GNU Linux File Permissions: Introductory Guide and Best Practices

Introduction

Linux is a powerful operating system used by millions of people around the world. It is known for its stability, security, and flexibility, and is used in a wide range of applications, from servers and desktops to embedded devices and supercomputers.

One of the key features of Linux is its file system, which is based on a hierarchical tree-like structure. Each file and directory in the file system has a set of permissions that control who can access it and what actions they can perform on it. Understanding file permissions is essential for any Linux user, whether you’re a system administrator managing a large network of servers or a casual user working on a personal computer.

In this post, we’ll provide a comprehensive guide to Linux file permissions, starting with the basics of file permissions and ownership and moving on to more advanced topics like modifying permissions and best practices for setting file permissions. By the end of this post, you should have a solid understanding of how file permissions work in Linux and how to work with them effectively. Since I have been facing several content piracy cases lately, this blog post has ONLY been published on the Software, Architecture, and Cloud blog - SWAC.blog and canonically to dev.to only. If you are reading it elsewhere, then please let us know.

Basic Concepts

Before we dive into the chmod command, let’s first cover some basic concepts related to file permissions in Linux.

In Linux, every file and directory has three sets of permission bits that determine who can read, write, and execute the file. The permission bits are represented by the letters r (read), w (write), and x (execute). Each set of permission bits represents a different class of users: the owner of the file, the group that the file belongs to, and everyone else.

For example, consider the following output from the ls command:

$ ls -l test.txt
-rw-r--r-- 1 john users 0 Apr 18 2023 test.txt

In this case, the file test.txt has the following permissions:

• The owner of the file (john) has read and write permissions.
• The group that the file belongs to (users) has read permissions.
• Everyone else has read permissions.

The first character in the output (a hyphen in this case) indicates that this is a regular file. If the file were a directory, this character would be replaced by a d.

Ownership also plays a role in file permissions. In Linux, every file and directory has an owner and a group. The owner is usually the user who created the file, while the group is a collection of users who have certain permissions on the file.

For example, consider the following output from the ls command:

$ ls -l test.txt
-rw-r--r-- 1 john users 0 Apr 18 2023 test.txt

In this case, the file test.txt is owned by the user john and belongs to the group users.

The Different Types of Users

As we mentioned earlier, there are three types of users that can have permissions on a file in Linux: the owner, the group, and everyone else.

The owner is the user who created the file. The owner has the most control over the file and can read, write, and execute it (if the appropriate permission bits are set).

The group is a collection of users who have certain permissions on the file. By default, when a file is created, it belongs to the primary group of the user who created it. However, the group can be changed using the chgrp command.

Everyone else refers to all other users who are not the owner or a member of the group that the file belongs to. Everyone else has the least amount of control over the file and can only read it (if the appropriate permission bits are set).

The chmod Command

Now that we understand the basic concepts of file permissions in Linux, let’s move on to the chmod command.

The chmod command is used to modify the permissions of a file or directory. The syntax of the chmod command is as follows:

chmod [options] mode file/directory

The options for the chmod command can be used to modify the behavior of the command. Here are some of the most common options:

• -R: Recursively apply the permissions to all files and directories under the specified directory.
• -v: Verbose output. Show each file that is modified by the command.
• -c: Verbose output. Show each file that is modified by the command, but only display if the permissions are actually changed.

The mode argument is used to specify the new permissions for the file or directory. There are two ways to specify the mode: numeric mode and symbolic mode.

Numeric Mode

In numeric mode, the permissions are represented by a three-digit number. Each digit represents a different set of permission bits: the first digit represents the permissions for the owner, the second digit represents the permissions for the group, and the third digit represents the permissions for everyone else.

Each digit is calculated by adding up the following values:

• 4: Read permission
• 2: Write permission
• 1: Execute permission

For example, to set read and write permissions for the owner, read permissions for the group, and no permissions for everyone else, you would use the following command:

$ chmod 640 test.txt

In this case, the first digit (6) represents the permissions for the owner (4 + 2 = 6), the second digit (4) represents the permissions for the group (4 = 4), and the third digit (0) represents the permissions for everyone else (no permissions).

Symbolic Mode

In symbolic mode, the permissions are represented by a combination of letters and symbols. Here are the different letters and symbols that can be used:

• r: Read permission
• w: Write permission
• x: Execute permission
• u: User (owner)
• g: Group
• o: Other (everyone else)
• +: Add permissions
• -: Remove permissions
• =: Set permissions to exactly what is specified

For example, to set read and write permissions for the owner, read permissions for the group, and no permissions for everyone else, you would use the following command:

$ chmod u+rw,g+r,o-rwx test.txt

In this case, we’re using the u+rw option to add read and write permissions for the owner, the g+r option to add read permissions for the group, and the o-rwx option to remove all permissions for everyone else.

Best Practices

Now that we know how to use the chmod command to modify file permissions, let’s talk about some best practices for setting file permissions in Linux.

The principle of least privilege is a key concept in Linux security. It states that users and processes should be given only the minimum amount of access necessary to perform their tasks. In other words, don’t give users or processes more permissions than they need.

Here are some specific recommendations for setting file permissions in Linux:

• Set the permissions to the minimum required for the user or process to perform their task.
• Use groups to manage permissions instead of giving individual users permissions.
• Use the umask command to set default permissions for newly created files and directories.

The umask command is used to set the default permissions for new files and directories. The umask value is subtracted from the maximum permissions to determine the default permissions. For example, if the umask value is 022, the default permissions for a new file would be 644 (666 – 022 = 644), and the default permissions for a new directory would be 755 (777 – 022 = 755).

Conclusion

In conclusion, understanding Linux file permissions is an essential skill for anyone working with Linux systems. The file system is the backbone of the operating system, and the ability to manage permissions is crucial for ensuring the security and stability of the system.

In this post, we’ve covered the basics of file permissions in Linux, including the meaning of the different permission bits, how ownership affects permissions, and how to use the chmod command to modify permissions. We’ve also discussed best practices for setting file permissions, including the principle of least privilege and the use of groups and the umask command.

By following these best practices and using the tools provided by Linux, you can ensure that your system is secure and that your files and directories are accessible only to those who need them. If you have any questions or feedback, please let us know. We hope this post has been helpful, and we wish you the best of luck in your Linux endeavors! Since I have been facing several content piracy cases lately, this blog post has ONLY been published on the Software, Architecture, and Cloud blog - SWAC.blog and canonically to dev.to only. If you are reading it elsewhere, then please let us know.

For more articles about AWS & how to begin your AWS journey, visit AWS section on the Software, Architecture & Cloud blog - SWAC.blog