Linux - Ownership and Permissions

The chown command allows the root user to change the user ownership of files and directories. A regular user cannot use this command to change the user owner of a file, even to give the ownership of one of their own files to another user. However, the chown command also permits changing group ownership, which can be accomplished by either root or the owner of the file.

There are three different ways the chown command can be executed. The first method is used to change just the user owner of the file. For example, if the root user wanted to change the user ownership of the abc.txt file to the user "ted", then the following command could be executed:

[root@localhost ~]# chown ted abc.txt

The second method is to change both the user and the group; this also requires root privileges. To accomplish this, you separate the user and group by either a colon or a period character. For example:

[root@localhost ~]# chown user:group /path/to/file
[root@localhost ~]# chown user.group /path/to/file

If a user doesn‘t have root privileges, they can use the third method to change the group owner of a file just like the chgrp command. To use chown to only change the group ownership of the file, use a colon or a period as a prefix to the group name:

[root@localhost ~]# chown :group /path/to/file
[root@localhost ~]# chown .group /path/to/file

When you execute the ls -l command, the resulting output displays ten characters at the beginning of each line, which indicate the type of file and the permissions of the file:

• The first character indicates the file type.
• Characters 2-4 indicate the permissions for the user that owns the file.
• Characters 5-7 indicate the permissions for the group that owns the file.
• Characters 8-10 indicate the permissions for "others" or what is sometimes referred to as the world‘s permissions. This would include all users who are not the file owner or a member of the file‘s group.

For example, consider the output of the following command:

[root@localhost ~]# ls -l /etc/passwd
-rw-r--r--. 1 root root 4135 May 27 21:08 /etc/passwd

Based on the previous command output, the first ten characters could be described by the following table:

The following table describes the possible values for the file type. Recall that these types were covered in a previous chapter:

Although all the file types are listed in the table above, most likely you will never encounter anything but regular, directory and link files unless you explore the/dev directory.

The characters in the permissions part of the output have the following meanings:

• r stands for read permission
• w stands for write permission
• x stands for execute permission

The permissions set on these files determine the level of access that a user will have on the file. When a user runs a program and the program accesses a file, then the permissions are checked to determine if the user has the correct access rights to the file.

The permissions themselves are deceptively simple and have a different meaning depending on whether they are applied to a file or a directory:

While the chart on the previous page can be a handy reference, by itself it doesn‘t provide a clear description of how permissions work. To better understand how permissions work, consider the following scenarios.

To understand these scenarios, you should first understand the following diagram:

The important information is highlighted. The first box represents the / directory, with a user owner of "root", a group owner of "root" and permissions of rwxr-xr-x. The second box represents the /data directory, a directory that is under the /directory. The third box represents the abc.txt file, which is stored in the/data directory.

You should also understand that if you are the owner of the file/directory, then only the user owner permissions are used to determine access to that file/directory.

If you are not the owner, but are a member of the group that owns the file/directory, then only group owner permissions are used to determine access to that file/directory.

If you aren‘t the owner and not a member of the file/directory group, then your permissions would be "others".

Question: Based on the following diagram, what access would the user "bob" have on the file abc.txt?

Answer: None

Explanation: Initially it would appear that the user "bob" can view the contents of the abc.txt file as well as copy the file, modify its contents and run it like a program. This erroneous conclusion would be the result of looking solely at the file‘s permissions (rwx for the user "bob" in this case).

However, in order to do anything with the file, the user must first "get into" the/data directory. The permissions for "bob" for the /data directory are the permissions for "others" (r--), which means "bob" can‘t even use the cdcommand to get into the directory. If the execute permission (--x) was set for the directory, then the user "bob" would be able to "get into" the directory, meaning the permissions of the file itself would apply.

Lesson learned: The permissions of all parent directories must be considered before considering the permissions on a specific file.

Question: Based on the following diagram, who can use the ls command to display the contents of the /data directory (ls /data)?

Answer: All users

Explanation: All that is required to be able to view a directory‘s contents is rpermission on the directory (and the ability to access the parent directories). Thex permission for all users in the / directory means all users can use / as part of a path, so everyone is able to get through the / directory to get to the /datadirectory. The r permission for all users in the /data directory means all users can use the ls command to view the contents.This includes hidden files, so thels -a command will also work on this directory.

However, note that in order to see file details (ls -l) would also require xpermission on the directory. So while the root user and members of the root group have this access on the /data directory, no other users would be able to execute ls -l /data.

Lesson learned: The r permission allows a user to view a listing of the directory.

Question: Based on the following diagram, who can delete the /data/abc.txtfile?

Answer: Only the root user

Explanation: A user needs no permissions at all on the file itself to delete a file. The w permission on the directory that the file is stored in is required to delete a file in a directory. Based on that, it would seem that all users could delete the/data/abc.txt file, since everyone has w permission on the directory.

However, to delete a file, you must also be able to "get into" the directory. Since only the root user has x permission on the /data directory, only root can "get into" that directory in order to delete files in this directory.

Lesson learned: The w permission allows a user to delete files from a directory, but only if the user also has x permission on the directory.

Question: True or false: Based on the following diagram, the user "bob" can successfully execute the following command: more /data/abc.txt?

Answer: True

Explanation: As previously mentioned, in order to access a file, the user must have access to the directory. The access to the directory only requires xpermission; even though r permission would be useful to list files in a directory, it isn‘t required to "get into" the directory and access files within the directory.

When the command more /data/abc.txt is executed, the following permissions are checked: x permission on the / directory, x permission on thedata directory and r permission on the abc.txt file. Since the user "bob" has all of these permissions, the command executes successfully.

Lesson learned: The x permission is required to "get into" a directory, but the rpermission on the directory is not necessary unless you want to list the directory‘s contents.

Question: True or false: Based on the following diagram, the user "bob" can successfully execute the following command: more /data/abc.txt (note that the /data directory has different user and group owners than previous examples)?

Answer: Not enough information to determine.

Explanation: In order to access the /data/abc.txt file, the user "bob" needs to be able to "get into" the /data directory. This requires x permission, which "bob" may or may not have, depending on if he is a member of the "payroll" group.

If "bob" is a member of the "payroll" group, then his permissions on the /datadirectory are r-x and the command more /data/abc.txt will execute successfully ("bob" also needs x on / and r on abc.txt, which he already has). If he isn‘t a member of the "payroll group", his permissions on the /data directory are --- and the more command would fail.

Lesson learned: You must look at each file and directory permissions separately and be aware of which groups the user account belongs to.

Question: True or false: Based on the following diagram, the user "bob" can successfully execute the following command: more /data/abc.txt (note that the /data directory has different user and group owners than previous example)?

Answer: False

Explanation: Recall that if you are the owner of a file, then the only permissions that are checked are the user owner‘s permissions. In this case, that would be ---for "bob" on the /data/abc.txt file.

In this case, members of the "bob" group and "others" have more permissions on the file than "bob" has.

Lesson learned: Don‘t provide permissions to the group owner and "others" without applying at least the same level of access to the owner of the file.

2. Using the chmod Command - Symbolic Method

The chmod (change mode) command is used to change permissions on a directory. There are two techniques that can be used with this command: symbolic and numeric. Both techniques use the following basic syntax: chmodnew_permission file_name.

If you want to modify some of the current permissions, the symbolic method will likely be easier to use. With this method, you specify which permissions you want to change on the file and the other permissions remain as they are.

When specifying the "new_permission", you start by using one of the following characters to indicate which permission set you want to change:

• u = change user owner‘s permissions
• g = change group owner‘s permissions
• o = change "others" permissions
• a = apply changes to all permission sets (user owner, group owner and "others")

Then you specify a + to add a permission or a - to remove a permission. Lastly, you specify r for "read", w for "write" and x for "execute".

For example, to give the user owner read permission on a file named abc.txt, you could use the following command:

[root@localhost ~]# chmod u+r abc.txt

You can combine values to make multiple changes to the file‘s permissions. For example, consider the following command which will add read permission to the user owner and group owner while removing write permission for "others":

[root@localhost ~]# chmod ug+r,o-w abc.txt

Lastly, you could use the = character instead of - or + to specify exactly the permissions you want for a permission set:

[root@localhost ~]# chmod u=r-x abc.txt

3. Using the chmod Command - Numeric Method

The numeric method (also called octal method) is useful when you want to change many permissions on a file. It is based on the octal numbering system in which each permission type is assigned a numeric value:

By using a combination of numbers from 0 to 7, any possible combination of read, write and execute permissions can be specified for a single permission set. For example:

When the numeric method is used to change permissions, all nine permissions must be specified. Because of this, the symbolic method is generally easier for changing a few permissions while the numeric method is better for changes that are more drastic.

For example, to set the permissions of a file named abc.txt to be rwxr-xr-- you could use the following command:

[root@localhost ~]# chmod 754 abc.txt

Part 6: Revisiting the stat Command

Recall the stat command discussed earlier in this chapter. This command provided more detailed information than the ls -l command provided.

Because of this, you may consider using the stat command instead of the ls -lcommand when viewing permissions on a file. One big advantage of the stat command is that it shows permissions both symbolically and by numeric method, as demonstrated below:

[sysadmin@localhost ~]$ stat /tmp/filetest1
  File: `/tmp/filetest1‘
  Size: 0         	Blocks: 0          IO Block: 4096   regular empty file
Device: fd00h/64768d	Inode: 31477       Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  502/sysadmin)   Gid: (  503/sysadmin)
Access: 2013-10-21 10:18:02.809118163 -0700
Modify: 2013-10-21 10:18:02.809118163 -0700
Change: 2013-10-21 10:18:02.809118163 -0700

Part 7: umask

The umask command is a feature that is used to determine default permissions that are set when a file or directory is created. Default permissions are determined when the umask value is subtracted from the maximum allowable default permissions. The maximum default permissions are different for files and directories:

The permissions that are initially set on a file when it is created cannot exceed rw-rw-rw-. To have the execute permission set on a file, you first need to create the file and then change the permissions.

The umask command can be used to display the current umask value:

[sysadmin@localhost ~]$ umask
0002

A breakdown of the output:

• The first 0 is indicates that the umask is given as an octal number.
• The second 0 indicates which permissions to subtract from the default user owner‘s permissions.
• The third 0 indicates which permissions to subtract from the default group owner‘s permissions.
• The last number (2) indicates which permissions to subtract from the default other‘s permissions.

Note that different users may have different umasks. Typically the root user will have a more restrictive umask than normal user accounts:

[root@localhost ~]# umask
0022

1. How umask Works

To understand how umask works, assume that the umask is set to 027 and consider the following :

The 027 umask means that, by default new files would receive 640 or rw-r-----permissions, as demonstrated below:

[sysadmin@localhost ~]$ umask 027
[sysadmin@localhost ~]$ touch sample
[sysadmin@localhost ~]$ ls -l sample
-rw-r-----. 1 sysadmin sysadmin 0 Oct 28 20:14 sample

Because the default permissions for directories are different than for files, a umask of 027 would result in different initial permissions on new directories:

The 027 umask means that, by default directories files would receive 750 or rwxr-x--- permissions, as demonstrated below:

[sysadmin@localhost ~]$ umask 027
[sysadmin@localhost ~]$ mkdir test-dir
[sysadmin@localhost ~]$ ls -ld test-dir
drwxr-x---. 1 sysadmin sysadmin 4096 Oct 28 20:25 test-dir

The new umask will only be applied to file and directories created during that session. When a new shell is started the default umask will again be in effect.

Permanently changing a user‘s umask requires modifying the .bashrc file located in that user‘s home directory.