FilePermissions

Differences between revisions 2 and 19 (spanning 17 versions)
Revision 2 as of 2005-11-20 04:29:25
Size: 4920
Editor: adsl-69-109-188-174
Comment:
Revision 19 as of 2006-03-22 02:36:24
Size: 11502
Editor: 202-155-165-25
Comment:
Deletions are marked like this. Additions are marked like this.
Line 8: Line 8:
In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a linux system have permissions that allow or prevent others from viewing, modifying or executing. The super user "root" has the ability to access any file on the system. Each file has access restrictions, user restrictions and have an owner/group association. Permissions are refered to as bit's.

If the owner read & execute bit are on the permission will look like this:
In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a system have permissions that allow or prevent others from viewing, modifying or executing. If the file is of type Directory then it restricts different actions than files and device nodes. The super user "root" has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are refered to as bits.

To change or edit files that are owned by root,
'''sudo''' must be used - please see RootSudo for details.

If the owner read & execute bit are on, then the permissions are:
Line 15: Line 17:
Three types of access restrictions. There are three types of access restrictions:
Line 18: Line 20:
|| read|| (view) ||r = 4||
|| write|| (edit) ||w = 2||
|| execute|| (execute) ||x = 1||


Three types of user restrictions.
|| read|| (view) ||r or 4||
|| write|| (edit) ||w or 2||
|| execute|| (execute) ||x or 1||


There are also three types of user restrictions:
Line 26: Line 28:
|| owner||-rwx--``--``--||
|| group||--``--rwx---||
|| other||--``--``---rwx||
|| owner||{{{-rwx------}}}||
|| group||{{{----rwx---}}}||
|| other||{{{-------rwx}}}||


Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes.

|| '''Permission'''|| '''Action'''|| '''chmod option'''||
|| read|| (view contents, i.e. ls command) ||r or 4||
|| write|| (create or remove files from dir) ||w or 2||
|| execute|| (cd into directory) ||x or 1||


    * read restricts or allows viewing the directories contents, i.e. ''ls'' command
    * write restricts or allows creating new files or deleting files in the directory. (Caution: '''write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!''')
    * execute restricts or allows changing into the directory, i.e. ''cd'' command

Line 51: Line 68:
=== Changing Permissions === == Changing Permissions ==
Line 70: Line 87:
==== chmod with Letters ====

Here are a few examples of chmod usage with letters (try these out on your system):

''First create some empty files:''

=== chmod with Letters ===

{{{
Usage: chmod {options} filename
}}}

|| '''Options'''|| '''Definition'''||
|| u || owner ||
|| g || group ||
|| o || other ||
|| x || execute ||
|| w || write ||
|| r || read ||
|| + || add permission ||
|| - || remove permission ||
|| = || set permission ||

Here are a few examples of chmod usage with letters (try these out on your system).

First create some empty files:
Line 84: Line 117:
''Add owner execute bit:'' Add owner execute bit:
Line 90: Line 123:
''Add other write & execute bit:'' Add other write & execute bit:
Line 96: Line 129:
''Add group read bit:'' Remove group read bit:
Line 102: Line 135:
''Add read, write and execute to everyone:'' Add read, write and execute to everyone:
Line 111: Line 144:
==== chmod with Numbers ====

Here are a few examples of chmod usage with numbers (try these out on your system):

''First create some empty files:''
=== chmod with Numbers ===

{{{
Usage: chmod {options} filename
}}}

|| '''Options'''|| '''Definition'''||
|| {{{#--}}} || owner ||
|| {{{-#-}}} || group ||
|| {{{--#}}} || other ||
|| 1 || execute ||
|| 2 || write ||
|| 4 || read ||

Owner, Group and Other is represented by three numbers. To get the value for the options determine the type of access needed for the file then add.

For example if you want a file that has -rw-rw-rwx permissions you will use the following:

|| '''Owner'''|| '''Group'''|| '''Other'''||
|| read & write|| read & write || read, write & execute||
|| 4+2=6 || 4+2=6 || 4+2+1=7 ||

{{{
user@host:/home/user$ chmod 667 filename
}}}

Another example if you want a file that has --w-r-x--x permissions you will use the following:

|| '''Owner'''|| '''Group'''|| '''Other'''||
|| write|| read & execute || execute||
|| 2 || 4+1=5 || 1 ||

{{{
user@host:/home/user$ chmod 251 filename
}}}

Here are a few examples of chmod usage with numbers (try these out on your system).

First create some empty files:
Line 125: Line 192:
''Add owner execute bit:'' Add owner execute bit:
Line 131: Line 198:
''Add other write & execute bit:'' Add other write & execute bit:
Line 137: Line 204:
''Add group read bit:'' Remove group read bit:
Line 143: Line 210:
''Add read, write and execute to everyone:'' Add read, write and execute to everyone:
Line 151: Line 218:
=== chmod with sudo ===

Changing permissions on files that you do not have ownership of: ('''Note''' that changing permissions the wrong way on the wrong files can quickly mess up your system a great deal! Please be careful when using '''sudo'''!)
{{{
user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-- 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$

user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile

user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-x 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$
}}}

=== For more information ===
 * ''man chmod''
 * ''man chown''
 * ''man chgrp''


== Changing Permissions For Volumes With umask ==

New users attempting to change permissions for certain volumes will find that changes made with chmod or a sudo/kdesu filebrowser window will not be applied. This is often because the umask modifier in the volume's fstab entry is overriding the changes they are attempting to make. A common example of this situation is a user attempting to add write permissions to a FAT volume on their dual-boot ubuntu/windows box. Permissions for volumes are most easily changed by adding a umask modifier to their fstab entries. Here is a sample fstab entry:
{{{
#
# <file system> <mount point> <type> <options> <dump> <pass>
proc /proc proc defaults 0 0
/dev/hdb2 / ext3 defaults,errors=remount-ro 0 1
/dev/hda1 /media/hda1 vfat umask=000 0 0
/dev/hdb1 none swap sw 0 0
/dev/hdc /media/cdrom0 udf,iso9660 user,noauto 0 0
/dev/fd0 /media/floppy0 auto rw,user,noauto 0 0
/dev/hda2 /media/windows ntfs ro,nls=utf8,umask=0222 0 0
/dev/hdd1 /media/storage ntfs ro,nls=utf8,umask=0222 0 0
/dev/hdd5 /media/fat vfat umask=000 0 0
}}}

The umask modifier sets the permissions for all users of the volume. The umask modifier cannot be overridden by changing permissions through your file browser (not even using a root window,) so it is a good way to set relatively tamper-proof permissions. A umask entry of 0222 allows read access to all users and write access to root only, so it is good for NTFS partitions. A umask entry of 000 allows read and write access to all users.

There are analogous options called fmask and dmask. fmask applies to files and dmask applies to directories. They work in the same way as umask, but offer finer grained control. For example, you usually want directories to executable (i.e. listable), but most files don't need to be executable.

=== Changing permissions for a FAT volume with umask ===

To change permissions for a FAT volume, it must first be unmounted with the command

{{{
user@host:/home/user$ sudo umount /dev/xxxx
}}}

Where xxxx is the FAT volume you wish to modify. Begin by backing up the file /etc/fstab
{{{
user@host:/home/user$ sudo cp /etc/fstab /etc/fstab_backup1
}}}

Next, edit the fstab file with gedit, using the command

{{{
user@host:/home/user$ sudo gedit /etc/fstab
}}}

Modify the line detailing the FAT volume, changing
{{{
/dev/xxxx /media/xxxx vfat defaults 0 0
}}}

to

{{{
/dev/xxxx /media/xxxx vfat umask=000 0 0
}}}

Save and exit gedit. This will allow ALL users read and write access to the drive. (I am a home user who is willing to take his chances. A more knowledgeable contributor will clarify this section.)

To finish, mount your volumes as per the specifications of the fstab file by using the command

{{{
user@host:/home/user$ sudo mount -a
}}}

Voila! Your FAT partition now allows read and write access to all users.

=== For more information ===
 * ''man mount''

== ACLs ==

ACLs are a way of achieving a finer granularity of permissions than is possible with the standard Unix file permissions. Documentation can be found in the online man pages:

 * man acl
 * man setfacl
 * man getfacl
Line 154: Line 314:
 * umask  * umask (re-write and clarify umask section, with specific focus on security)
Line 156: Line 316:
 * * ''Suggestion: I often use {{{find}}} instead of {{{chmod -R}}}, because it's easier to differentiate between files and directories that way. Yes, I know about the 'X' permission, but I don't trust it.''

----
CategoryDocumentation

Understanding and Using File Permissions

In Linux and Unix everything is a file. Directories are files, files are files and devices are files. Devices are usually refered to as a node, however, they are still files. All of the files on a system have permissions that allow or prevent others from viewing, modifying or executing. If the file is of type Directory then it restricts different actions than files and device nodes. The super user "root" has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are refered to as bits.

To change or edit files that are owned by root, sudo must be used - please see RootSudo for details.

If the owner read & execute bit are on, then the permissions are:

-r-x------

There are three types of access restrictions:

Permission

Action

chmod option

read

(view)

r or 4

write

(edit)

w or 2

execute

(execute)

x or 1

There are also three types of user restrictions:

User

ls output

owner

-rwx------

group

----rwx---

other

-------rwx

Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes.

Permission

Action

chmod option

read

(view contents, i.e. ls command)

r or 4

write

(create or remove files from dir)

w or 2

execute

(cd into directory)

x or 1

  • read restricts or allows viewing the directories contents, i.e. ls command

  • write restricts or allows creating new files or deleting files in the directory. (Caution: write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!)

  • execute restricts or allows changing into the directory, i.e. cd command

Permissions in Action

user@host:/home/user$ ls -l /etc/hosts
-rw-r--r--  1 root root 288 2005-11-13 19:24 /etc/hosts
user@host:/home/user$

Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group.

What are the permissions from the above /etc/hosts ls output?

-rw-r--r--

owner = Read & Write (rw-)
group = Read (r--)
other = Read (r--)

Changing Permissions

The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access.

user@host:/home/user# ls -l /etc/shadow
-rw-r-----  1 root shadow 869 2005-11-08 13:16 /etc/shadow
user@host:/home/user#

Permissions:
owner = Read & Write (rw-)
group = Read (r--)
other = None (---)

Ownership:
owner = root
group = shadow

chmod with Letters

Usage: chmod {options} filename

Options

Definition

u

owner

g

group

o

other

x

execute

w

write

r

read

+

add permission

-

remove permission

=

set permission

Here are a few examples of chmod usage with letters (try these out on your system).

First create some empty files:

user@host:/home/user$ touch file1 file2 file3 file4
user@host:/home/user$ ls -l
total 0
-rw-r--r--  1 user user 0 Nov 19 20:13 file1
-rw-r--r--  1 user user 0 Nov 19 20:13 file2
-rw-r--r--  1 user user 0 Nov 19 20:13 file3
-rw-r--r--  1 user user 0 Nov 19 20:13 file4

Add owner execute bit:

user@host:/home/user$ chmod u+x file1
user@host:/home/user$ ls -l file1
-rwxr--r--  1 user user 0 Nov 19 20:13 file1

Add other write & execute bit:

user@host:/home/user$ chmod o+wx file2
user@host:/home/user$ ls -l file2
-rw-r--rwx  1 user user 0 Nov 19 20:13 file2

Remove group read bit:

user@host:/home/user$ chmod g-r file3
user@host:/home/user$ ls -l file3
-rw----r--  1 user user 0 Nov 19 20:13 file3

Add read, write and execute to everyone:

user@host:/home/user$ chmod ugo+rwx file4
user@host:/home/user$ ls -l file4
-rwxrwxrwx  1 user user 0 Nov 19 20:13 file4
user@host:/home/user$

chmod with Numbers

Usage: chmod {options} filename

Options

Definition

#--

owner

-#-

group

--#

other

1

execute

2

write

4

read

Owner, Group and Other is represented by three numbers. To get the value for the options determine the type of access needed for the file then add.

For example if you want a file that has -rw-rw-rwx permissions you will use the following:

Owner

Group

Other

read & write

read & write

read, write & execute

4+2=6

4+2=6

4+2+1=7

user@host:/home/user$ chmod 667 filename

Another example if you want a file that has --w-r-x--x permissions you will use the following:

Owner

Group

Other

write

read & execute

execute

2

4+1=5

1

user@host:/home/user$ chmod 251 filename

Here are a few examples of chmod usage with numbers (try these out on your system).

First create some empty files:

user@host:/home/user$ touch file1 file2 file3 file4
user@host:/home/user$ ls -l
total 0
-rw-r--r--  1 user user 0 Nov 19 20:13 file1
-rw-r--r--  1 user user 0 Nov 19 20:13 file2
-rw-r--r--  1 user user 0 Nov 19 20:13 file3
-rw-r--r--  1 user user 0 Nov 19 20:13 file4

Add owner execute bit:

user@host:/home/user$ chmod 744 file1
user@host:/home/user$ ls -l file1
-rwxr--r--  1 user user 0 Nov 19 20:13 file1

Add other write & execute bit:

user@host:/home/user$ chmod 647 file2
user@host:/home/user$ ls -l file2
-rw-r--rwx  1 user user 0 Nov 19 20:13 file2

Remove group read bit:

user@host:/home/user$ chmod 604 file3
user@host:/home/user$ ls -l file3
-rw----r--  1 user user 0 Nov 19 20:13 file3

Add read, write and execute to everyone:

user@host:/home/user$ chmod 777 file4
user@host:/home/user$ ls -l file4
-rwxrwxrwx  1 user user 0 Nov 19 20:13 file4
user@host:/home/user$

chmod with sudo

Changing permissions on files that you do not have ownership of: (Note that changing permissions the wrong way on the wrong files can quickly mess up your system a great deal! Please be careful when using sudo!)

user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r--  1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$

user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile

user@host:/home/user$ ls -l /usr/local/bin/somefile
-rw-r--r-x  1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile
user@host:/home/user$

For more information

  • man chmod

  • man chown

  • man chgrp

Changing Permissions For Volumes With umask

New users attempting to change permissions for certain volumes will find that changes made with chmod or a sudo/kdesu filebrowser window will not be applied. This is often because the umask modifier in the volume's fstab entry is overriding the changes they are attempting to make. A common example of this situation is a user attempting to add write permissions to a FAT volume on their dual-boot ubuntu/windows box. Permissions for volumes are most easily changed by adding a umask modifier to their fstab entries. Here is a sample fstab entry:

#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    defaults        0       0
/dev/hdb2       /               ext3    defaults,errors=remount-ro 0       1
/dev/hda1       /media/hda1     vfat    umask=000        0       0
/dev/hdb1       none            swap    sw              0       0
/dev/hdc        /media/cdrom0   udf,iso9660 user,noauto     0       0
/dev/fd0        /media/floppy0  auto    rw,user,noauto  0       0
/dev/hda2 /media/windows ntfs ro,nls=utf8,umask=0222 0 0
/dev/hdd1 /media/storage ntfs ro,nls=utf8,umask=0222 0 0
/dev/hdd5       /media/fat     vfat umask=000 0 0

The umask modifier sets the permissions for all users of the volume. The umask modifier cannot be overridden by changing permissions through your file browser (not even using a root window,) so it is a good way to set relatively tamper-proof permissions. A umask entry of 0222 allows read access to all users and write access to root only, so it is good for NTFS partitions. A umask entry of 000 allows read and write access to all users.

There are analogous options called fmask and dmask. fmask applies to files and dmask applies to directories. They work in the same way as umask, but offer finer grained control. For example, you usually want directories to executable (i.e. listable), but most files don't need to be executable.

Changing permissions for a FAT volume with umask

To change permissions for a FAT volume, it must first be unmounted with the command

user@host:/home/user$ sudo umount /dev/xxxx

Where xxxx is the FAT volume you wish to modify. Begin by backing up the file /etc/fstab

user@host:/home/user$ sudo cp /etc/fstab /etc/fstab_backup1

Next, edit the fstab file with gedit, using the command

user@host:/home/user$ sudo gedit /etc/fstab

Modify the line detailing the FAT volume, changing

/dev/xxxx       /media/xxxx     vfat defaults 0 0

to

/dev/xxxx       /media/xxxx     vfat umask=000 0 0

Save and exit gedit. This will allow ALL users read and write access to the drive. (I am a home user who is willing to take his chances. A more knowledgeable contributor will clarify this section.)

To finish, mount your volumes as per the specifications of the fstab file by using the command

user@host:/home/user$ sudo mount -a

Voila! Your FAT partition now allows read and write access to all users.

For more information

  • man mount

ACLs

ACLs are a way of achieving a finer granularity of permissions than is possible with the standard Unix file permissions. Documentation can be found in the online man pages:

  • man acl
  • man setfacl
  • man getfacl

ToDo

  • sticky bit
  • umask (re-write and clarify umask section, with specific focus on security)
  • Recursive chmod with -R
  • * Suggestion: I often use find instead of chmod -R, because it's easier to differentiate between files and directories that way. Yes, I know about the 'X' permission, but I don't trust it.


CategoryDocumentation

FilePermissions (last edited 2008-08-06 16:27:42 by localhost)