ls -l file1
-rwxr--r-- 1 user user 0 Nov 19 20:13 file1
}}}
''Add other write & execute bit:''
{{{
user@host:/home/user$ chmod 647 file2
user@host:/home/user$ ls -l file2
-rw-r--rwx 1 user user 0 Nov 19 20:13 file2
}}}
''Add group read bit:''
{{{
user@host:/home/user$ chmod 604 file3
user@host:/home/user$ ls -l file3
-rw----r-- 1 user user 0 Nov 19 20:13 file3
}}}
''Add read, write and execute to everyone:''
{{{
user@host:/home/user$ chmod 777 file4
user@host:/home/user$ ls -l file4
-rwxrwxrwx 1 user user 0 Nov 19 20:13 file4
user@host:/home/user$
}}}

==== chmod with sudo ====

Changing permissions on files that you do not have permission to access:
{{{
user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-- 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$

user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile

user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-x 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$
}}}
== ToDo ==

 * sticky bit
 * umask
 * Recursive chmod with -R

Understanding and Using File Permissions

In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a linux system have permissions that allow or prevent others from viewing, modifying or executing. The super user "root" has the ability to access any file on the system. Each file has access restrictions, user restrictions and have an owner/group association. Permissions are refered to as bit's.

If the owner read & execute bit are on the permission will look like this:

-r-x------

Three types of access restrictions.

Permission

Action

chmod option

read

(view)

r = 4

write

(edit)

w = 2

execute

(execute)

x = 1

Three types of user restrictions.

User

ls output

owner

-rwx------

group

----rwx---

other

-------rwx

Permissions in Action

user@host:/home/user$ ls -l /etc/hosts
-rw-r--r--  1 root root 288 2005-11-13 19:24 /etc/hosts
user@host:/home/user$

Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group.

What are the permissions from the above /etc/hosts ls output?

-rw-r--r--

owner = Read & Write (rw-)
group = Read (r--)
other = Read (r--)

Changing Permissions

The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access.

user@host:/home/user# ls -l /etc/shadow
-rw-r-----  1 root shadow 869 2005-11-08 13:16 /etc/shadow
user@host:/home/user#

Permissions:
owner = Read & Write (rw-)
group = Read (r--)
other = None (---)

Ownership:
owner = root
group = shadow

chmod with Letters

Here are a few examples of chmod usage with letters (try these out on your system):

First create some empty files:

user@host:/home/user$ touch file1 file2 file3 file4
user@host:/home/user$ ls -l
total 0
-rw-r--r--  1 user user 0 Nov 19 20:13 file1
-rw-r--r--  1 user user 0 Nov 19 20:13 file2
-rw-r--r--  1 user user 0 Nov 19 20:13 file3
-rw-r--r--  1 user user 0 Nov 19 20:13 file4

Add owner execute bit:

user@host:/home/user$ chmod u+x file1
user@host:/home/user$ ls -l file1
-rwxr--r--  1 user user 0 Nov 19 20:13 file1

Add other write & execute bit:

user@host:/home/user$ chmod o+wx file2
user@host:/home/user$ ls -l file2
-rw-r--rwx  1 user user 0 Nov 19 20:13 file2

Add group read bit:

user@host:/home/user$ chmod g-r file3
user@host:/home/user$ ls -l file3
-rw----r--  1 user user 0 Nov 19 20:13 file3

Add read, write and execute to everyone:

user@host:/home/user$ chmod ugo+rwx file4
user@host:/home/user$ ls -l file4
-rwxrwxrwx  1 user user 0 Nov 19 20:13 file4
user@host:/home/user$

chmod with Numbers

Here are a few examples of chmod usage with numbers (try these out on your system):

First create some empty files:

user@host:/home/user$ touch file1 file2 file3 file4
user@host:/home/user$ ls -l
total 0
-rw-r--r--  1 user user 0 Nov 19 20:13 file1
-rw-r--r--  1 user user 0 Nov 19 20:13 file2
-rw-r--r--  1 user user 0 Nov 19 20:13 file3
-rw-r--r--  1 user user 0 Nov 19 20:13 file4

Add owner execute bit:

user@host:/home/user$ chmod 744 file1
user@host:/home/user$ ls -l file1
-rwxr--r--  1 user user 0 Nov 19 20:13 file1

Add other write & execute bit:

user@host:/home/user$ chmod 647 file2
user@host:/home/user$ ls -l file2
-rw-r--rwx  1 user user 0 Nov 19 20:13 file2

Add group read bit:

user@host:/home/user$ chmod 604 file3
user@host:/home/user$ ls -l file3
-rw----r--  1 user user 0 Nov 19 20:13 file3

Add read, write and execute to everyone:

user@host:/home/user$ chmod 777 file4
user@host:/home/user$ ls -l file4
-rwxrwxrwx  1 user user 0 Nov 19 20:13 file4
user@host:/home/user$

chmod with sudo

Changing permissions on files that you do not have permission to access:

user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r--  1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$

user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile

user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-x  1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$

ToDo

  • sticky bit
  • umask
  • Recursive chmod with -R

FilePermissions (last edited 2008-08-06 16:27:42 by localhost)