The SLUG Presentation Series

Permissions allow the owner of the file/directory to specify who has access to the file or directory and how they can use it. It should be noted that directories are treated like files on Linux systems, so they have permissions just like regular files. There are three basic types of permissions.

Read

Read permission allows the user to view the contents of a file (for example, with an editor). On directories, read access allows you to list the directory contents.

Write

Write permission allows the user to modify the contents of a file, but not delete or rename it. For directories, write permission allows the user to create new files and delete or rename existing files in a directory.

Execute

Execute permission allows the user to run a file as a program. The file should either be a shell script or a compiled executable program. (If you execute something that isn't really executable, unexpected errors will result.) For directories, execute permission is much more involved.

For directories, execute permission means that if you or your group (see below regarding ownership) has execute permissions, you can list the directory's contents, read the directory's files (assuming you have read permissions for the files you want to read), and change your working directory to this directory. If a user or group doesn't have execute permissions to a directory, they can't read or list anything in it, regardless of the permissions on individual files. Oddly, if you have read but not execute permission on a directory, and you try to list files in the directory, you'll get an error message that lists the contents of the directory.

Ownership

Each user on a Linux system has a unique number associated with him or her that is his or her "userid". That's in addition to their user name on the system. User IDs often start at 500 for regular users. In addition, each user may have more than one group he belongs to. Groups are represented by numbers as well, often also starting at 500. Although a user may be associated with more than one group, files and directories can only have one group they are associated with.

Examples Here's the output of the ls -l command in a sample directory:

-rw-r--r--   1 paulf    users       17989 Jun 21  1999 COPYING
lrwxrwxrwx   1 paulf    users          17 May  4 23:33 Changelog ->
content/Changelog
-rw-rw-r--   1 paulf    users         528 Jun 21  1999 Makefile
-rw-rw-r--   1 paulf    users         972 Jun 21  1999 README
drwxrwxr-x   2 paulf    users        4096 Aug  4  1999 bin
drwxrwxr-x   3 paulf    users        4096 Aug  4  1999 content
drwxrwxr-x   5 paulf    users        4096 Jul 16  1999 examples
-rwxr-xr-x   1 paulf    users       21231 Aug  4  1999 genpage
-rw-rw-r--   1 paulf    users         424 Jul 31  1999 genpage.conf
drwxrwxr-x   2 paulf    users        4096 Jul 16  1999 include
drwxrwxr-x   2 paulf    users        4096 Jul 31  1999 layout
drwxr-xr-x   2 paulf    users        4096 Jul 16  1999 news.themes
drwxr-xr-x   3 paulf    users        4096 Feb 16 01:16 www

First, let's look at the far left hand column. You see an array of letters that indicate what kind of thing is being talked about and the permissions assigned to it. That permission string is divided into four groups. The first group is just one letter. In our case, it is either a dash (-), a d or an l. The dash means that this file is just a regular file. A d means that this "file" is really a directory. An l is a special case of a file. It's a link. In Linux, you can make a link that points to another file or directory. In our case, it's a link called Changelog in the current directory, but the real file is called by the same name in the content subdirectory. (Note the -> that shows where the link points to.

The other three groups are three letters each, and are all very similar. The first group of three letters is the permissions for the owner of the group. Let's look at the genpage file above. The genpage file is a regular file, as shown by that first dash (-) on the left. The second set of three characters are rwx. Remember that there are three types of permissions: read, write and execute. And that's what the rwx string there indicates. This file has read, write and execute permissions for the owner of the file.

Let's look at the second set of three characters. These apply to the group that the owner belongs to. These are r-x for the genpage file. Notice that the second w character has been replaced by a dash (-). This file has read and execute permissions, but not write permissions for the group the user belongs to. So other members of the user's group can read the file, execute it, but they can't modify, delete or rename it.

The last set of three permission characters apply to everyone else besides the user and his group. They would apply, for instance to some other user on the system who isn't part of the user's group. For the genpage file, these are the same as they were for the group, r-x. But these apply to others. So anyone else on the system can read this file and can execute it, but they can't modify, delete or rename it.

-rwxr-xr-x   1 paulf    users       21231 Aug  4  1999 genpage

Now, let's look at the rest of the line. The next thing you see is a number. This is the number of links to a file. Remember links? You can have many links that point to a single file, if you like, but in our case, there is only one link, the file itself.

Next you see the user name for the owner of the file. Next is the group that the file belongs to. Incidentally, this may or may not be a group the user himself belongs to.

Next you see a number, which is the size in bytes of this file.

Next you see a date, in our case the 4th day of August, 1999. This is the date and time of the file's last modification.

Last, you see the name of the file.

Now let's look at a directory.

drwxrwxr-x   5 paulf    users        4096 Jul 16  1999 examples

This is obviously similar to the genpage file, in that it's owned by the same person and the same group. The size is smaller. For directories, file size usually relates to the number of files contained in that directory. In our case it doesn't mean that there are 4096 files in the directory, just that Linux has set aside this much space to hold the actual directory entry. But there's no direct correlation between the number of files in a directory and the size of the directory entry in bytes.

Let's look at the permission string. This is a directory, as we can see from that first d. The second set of three characters relate to the owner's permissions, and are rwx, as before. But this is a directory. The read permission means the owner can read what's in the directory. The write permission means the owner can create and delete files in that directory. The execute permission means the same as the read permission in this case: the owner can list the contents of the directory.

Now, the second set of three permission characters are the same as the first set. That means that members of the group for this directory have the same rights as the owner of the directory. They can list the directory's contents, read, write, create and delete files in this directory.

The last set of three characters is r-x. Again, the write permission has been dropped for everybody besides the owner and his group. Anyone else can take a look at what's in the directory (read and execute permissions), but they can't write files in this directory. So they can't make up their own files and put them in this directory, or tamper with the files that are already in there.

Numeric Permissions

Up until now, we've dealt with permissions in terms of the letters r, w and x. This is the way you see them with the ls -l command. But there are other commands that can use an alternate way of showing permissions, and it's important to be able to understand this alternate way. This new way shows permissions by numbers.

For those of you who are math impaired, here is a table that shows how permission strings map to numbers. For those who are mathematically inclined, a more technical explanation appears below.

no permissions             ---   0
execute only               --x   1
write only                 -w-   2
write and execute          -wx   3
read only                  r--   4
read and execute           r-x   5
read and write             rw-   6
read, write and execute    rwx   7

These numbers apply to each type of permission in the permission string. So for a permission string of

rwxrw-r-x

rwxr-xr--
111101100
 7  5  4

r-xrwx--x
101111001
 5  7  1

The chmod command

Here's where all this permission stuff becomes useful. Let's say you want to change the permissions of a file or a directory for some reason. Let's say you created a shell script, and now you want to make it executable (it won't run unless you do). Let's say your shell script looks like this when you run the ls -l command (ls -l genpage):

-rw-rw-r--   1 paulf    users       21231 Aug  4  1999 genpage

We can use the chmod command to give it execute permission this way:

chmod +x genpage

-rwxrwxr-x   1 paulf    users       21231 Aug  4  1999 genpage

Now you can see that we made it executable for everyone. The +x in the chmod command means "add executable permission all around".

Now let's say we don't want anyone reading this file, not even ourselves. We can do this:

chmod -r genpage

--wx-wx--x   1 paulf    users       21231 Aug  4  1999 genpage

Now you can see we've removed the read permission for everyone. Kinda goofy, since now the owner can't even read it.

So far, we've changed permissions "globally" for our file. That is, we've changed read and execute permissions for everyone. But let's say that we just want to make the file readable by the owner and no one else.

chmod u+r genpage

-rwx-wx--x   1 paulf    users       21231 Aug  4  1999 genpage

Ah, now I can read my own file again. The u+r means "add read permission for the user who owns the file". But let's say it's not really that secret, and we'd like other members of my group to read it as well (but no one else).

chmod g+r genpage

-rwxrwx--x   1 paulf    users       21231 Aug  4  1999 genpage

Now I can read it and my group can read it. The g+r means "add read permission for other members of the group."

There are all kinds of combinations that follow the same pattern. As we've seen, u represents the user who owns the file, and g is the group. There are two other letters that operate similarly. The first is o which stands for "others". These are those other people not lucky enough to be in your group. The last letter is a for "all". That includes the user who owns the file (u), the group (g) and others (o). Notice that when we first changed permissions on this file, we just said

chmod +x genpage

That changed the execute permission for everyone. As you might have guessed, that's the same as saying

chmod a+x genpage

If you leave off a u g o or a, chmod assumes that you mean a, which is why the first command changed the executable permission for all users.

Of course, you can eliminate permissions the same way you add them:

chmod o-x genpage

would eliminate executable permissions for other users (but not you or your group). The result would be:

-rwxrwx---   1 paulf    users       21231 Aug  4  1999 genpage

In addition to the - and + characters, you can use the = character to set the permissions the way you want (as opposed to adding or subtracting permissions.

chmod u=r genpage

This would make read permission the only one the owner has for this file:

-r--rwx---   1 paulf    users       21231 Aug  4  1999 genpage

You can also do more than one thing at once with the chmod command:

chmod u=w,o+x genpage

This would make the owner only able to write the file (not read it) and add execute permission for all the non-group users:

--w-rwx--x   1 paulf    users       21231 Aug  4  1999 genpage

Obviously, this can get kind of cumbersome if you want to set a lot of permissions very specifically on a file or set of files. The answer is to set the permissions numerically. Let's take our original file:

-rw-rw-r--   1 paulf    users       21231 Aug  4  1999 genpage

What are the numeric permissions on this file as it stands right now? Recall from the table that rw- is 6 and r-- is 4. So the permissions on this file would be 664.

What if we want to give executable permissions to everyone? In that case, the permission string would look like this:

rwxrwxr-x

Looking at the table, rwx is 7 and r-x is 5. So numerically, the permissions on this file would be 775. If we wanted to make chmod change the permissions numerically, we would say:

chmod 775 genpage

Note that with numeric permissions, it isn't possible to add and delete permissions. With numeric permissions, you have to specify exactly what the permissions would be for the owner, group and others all at the same time.

You may not use numeric permissions much, but old hands at Unix and Linux use them because they allow you to specify exactly what the file permissions should be without a lot of gobbledegook in the chmod command. After a while you just know that r-x equals 5 and rwx is 7, etc. But one of the biggest reasons for knowing numeric permissions is that they are stored this way in the Linux file system. Linux doesn't store an x and an r, etc. Linux stores these permissions in just a few bytes in the directory entry for a file, and does so with numbers just like these (though in this case they're stored as binary numbers).

This is not a definitive treatise on the chmod command. There are many other things you can do with it. These are covered in the chmod(1) man page.

Ownership

One last point. You can change permissions with the chmod command, but not file ownership. For that, you use the chown command. Let's take our original file:

-rw-rw-r--   1 paulf    users       21231 Aug  4  1999 genpage

One important thing to note. Unless you are the owner of a file or root, you can't change the owner of a file to someone else. That is, if you're Sam and the file belongs to Joe, you can't just randomly go changing ownership on the file. You have to be root or the file's owner to do things like this, and in the following examples, I'll assume the person issuing the command is root.

chown nancyf:users genpage

Now we've changed the owner to nancyf and kept the group the same:

-rw-rw-r--   1 nancyf   users       21231 Aug  4  1999 genpage

Notice the colon (:) in the command above. This can be a period (.) as well. The choice it up to you. The first item (nancyf) is the user, and the second one (users) is the group.

There are lots of ways to use the chown command.

chown nancyf genpage

would change the owner to nancyf and leave the group untouched.

chown nancyf: genpage

would change the owner to nancyf and make the group the login group for nancyf, regardless of what the group was before.

chown :users genpage

would change the group, but not the owner of the file. (This is similar in function to the chgrp command.)

Again, there are more things that can be done with the chown command. For more information, see the chown(1) man page.

Paul M. Foster