Understanding UNIX and Linux File Permissions

Description

UNIX and Linux operating systems use file permissions to control who can read, modify, or execute files and directories. Understanding these permissions is essential for maintaining system security, troubleshooting access problems, and managing shared resources.

This guide explains how UNIX permissions work, how to interpret permission strings, and how to modify permissions using common Linux commands.

Procedure

1. Understanding Permission Types

UNIX uses three basic permission types:

Permissions are assigned to three categories of users:

• Owner (User): The account that owns the file or directory.
• Group: Users belonging to the group assigned to the file or directory.
• Others: Everyone else who is not the owner or a member of the assigned group.

2. Viewing File Permissions

To view file and directory permissions, open a terminal and run:

ls -l

Example output:

-rwxr-xr-- 1 admin staff 2048 Nov 5 10:30 script.sh

The first field represents the file type and permissions:

-rwxr-xr--

It can be broken down into four sections:

-   rwx   r-x   r--
|    |     |     |
|    |     |     +-- Others
|    |     +-------- Group
|    +-------------- Owner
+------------------- File Type

Explanation:

• - indicates a regular file.
• rwx means the owner can read, write, and execute.
• r-x means the group can read and execute, but not write.
• r-- means others can only read.

Common file type indicators include:

3. Understanding Numeric (Octal) Permissions

UNIX permissions can also be represented using numbers.

Each permission has a numeric value:

Read    = 4
Write   = 2
Execute = 1

Add the values together to determine the permission number.

Example: Permission 755

Owner:   7 = 4 + 2 + 1 = rwx
Group:   5 = 4 + 0 + 1 = r-x
Others:  5 = 4 + 0 + 1 = r-x

Result:

rwxr-xr-x

Example: Permission 644

Owner:   6 = 4 + 2 + 0 = rw-
Group:   4 = 4 + 0 + 0 = r--
Others:  4 = 4 + 0 + 0 = r--

Result:

rw-r--r--

4. Common UNIX Permission Settings

Security Note: Avoid using permission 777 unless absolutely necessary. It grants all users read, write, and execute permissions and can create significant security risks.

5. Changing Permissions with chmod

The chmod command changes file and directory permissions.

Set permissions using numbers

Give the owner full access and everyone else read and execute access:

chmod 755 script.sh

Allow the owner to read and write while everyone else can only read:

chmod 644 document.txt

Restrict a file to its owner:

chmod 600 private.key

Set permissions using symbols

Permissions can also be changed using symbolic notation.

chmod u+x script.sh

Adds execute permission for the owner.

chmod g+w shared.txt

Adds write permission for the group.

chmod o-r confidential.txt

Removes read permission from others.

chmod a+r document.txt

Adds read permission for all users.

Symbol definitions:

6. Understanding Directory Permissions

Directory permissions behave differently from regular file permissions.

For example:

chmod 755 /home/admin/shared

This allows the owner full directory access while other users can list and traverse it.

A directory typically requires both write and execute permissions to allow users to create or delete files inside it.

Important: Deleting a file is generally controlled by permissions on its parent directory, not by write permission on the file itself. Sticky-bit restrictions and other security controls may also apply.

7. Changing File Ownership

Permissions are closely related to file ownership.

Use the chown command to change ownership.

Change file owner

sudo chown admin document.txt

Change owner and group

sudo chown admin:staff document.txt

Change ownership recursively

sudo chown -R admin:staff /srv/shared

The -R option applies the change to the directory and everything inside it.

To change only the group, use:

sudo chgrp staff document.txt

Warning: Recursive ownership changes can affect application functionality. Always verify the target directory before executing these commands.

8. Understanding Special Permissions

UNIX also supports three special permission bits.

SetUID (4)

When applied to an executable file, SetUID can cause it to execute using the file owner's effective user identity.

Example:

chmod 4755 program

SetGID (2)

On an executable, SetGID can run the program using the file group's effective identity.

On a directory, SetGID causes newly created files and subdirectories to inherit the directory's group.

Example:

chmod 2775 /srv/shared

Sticky Bit (1)

On directories, the sticky bit restricts who can delete or rename entries, even when the directory is writable by multiple users.

Example:

chmod 1777 /tmp/example

The /tmp directory commonly uses permission 1777.

Special permissions should be configured carefully because they affect system security and resource access.

9. Troubleshooting Permission Denied Errors

A common Linux error is:

Permission denied

Follow these steps to troubleshoot.

Step 1: Check current permissions

ls -l filename

Step 2: Identify your current user

whoami

Step 3: Check group membership

id

Step 4: Check directory permissions

ls -ld /path/to/directory

For deeper troubleshooting, inspect each parent directory:

namei -l /path/to/file

Step 5: Correct permissions if appropriate

For a script that should be executable by its owner:

chmod u+x script.sh

Step 6: Verify ownership

ls -l script.sh

If ownership is incorrect, an authorized administrator can correct it:

sudo chown admin:staff script.sh

Do not automatically apply chmod 777 to resolve permission errors. Identify the actual access requirement and grant only the necessary permissions.

If standard permissions appear correct, investigate ACLs, SELinux or AppArmor policies, filesystem mount options, and application-specific restrictions.

10. Best Practices

• Follow the principle of least privilege: grant only the permissions required.
• Use 644 for ordinary files and 755 for directories when public read access is appropriate.
• Use 600 for sensitive files such as private keys.
• Use groups to manage shared access instead of granting write access to everyone.
• Avoid unnecessary recursive chmod and chown commands.
• Review special permissions on executable files.
• Periodically audit permissions on sensitive directories and configuration files.
• Remember that POSIX ACLs and additional security controls can affect effective permissions.

11. Quick Reference Commands

Addtional Information

Understanding UNIX file permissions is a fundamental skill for Linux and UNIX system administration.

By learning the relationship between owners, groups, read/write/execute permissions, and numeric permission values, administrators can troubleshoot access problems and maintain secure systems.

The most commonly encountered permissions are 644 for standard files, 755 for directories and executable programs, and 600 for sensitive files. Always adjust these defaults to match the actual security requirements of the system.