Linux Permissions made easy

The Quick Part Linux, like every machine, is used by users (real or not) each with their own UID. The normal ones are the humans like you and me, the root, and some psuedo users that are used to isolate system level services such daemons, nvidia, systemd-* etc (check cat /etc/passwd ). What we are concerned about usually is us and the one above us, root. Users and Groups All these users are assorted into groups, which form the core part of how kernel enforces permissions. Each group have its own GID (check cat /etc/group ) Membership A user belongs to at least one group, its primary group. Other groups the user is part of are known as its supplementary groups. By default, any user belongs to primary group of their own username (human:human, user human belongs to group human), and this can be changed. id # UID, GIDs whoami # username groups [username] # group names Permissions Permission, relvant to a user, is the ability to perform an action on an entity. These permissions apply to files, and everything is a file. So, permissions apply to files, directories, devices, sockets, named pipes and many other things. The users who perform actions are divided into 3 types, with respect to the file. - User (u) - owner user - Group (g) - owner group - Others (o) - catch all When a file is first created, the current user in context becomes the owner user and their primary group becomes the owner group for that file. The imporant part - above assignment is the only point of relation between owner user and group. So, the owner user and owner group are essentially independent from each other. ex. a file's owner group is supplmentary for its owner user. or the owner user may not be part of the owner group at all. Recipe For each of the 3 types, 3 values are used for Read, Write and Execute, with their 3 octal values. - Read (r) value = 4 - Write (w) value = 2 - Execute (x) value = 1 For none, (-) value = 0 Think of these as each user type independenty getting their own triplet of read, write and execute. These are also written in decimal notation by summing the triplet. rwx = 4+2+1 = 7 rw- = 4+2+0 = 5 and rwxrw-rw- becomes 755 Check The decision to grant a particular permission is a sequence of checks. Commands 1. chmod Who Can Run? - root - owner user Description Modifies the permission values of the file chmod 754 file // overwrite chmod u+rx file // append chmod u+r-x file // append that overwrites chmod g-w, o+r file chmod -R 754 dir // recursive in directory Note the subtle difference between u+rx and u+r-x , the first one will retain the original setting of write, while second one unsets it. 2. chown Who Can Run? - root Description Sets wner user and owner group chown human file // owner user chown human:sapiens file // both owner user and group 3. chgrp Who Can Run? - root - owner user only if it belongs to destination group Description Sets owner group chgrp sapiens file Important Note when assigning new owner group through chgrp that the command executing user must also be a member of the group they are assigning, this prevents vulnerabilities. Root the root user has the highest elevated prviliges and can work on top of existing users and groups. Hence, it can run the above commands for any file and also has implcit rwx access to every file One caveat is if the permission for some file is 000 , meaning no permission set, it can still read and write but can't execute the file. Although, can simply do chmod +x file to give itself that permission. There are some special values like SGID and SUID but I will cover in next post. Thanks. Top comments (0)