Permissions: Mode, User and Group Ownership¶

Owner and Permissions ¶

Types of permissions

Read (r)
Write (w)
Execute (x)

Separate permissions for …

User (u): the owning user of the entry
Group (g): the owning group of the entry
Others (o): all others

A Simple Example ¶

Group team
User jfasch, member (among possibly others) of group team
User teammember42, also member of group team
User manfromthestreet, not member of group team

The typical ls -l output:

$ ls -l tasks.csv
-rw-rw-r-- 1 jfasch team 396 Jun  8 14:49 tasks.csv

Three groups of “bits”: rw-, rw-, r--

Bits	Meaning
`rw-`	Read- and writable for owning user (`jfasch`)
`rw-`	Read- and writable for (members of) owning group (`team`)
`r--`	Readable for all others: those who are neither user `jfasch` nor belong to group `team`

First column (-) is irrelevant (it’s the type: regular file)

Permission Check: User ¶

Can user jfasch write the file?

Which triplet to check?
- jfasch is the owner of the file
- ⟶ The first triplet: rw-
⟶ yes, jfasch can write
(likewise, jfasch will be able to read)

Permission Check: Group ¶

Can user teammember42 write the file?

Which triplet to check?
- teammember42 is not jfasch ⟶ not the first triplet
- Is teammember42 a member of group team?
```
$ id teammember42
uid=1001(teammember42) gid=1002(teammember42) groups=1002(teammember42),1001(team)
```
  - Answer: yes
  - ⟶ second triplet, rw-
⟶ yes, teammember42 can write
(likewise, teammember42 will be able to read)

Permission Check: Others ¶

Can user manfromthestreet read the file?

Which triplet to check?
- manfromthestreet is not jfasch ⟶ not the first triplet
- Is manfromthestreet a member of group team?
```
$ id manfromthestreet
uid=1002(manfromthestreet) gid=1003(manfromthestreet) groups=1003(manfromthestreet)
```
  - Answer: no
  - ⟶ not the second triplet
- ⟶ manfromthestreet is among the others
  - Third triplet, r--
  - ⟶ no, manfromthestreet cannot write
  - (manfromthestreet can read though)

Programs: Execute Permissions ¶

What makes a file a program?

$ ls -l /bin/ls
-rwxr-xr-x ... /bin/ls

Facts …

An executable file does not have to end with .exe to be executable
… it simply is executable

Directory Permissions ¶

$ ls -ld /etc
drwxr-xr-x 1 root root 4882 Mar 22 12:20 /etc

Read permissions: content (list of names) is readable
Execute permissions: to access a file (e.g. for reading), one has to have execute permissions on the parent directory and all directories along the path
The right to cd into the directory

Permission Bits, octal ¶

`ls -l` Output	Binary	Shell command
`-rw-r--r--`	`110100100`	`chmod 0644 <path>`
`-rw-------`	`110000000`	`chmod 0600 <path>`
`-rwxr-xr-x`	`111101101`	`chmod 0755 <path>`

Shell Commands: Tuning Permissions ¶

Permission modification (set to octal value, absolutely, the whole bitmask no matter what)

$ ls -l /bin/script.sh
-rw-rw-r-- 1 jfasch jfasch 612 Mar 23 18:39 script.sh
$ chmod 755 /bin/script.sh
-rwxr-xr-x 1 jfasch jfasch 0 Mar 23 18:39 script.sh

Permission modification (differential symbolic)

$ ls -l /bin/script.sh
-rw-rw-r-- 1 jfasch jfasch 612 Mar 23 18:39 script.sh
$ chmod u+x,g-w,g+x,o+x script.sh
$ ls -l script.sh
-rwxr-xr-x. 1 jfasch jfasch 0 Mar 23 18:42 script.sh

Shell Commands: Changing User/Group Ownership ¶

Group ownership modification (only root and members of the group can do this)
```
$ chgrp team /tmp/file
```
Ownership modification (only root)
```
# chown jfasch /tmp/file
```
chmod, chown, and chgrp understand -R for “recursive”.