Linux File Permissions: Complete Guide

Introduction

Linux file permissions are a fundamental security mechanism that controls who can access, modify, or execute files and directories on a Linux system. Understanding file permissions is crucial for system administration, security, and proper file management. This comprehensive guide covers all aspects of Linux file permissions, from basic concepts to advanced implementation.

Basic Concepts

What are File Permissions?

File permissions in Linux define three types of access for three categories of users:

Types of Access: - Read (r): Permission to view the contents of a file or list the contents of a directory - Write (w): Permission to modify a file or create/delete files within a directory - Execute (x): Permission to run a file as a program or enter a directory

User Categories: - Owner (u): The user who owns the file - Group (g): Users who belong to the file's group - Others (o): All other users on the system

Permission Representation

Linux file permissions can be represented in two ways:

1. Symbolic notation: Uses letters (r, w, x, -) 2. Octal notation: Uses numbers (0-7)

Understanding Permission Display

The ls -l Command

The ls -l command displays detailed file information including permissions:

`bash ls -l filename `

Example Output: ` -rwxr-xr-- 1 john developers 1024 Mar 15 10:30 script.sh drwxr-xr-x 2 john developers 4096 Mar 15 09:15 documents `

Breaking Down the Permission String

The permission string consists of 10 characters:

| Position | Meaning | |----------|---------| | 1 | File type (- for regular file, d for directory, l for link) | | 2-4 | Owner permissions (rwx) | | 5-7 | Group permissions (rwx) | | 8-10 | Others permissions (rwx) |

Example Analysis: ` -rwxr-xr-- │└┬┘└┬┘└┬┘ │ │ │ └── Others: read only │ │ └───── Group: read and execute │ └──────── Owner: read, write, and execute └─────────── Regular file `

Symbolic Notation

Permission Characters

| Character | Permission | Octal Value | |-----------|------------|-------------| | r | Read | 4 | | w | Write | 2 | | x | Execute | 1 | | - | No permission | 0 |

Common Permission Combinations

| Symbolic | Description | Typical Use | |----------|-------------|-------------| | rwx | Full access | Owner of executable files | | rw- | Read and write | Owner of data files | | r-x | Read and execute | Group/others for programs | | r-- | Read only | Public readable files | | --- | No access | Restricted access |

Octal Notation

Understanding Octal Values

Octal notation uses three digits, each representing permissions for owner, group, and others respectively. Each digit is calculated by adding the values of granted permissions:

| Permission | Value | |------------|-------| | Read (r) | 4 | | Write (w) | 2 | | Execute (x) | 1 |

Octal Permission Table

| Octal | Binary | Symbolic | Description | |-------|--------|----------|-------------| | 0 | 000 | --- | No permissions | | 1 | 001 | --x | Execute only | | 2 | 010 | -w- | Write only | | 3 | 011 | -wx | Write and execute | | 4 | 100 | r-- | Read only | | 5 | 101 | r-x | Read and execute | | 6 | 110 | rw- | Read and write | | 7 | 111 | rwx | Full permissions |

Common Octal Permission Combinations

| Octal | Symbolic | Description | Common Use | |-------|----------|-------------|------------| | 755 | rwxr-xr-x | Owner full, others read/execute | Executable files, directories | | 644 | rw-r--r-- | Owner read/write, others read | Regular files | | 600 | rw------- | Owner read/write only | Private files | | 777 | rwxrwxrwx | Full permissions for all | Temporary files (not recommended) | | 700 | rwx------ | Owner full access only | Private directories | | 666 | rw-rw-rw- | Read/write for all | Shared data files |

File Permission Commands

The chmod Command

The chmod (change mode) command modifies file permissions.

Syntax: `bash chmod [options] mode file(s) `

#### Using Octal Mode

Examples: `bash

Set permissions to 755 (rwxr-xr-x)

Set permissions to 644 (rw-r--r--)

Set permissions to 600 (rw-------)

#### Using Symbolic Mode

Syntax Components: - Who: u (user/owner), g (group), o (others), a (all) - Operation: + (add), - (remove), = (set exactly) - Permission: r (read), w (write), x (execute)

Examples: `bash

Add execute permission for owner

Remove write permission for group and others

Set read and execute for group, no permissions for others

Add read permission for all users

Set full permissions for owner, read/execute for group and others

#### Advanced chmod Options

| Option | Description | |--------|-------------| | -R | Recursive: apply to directories and their contents | | -v | Verbose: show files being processed | | -c | Changes: only show files that are changed | | --reference=file | Copy permissions from reference file |

Examples: `bash

Recursively set permissions on directory and contents

Verbose output showing changes

Copy permissions from one file to another

The chown Command

The chown (change owner) command changes file ownership.

Syntax: `bash chown [options] owner[:group] file(s) `

Examples: `bash

Change owner to john

Change owner to john and group to developers

Change only the group (owner remains unchanged)

Recursively change ownership

The chgrp Command

The chgrp (change group) command changes group ownership.

Syntax: `bash chgrp [options] group file(s) `

Examples: `bash

Change group to developers

Recursively change group

Directory Permissions

How Directory Permissions Work

Directory permissions have different meanings than file permissions:

| Permission | Files | Directories | |------------|-------|-------------| | Read (r) | View file contents | List directory contents | | Write (w) | Modify file contents | Create/delete files in directory | | Execute (x) | Run file as program | Enter directory (cd command) |

Directory Permission Examples

`bash

Create a directory with full permissions for owner, read/execute for others

Directory that can be entered but contents cannot be listed

Directory where files can be created but not listed by others

Special Directory Considerations

Important Notes: - Execute permission on a directory is required to access files within it - Write permission on a directory allows creating and deleting files - Read permission allows listing directory contents but not accessing files

Special Permissions

Setuid (Set User ID)

The setuid bit allows a file to be executed with the permissions of the file owner rather than the user running it.

Setting Setuid: `bash

Using octal notation (4000 + regular permissions)

Using symbolic notation

Example: `bash

The passwd command uses setuid to allow users to change their password

Setgid (Set Group ID)

The setgid bit can be applied to files and directories: - Files: Execute with group permissions - Directories: New files inherit the directory's group

Setting Setgid: `bash

Using octal notation (2000 + regular permissions)

Using symbolic notation

Sticky Bit

The sticky bit on directories prevents users from deleting files they don't own, even if they have write permission to the directory.

Setting Sticky Bit: `bash

Using octal notation (1000 + regular permissions)

Using symbolic notation

Example: `bash

The /tmp directory typically has the sticky bit set

Special Permissions Summary

| Special Permission | Octal | Symbol | Effect | |-------------------|-------|--------|--------| | Setuid | 4000 | s (user execute position) | Execute as file owner | | Setgid | 2000 | s (group execute position) | Execute as file group | | Sticky Bit | 1000 | t (others execute position) | Prevent deletion by non-owners |

Access Control Lists (ACLs)

Introduction to ACLs

Access Control Lists provide more granular permission control beyond the traditional owner/group/others model.

ACL Commands

#### getfacl Command

View ACL information for files and directories:

`bash

View ACL for a file

View ACL for multiple files

Example Output: `

file: document.txt

owner: john

group: developers

#### setfacl Command

Set ACL permissions:

`bash

Grant read permission to user alice

Grant read/write permission to group admin

Remove ACL entry for user alice

Remove all ACL entries

ACL Examples and Use Cases

| Command | Description | |---------|-------------| | setfacl -m u:user:rwx file | Grant full access to specific user | | setfacl -m g:group:r-x dir | Grant read/execute to specific group | | setfacl -m d:u:user:rw- dir | Set default ACL for new files in directory | | setfacl -R -m u:user:r-- dir | Recursively grant read access |

Practical Examples and Scenarios

Web Server File Permissions

Setting up proper permissions for a web server:

`bash

Set directory permissions for web root

Set file permissions for web content

Set directory permissions

Special permissions for upload directory

Shared Directory Setup

Creating a shared directory for team collaboration:

`bash

Create shared directory

Set group write permission and setgid

Verify permissions

Script File Permissions

Setting up executable scripts:

`bash

Create script file

Make executable for owner

Make executable for everyone

Verify permissions

Troubleshooting Permission Issues

Common Permission Problems

| Problem | Symptoms | Solution | |---------|----------|----------| | Cannot execute file | "Permission denied" when running | chmod +x filename | | Cannot access directory | "Permission denied" when using cd | chmod +x directory | | Cannot create files | Write operations fail | Check directory write permissions | | Cannot list directory | ls shows permission denied | chmod +r directory |

Diagnostic Commands

`bash

Check current permissions

Check effective permissions

Check user and group membership

Check file system mount options

Permission Restoration

`bash

Restore default permissions for home directory

Restore execute permission for scripts

Security Best Practices

Principle of Least Privilege

Always grant the minimum permissions necessary:

`bash

Good: Specific permissions

Avoid: Overly permissive

Regular Permission Audits

`bash

Find files with world-write permissions

Find files with setuid bit

Find directories with unusual permissions

Secure File Creation

`bash

Set restrictive umask

Create private files

Create secure temporary files

Advanced Topics

Understanding umask

The umask (user mask) determines default permissions for newly created files and directories:

`bash

View current umask

Set umask (octal)

Set umask (symbolic)

Umask Calculation: - Default file permissions: 666 - Default directory permissions: 777 - Actual permissions = Default - umask

File Attributes

Extended file attributes provide additional security features:

`bash

View file attributes

Set immutable attribute (prevents modification)

Remove immutable attribute

Set append-only attribute

SELinux and Permissions

Security-Enhanced Linux adds additional access controls:

`bash

View SELinux context

Set SELinux context

Restore default SELinux context

Conclusion

Linux file permissions are a powerful and essential security mechanism that every Linux user and administrator must understand. This comprehensive guide has covered:

- Basic permission concepts and representations - Symbolic and octal notation systems - Essential commands for managing permissions - Special permissions and their applications - Access Control Lists for granular control - Practical examples and troubleshooting - Security best practices and advanced topics

Mastering file permissions is crucial for maintaining system security, enabling proper collaboration, and ensuring that files and directories are accessible to the right users with appropriate levels of access. Regular practice with these concepts and commands will help you become proficient in managing Linux file permissions effectively.

Remember that permission management is not just about technical implementation but also about understanding the security implications of each decision. Always follow the principle of least privilege and regularly audit your system's permissions to maintain a secure environment.