Getting Started with Linux Fundamentals

In Linux, three types of file permissions determine the access for three sets of users: user, group, and others.

The user set, also known as owner, refers to only one user: the user that owns the file. By default, this user is the user that creates the file. The group set refers to all the users who are members of the group that owns the file. By default, this group is usually the primary group of the user that creates the file. The others set refers to any user who is not a member of the group, and who is not the user that owns the file.

Each set of users can have permissions to read, write, or execute a file or a directory. These permissions are represented by letters or octal values.

A set of permissions is a string of nine characters. For example, the rwxrw-r-- string represents the permissions of a file. To interpret the permissions, divide the string into three sets of three characters each. The first set corresponds to user permissions, the second set corresponds to group permissions, and the third set corresponds to permissions for others.

user permissions: rwx 
group permissions: rw- 
others permissions: r-- 

File permissions can also be represented by octal numbers, which is a number system that uses a range of eight digits (0 to 7). A full set of octal permissions is represented by four numbers. The first number represents special permissions. A leading zero in octal numbers represents no special permissions. The next three numbers are the permission numbers for each set of users. The read permission is represented by the number four, write is represented by a two, and execute is represented by a one.

From the previous example, the rwxrw-r-- string is represented as 0761 in octal numbers:

The default file permission that is set for a new directory is rwxrwxr-x, which can be represented as the 0775 octal number.

To view the permissions of a file or directory in the Files application, right-click the target and then select Properties > Permissions. The Access drop-down list displays the permissions that are set on the file. The Execute checkbox indicates whether the file has execute permissions.

In the following example, the Report.docx file has read and write permissions for the user, read and write permissions for the group, and only read permissions for others. The Execute checkbox is not selected, so the file does not have execute permissions.

Figure 5.2: File permissions example

On the command line, you view file permission by using the ls command with the -l option. The first column of the output contains three attributes of the file: the file type, the file permissions, and the extended attributes. The first character of the string represents the file type, the next nine characters represent the file permissions, and the last character represents the extended attributes.

In the following example, you examine the Report.docx file ownership and permissions. The Report.docx file is a regular file, which is indicated by the leading hyphen on the first column. The eprice user has read, write, and execute permissions (rwx). Members of the finance group have read and write permissions (rw-). All other users have read permissions (r--).

[user@host ~]$ ls -l
...output omitted...
-rwxrw-r--. 1 eprice finance 17 Nov  2 12:44 Report.docx

Even if a file has read permissions for all users, you must have permission to view all directories in the path of the file. If you do not have permission to view a directory in the path, then you cannot view the file.

In the Files application, view the properties of the file and click Permissions. You can select the desired permission in the Access drop-down list for each user set.

Figure 5.3: Updating file permissions

On the command line, you use the chmod command to modify file permissions. The chmod command requires two arguments: the new permission set, and the target file or directory. Similar to the chown command, you can use the -R option with the chmod command to modify permissions recursively.

In the following example, you set permissions for the homework.doc file. You set read and write permissions for the user set, and read permissions for the group set and the others set. This command overwrites any previous permissions on the file.

[user@host ~]$ chmod 0644 homework.doc
[user@host ~]$ ls -l homework.doc
-rw-r--r--. 1 user user 45045 Nov  5 00:50 homework.doc

In the following example, you review the file permissions of the daily-tasks.sh script and then try to execute the script. You execute a shell script by providing the script path. If the script is in the current directory, then you can use a period followed by a forward slash (./) to refer to the current directory. The daily-tasks.sh script does not have execute permissions, so the execution fails.

[aquincy@host ~]$ ls -l daily-tasks.sh
-rw-rw-r--. 1 aquincy finance 33 Nov  5 13:35 daily-tasks.sh
[aquincy@host ~]$ ./daily-tasks.sh
-bash: ./daily-tasks.sh: Permission denied

You then set execute permissions to the daily-tasks.sh shell script. The 0750 permissions grant all read, write, and execute permissions to the aquincy user. These permissions also set read and execute permissions to the finance group. No permissions are set to the others set.

[aquincy@host ~]$ chmod 0750 daily-tasks.sh
[aquincy@host ~]$ ls -l daily-tasks.sh
-rwxr-x---. 1 aquincy finance 33 Nov  5 13:35 daily-tasks.sh
[aquincy@host ~]$ ./daily-tasks.sh
All tasks ran successfully

If the script is in a different directory, then you provide the full path of the script to execute it. For example, the following command runs the /usr/local/bin/mytasks.sh script.

[user@host ~]$ /usr/local/bin/mytasks.sh
...output omitted...