Permissions & Ownership

Linux was built for many users sharing one machine, so every file and directory records who owns it and who may do what with it. These permissions are why a normal user cannot delete system files, why your SSH key must be private, and why a web server can read your site but not change it.

In this lesson you will learn to read permission strings, change them with chmod in both of its forms, change owners with chown, and understand umask, which decides the permissions of new files.

Owner, group and others

Every file has an owner (a user) and a group. Permissions are set separately for three classes of people:

• u (user): the owner of the file
• g (group): members of the file's group
• o (others): everyone else

Each class can have three permissions: r (read), w (write) and x (execute). Look at a long listing:

ls -l backup.sh orders.csv
ls -ld projects

-rwxrwxr-x 1 priya priya  412 Oct 30 10:02 backup.sh
-rw-rw-r-- 1 priya priya  281 Oct 30 08:15 orders.csv
drwxrwxr-x 3 priya priya 4096 Oct 28 21:30 projects

After the first character (the type), the nine letters split into three groups of three. For orders.csv, rw- is the owner (read and write), rw- is the group (read and write) and r-- is others (read only). A dash means that permission is missing. backup.sh also has x, so it can be run as a program.

What r, w and x mean

The letters mean slightly different things for files and directories, and the directory meaning surprises many people:

Notice that deleting a file depends on the directory's w permission, not the file's. And a directory without x cannot be entered at all, even if you can read its list of names.

Octal numbers

Permissions are often written as three digits. Each permission has a value, and you add them up for each class:

So rwx = 4+2+1 = 7, rw- = 6, r-x = 5, r-- = 4 and --- = 0. The string rwxr-x--- becomes 750. These are the combinations you will meet again and again:

stat can print the number and the string together:

stat -c '%a %A %U:%G %n' orders.csv ~/.ssh/id_ed25519

664 -rw-rw-r-- priya:priya orders.csv
600 -rw------- priya:priya /home/priya/.ssh/id_ed25519

Changing permissions with chmod

chmod (change mode) has two forms. The octal form sets all nine permissions at once. The symbolic form adds (+), removes (-) or sets (=) individual letters for u, g, o or a (all three).

chmod -v 600 notes/passwords.txt
chmod -v u+x backup.sh
chmod -v go-w orders.csv
chmod -R u=rwX,go=rX projects/shop-site

mode of 'notes/passwords.txt' changed from 0664 (rw-rw-r--) to 0600 (rw-------)
mode of 'backup.sh' changed from 0664 (rw-rw-r--) to 0764 (rwxrw-r--)
mode of 'orders.csv' changed from 0664 (rw-rw-r--) to 0644 (rw-r--r--)

The first line makes a file private. The second lets the owner run a script, without touching anything else. The third removes write permission from the group and others. The last line works recursively (-R) through a whole website folder: everyone can read, only the owner can write, and the capital X adds execute only to directories (and files that are already executable), so folders can be entered but HTML files do not become "programs".

Changing owners with chown

chown changes the owner, the group, or both, written as owner:group. Only root can give files away, so you need sudo. chgrp changes only the group.

sudo chown priya:www-data /var/www/shop/config.php
sudo chmod 640 /var/www/shop/config.php
sudo chown -R www-data:www-data /var/www/shop/uploads
ls -l /var/www/shop/config.php

-rw-r----- 1 priya www-data 1180 Oct 30 11:20 /var/www/shop/config.php

Now Priya can edit the config, the web server (which runs as user www-data) can read it through the group, and nobody else can see the database password inside. The upload folder belongs entirely to the web server so that it can save files there.

umask: permissions for new files

Why do Priya's new files start as rw-rw-r--? New files begin from 666 (programs are never executable by default) and new directories from 777. The umask is a mask of permissions to take away. On Ubuntu a normal user's umask is 0002, which removes only "write for others":

umask
touch new.txt && mkdir newdir
ls -ld new.txt newdir

0002
-rw-rw-r-- 1 priya priya    0 Oct 30 11:31 new.txt
drwxrwxr-x 2 priya priya 4096 Oct 30 11:31 newdir

666 minus 002 gives 664, and 777 minus 002 gives 775. This works safely on Ubuntu because every user has a private group with the same name (Priya's group priya contains only Priya). Root's umask is 0022. Running umask 077 in a shell makes everything you create afterwards private to you, which is handy before handling secrets.

Advanced: special permission bits

Three extra bits appear in the execute position:

• SUID (s in the owner's x spot, octal 4000): the program runs with its owner's rights. /usr/bin/passwd is owned by root and has SUID, so normal users can update their own password in a root-owned file.
• SGID on a directory (s in the group's x spot, 2000): new files inside get the directory's group, which is useful for shared team folders.
• Sticky bit (t in the others' x spot, 1000): on a shared directory, users can delete only their own files. /tmp uses it.

ls -ld /tmp /usr/bin/passwd

drwxrwxrwt 18 root root  4096 Oct 30 11:35 /tmp
-rwsr-xr-x  1 root root 64152 Apr 23 09:12 /usr/bin/passwd

Security auditors search for unexpected SUID files, because a buggy SUID-root program can let a normal user become root. You will see how to find them in Finding Files: find & xargs.

Common mistakes

• Making a script executable with chmod 777. chmod u+x script.sh or chmod 755 script.sh is enough.
• Wrong SSH key permissions. SSH refuses a private key that others can read ("UNPROTECTED PRIVATE KEY FILE"). Use chmod 600 on the key and chmod 700 on ~/.ssh.
• Forgetting directories need x. A folder set to 644 cannot be entered by anyone. Directories normally need 755 or 750.
• Using chmod -R 644 on a folder tree. It removes x from every directory too. Use the capital X form or find instead.

Key points

• Each file has an owner and a group; permissions are set for user, group and others.
• r=4, w=2, x=1; add them per class, so rwxr-xr-x is 755 and rw------- is 600.
• chmod changes permissions (octal like 640, or symbolic like u+x, go-w); chown owner:group changes ownership.
• On directories, w controls creating and deleting files and x controls entering.
• The umask (0002 for Ubuntu users) removes permissions from new files; never use 777 as a fix.

sudo chown -R rohan:www-data /var/www/canteen
sudo chmod -R u=rwX,g=rX,o= /var/www/canteen
chmod 700 ~/deploy.sh
ls -ld /var/www/canteen ~/deploy.sh

drwxr-x--- 4 rohan www-data 4096 Oct 30 12:05 /var/www/canteen
-rwx------ 1 rohan rohan     530 Oct 30 12:06 /home/rohan/deploy.sh