File permissions control access to files. Linux file permissions are flexible and can handle most normal permission cases.

Files have three user categories that permissions apply to. The file is owned by a user, normally the file creator. The file is also owned by a single group, which is usually the primary group of the user who created the file, but you can change it.

You can set different permissions for the owning user (user permissions), the owning group (group permissions), and for all other users on the system that are not the user or a member of the owning group (other permissions).

The most specific permissions take precedence. User permissions override group permissions, which override other permissions.

As an example of how group membership enables collaboration between users, imagine that your system has two users: alice and bob. alice is a member of the alice and web groups, and bob is a member of the bob, wheel, and web groups. When alice and bob work together, the files should be associated with the web group, and group permissions should allow both users to have access to the files.

Three permission categories apply: read, write, and execute. The following table explains how these permissions affect access to files and directories.

Users normally have both read and execute permissions on read-only directories so that they can list the directory and have read-only access to all of its contents. If a user has only read access on a directory, then they can list the names of the files in it. However, the user cannot access other information, such as permissions or time stamps. If a user has only execute access on a directory, then they cannot list file names in the directory. If they know the name of a file that they have permission to read, then they can access the contents of that file from outside the directory by explicitly specifying the relative file name.

Anyone who owns or has both write and execute permissions on a directory can remove files from it, regardless of the ownership or permissions on the file itself. You can override this behavior by using the sticky bit permission, to be discussed later in this chapter.

The ls command -l option shows detailed information about permissions and ownership:

[user@host ~]$ ls -l test
-rw-rw-r--. 1 student student 0 Mar  8 17:36 test

Use the ls command -d option to show detailed information about a directory itself, and not its contents.

[user@host ~]$ ls -ld /home
drwxr-xr-x. 5 root root 4096 Feb 31 22:00 /home

The first character of the long listing is the file type, and is interpreted as follows:

The next nine characters represent the file permissions. These characters are interpreted as three sets of three characters: The first set are permissions that apply to the file owner. The second set are for the file's group owner. The last set applies to all other (world) users. If a set is an rwx string, then that set has all three permissions: read, write, and execute. If a letter is replaced by a - dash character, then that set does not have that permission.

After the second column (the link count), the first name specifies the file owner, and the second name is the file's group owner.

In the first example, the permissions for the student user are the first set of three characters. The student user has read and write permissions on the test file, but not execute permission. The second set of three characters are the permissions for the student group: read and write permissions on test, but not execute permission. The third set of three characters are the permissions for all other users: only read permission on test.

The most specific set of permissions applies. So if the student user has different permissions from the student group, and the student user is also a member of that group, then only the user owner permissions apply. This permission allows setting a more restrictive set of permissions on a user than their group membership provides, when it might not be practical to remove the user from the group.

The following examples illustrate how file permissions interact. For these examples, your system has four users with the following group memberships:

Those users work with files in the dir directory. A long listing of the files in that directory is as follows:

[database1@host dir]$ ls -la
total 24
drwxrwxr-x.  2 database1 consultant1   4096 Mar  4 10:23 .
drwxr-xr-x. 10 root      root          4096 Mar  1 17:34 ..
-rw-rw-r--.  1 operator1 operator1     1024 Mar  4 11:02 app1.log
-rw-r--rw-.  1 operator1 consultant1   3144 Mar  4 11:02 app2.log
-rw-rw-r--.  1 database1 consultant1  10234 Mar  4 10:14 db1.conf
-rw-r-----.  1 database1 consultant1   2048 Mar  4 10:18 db2.conf

The ls command -a option shows the permissions of hidden files, including the special files to represent the directory and its parent. In this example, the . special directory reflects the permissions of dir itself, and the .. special directory reflects the permissions of its parent directory.

For the db1.conf file, the user that owns the file (database1) has read and write permissions but not execute permission. The group that owns the file (consultant1) has read and write permissions but not execute permission. All other users have read permission but not write or execute permissions.

The following table explores some effects of this set of permissions for these users: