Red Hat System Administration I
- SectionLinux File System Permissions
- Quiz: Interpreting File and Directory Permissions
- Managing File System Permissions from the Command Line
- Guided Exercise: Managing File Security from the Command Line
- Managing Default Permissions and File Access
- Guided Exercise: Controlling New File Permissions and Ownership
- Lab: Controlling Access to Files with Linux File System Permissions
Abstract
| Goal | To set Linux file system permissions on files and interpret the security effects of different permission settings. |
| Objectives |
|
| Sections |
|
| Lab |
|
Interpret file and directory permissions as displayed with the ls command.
Objectives
After completing this section, students should be able to explain how the Linux file permissions model works.
Linux file system permissions
Access to files by users are controlled by file permissions. The Linux file permissions system is simple but flexible, which makes it easy to understand and apply, yet able to handle most normal permission cases easily.
Files have just three categories of user to which permissions apply. The file is owned by a user, normally the one who created the file. The file is also owned by a single group, usually the primary group of the user who created the file, but this can be changed. Different permissions can be set for the owning user, the owning group, and for all other users on the system that are not the user or a member of the owning group.
The most specific permissions apply. So, user permissions override group permissions, which override other permissions.
In the graphic that follows, joshua is a member of the groups joshua and web, while allison is a member of allison, wheel, and web. When joshua and allison have the need to collaborate, the files should be associated with the group web and the group permissions should allow the desired access.
 |
There are also just three categories of permissions which apply: read, write, and execute. These permissions affect access to files and directories as follows:
Table 6.1. Effects of permissions on files and directories
Permission | Effect on files | Effect on directories |
|---|---|---|
| Contents of the file can be read. | Contents of the directory (file names) can be listed. |
| Contents of the file can be changed. | Any file in the directory may be created or deleted. |
| Files can be executed as commands. | Contents of the directory can be accessed (dependent on the permissions of the files in the directory). |
Note that users normally have both read and exec on read-only directories, so that they
can list the directory and access its contents. If a user only has read access on a directory, the names of the files in it
can be listed, but no other information, including permissions or time stamps, are available, nor can they be accessed.
If a user only has exec access on a directory, they cannot list the names of the files in the directory,
but if they already know the name of a file which they have permission to read, then they can access the contents of
that file by explicitly specifying the file name.
A file may be removed by anyone who has write permission to the directory in which the file resides, regardless of the ownership or permissions on the file itself. (This can be overridden with a special permission, the sticky bit, which will be discussed at the end of the unit.)
Viewing file/directory permissions and ownership
The -l option of the ls command will expand the file listing to include both the permissions of a file and the ownership:
[student@desktopX ~]$ls -l test-rw-rw-r--. 1 student student 0 Feb 8 17:36 test
The command ls -l directoryname will show the expanded listing of all of the files that reside inside the directory. To prevent the descent into the directory and see the expanded listing of the directory itself, add the -d option to ls:
[student@desktopX ~]$ls -ld /homedrwxr-xr-x. 5 root root 4096 Jan 31 22:00 /home
Note
Unlike NTFS permissions, Linux permissions only apply to the directory or file that they are set on. Permissions on a directory are not inherited automatically by the subdirectories and files within it. (The permissions on a directory may effectively block access to its contents, however.) All permissions in Linux are set directly on each file or directory.
The read permission on a directory in Linux is roughly equivalent to List folder contents in Windows.
The write permission on a directory in Linux is equivalent to Modify in Windows; it implies the ability to delete files and subdirectories. In Linux, if write and the sticky bit are both set on a directory, then only the user that owns a file or subdirectory in the directory may delete it, which is close to the behavior of the Windows Write permission.
Root has the equivalent of the Windows Full Control permission on all files in Linux. However, root may still have access restricted by the system's SELinux policy and the security context of the process and files in question. SELinux will be discussed in a later course.
Examples: Linux user, group, other concepts
Users and their groups:
lucy lucy,ricardo
ricky ricky,ricardo
ethel ethel,mertz
fred fred,mertz
File attributes (permissions, user & group ownership, name):
drwxrwxr-x ricky ricardo dir (which contains the following files)
-rw-rw-r-- lucy lucy lfile1
-rw-r--rw- lucy ricardo lfile2
-rw-rw-r-- ricky ricardo rfile1
-rw-r----- ricky ricardo rfile2| Allowed/denied behavior | Controlling permissions |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
Since |
|
|
|
|
|
other permissions apply to |
References
ls(1) man page
info coreutils (GNU Coreutils)
Section 13: Changing file attributes
