Linux permissions¶

Practical 5.4 linux-permissions-annex.pdf · PDF

Marta and Pau share the same Debian machine at Tramuntana Apps. Pau is the intern. Can he read Marta's files? Can he delete them? Who decided?

Nobody decided file by file. Every file on Linux carries a small card on its door with the answer. You have been looking at those cards for weeks, every time you typed ls -l: ten little characters at the start of each line. Today you learn to read them and to write them. And at the end, you build a folder that only the dev team of Tramuntana Apps can enter.

Who may read the most secret file?¶

You know from the previous session that /etc/shadow holds the password hashes. Who can read it?

ls -l /etc/shadow /usr/bin/passwd

-rw-r----- 1 root shadow    636 Oct  5 20:52 /etc/shadow
-rwsr-xr-x 1 root root   118168 Apr 19  2025 /usr/bin/passwd

Ten characters at the start of each line decide it. (The s in the second line is a riddle for the next session.)

The card on the door¶

Take one line and cut it into pieces:

-rw-r----- 1 marta dev 6 Jan 20 11:30 notes.txt

A permission is a yes/no switch that says whether someone may read (r), write (w) or execute (x) a file. A dash means "no".

The three letters always come in the same order: r, w, x. Each group of three is a triplet. So notes.txt above says: marta may read and write, the dev group may only read, everybody else gets nothing.

How Linux decides¶

When someone tries to open a file, the kernel asks three questions in order and stops at the first "yes":

flowchart TB
    A["<b>Someone opens the file</b>"] --> Q1{"Are you<br>the <b>owner</b>?"}
    Q1 -->|"yes"| U["Use the <b>first</b> triplet<br>(u)"]
    Q1 -->|"no"| Q2{"Are you in<br>the <b>group</b>?"}
    Q2 -->|"yes"| G["Use the <b>second</b> triplet<br>(g)"]
    Q2 -->|"no"| O["Use the <b>third</b> triplet<br>(o)"]

And root skips the card entirely.

Practise: decode three cards¶

Make a script run¶

Create a tiny script in a lab folder and try to run it:

mkdir ~/lab && cd ~/lab
printf '#!/bin/bash\necho Hello from Tramuntana\n' > hello.sh
./hello.sh

-bash: ./hello.sh: Permission denied

The file has no x. Give it to yourself, the owner (u), and try again:

chmod u+x hello.sh
./hello.sh            # Hello from Tramuntana
ls -l hello.sh        # -rwxrw-r-- 1 marta marta 39 ... hello.sh

Two curious details:

• Typing hello.sh without ./ says command not found. The current folder is not in PATH, the list of places where the shell looks for commands.
• bash hello.sh works even without x. Then the program being run is bash, and bash only needs to read the file.

chmod: symbolic and octal¶

chmod (change mode) changes the permissions of a file. You can write the change in symbolic or in octal notation.

Symbolic: change one thing¶

You say who (u, g, o, or a for all), what to do (+ add, - remove, = set exactly) and which letters:

chmod u+x hello.sh       # the owner may run it
chmod g-w notes.txt      # the group may no longer write
chmod u+x,g-w,o= file    # several changes; o= means others get nothing

Octal: set everything at once¶

Remember Binary: three switches on or off are three bits. Give each letter a value, r = 4, w = 2, x = 1, and add them up:

r w x      r w -      r - x      r - -      - - -
4+2+1=7    4+2+0=6    4+0+1=5    4+0+0=4    0

One digit per triplet, in the order owner, group, others:

chmod 640 notes.txt   # -rw-r-----
chmod 600 notes.txt   # -rw-------
chmod 755 notes.txt   # -rwxr-xr-x

A directory is a list of names¶

Here is the idea that surprises everyone. A directory is not a box full of files. It is a list of names pinned on a door. So the same three letters mean something different:

Try it. Put a secret in box, then change the directory's card three times:

echo secret > box/a.txt

chmod u-x box            # the list is readable, the door is closed
ls box                   # a.txt
cat box/a.txt            # cat: box/a.txt: Permission denied

chmod u+x,u-r box        # the door is open, the list is hidden
ls box                   # ls: cannot open directory 'box': Permission denied
cat box/a.txt            # secret

chmod 500 box            # read and enter, but the list cannot change
touch box/b.txt          # touch: cannot touch 'box/b.txt': Permission denied
rm box/a.txt             # rm: cannot remove 'box/a.txt': Permission denied

chmod 700 box            # repair it

With u-x, ls -l box prints the name followed by question marks: it can read the name on the list but cannot walk through the door to ask the file its size. And in the second case, you can open a.txt if you already know its name, even though you cannot see the list.

The surprise: deleting a read-only file¶

chmod 400 box/a.txt      # read-only, even for you
echo more >> box/a.txt   # Permission denied
rm -f box/a.txt          # works!

Deleting a file does not touch the file. It removes a name from the directory's list. So what counts is w (and x) on the directory.

Owner and group: chown and chgrp¶

On 21 February 2018, the JavaScript package manager npm shipped a pre-release, version 5.7.0. A bug made it change the owner of files while it worked. People who ran it with sudo on Linux found that /etc, /usr and /boot no longer belonged to root. Programs stopped working; some machines did not boot and had to be reinstalled. The fix, 5.7.1, came out the next day. Nobody changed a single rwx letter, only the owner. The card on the door has two halves, and both matter.

chown (change owner) changes the owner of a file, and optionally its group. chgrp (change group) changes only the group.

sudo chown root:dev /srv/tramuntana/dev   # owner root, group dev
chgrp dev notes.txt                       # only the group
chown pau notes.txt

chown: changing ownership of 'notes.txt': Operation not permitted

The rules:

• Only root can give a file to another user. Otherwise you could "donate" files to someone to hide them, or to blame them.
• The owner can change the group, but only to a group they belong to.
• Write root:dev with a colon and no spaces.

umask: who chose the permissions of a new file?¶

Run touch notes.txt and mkdir box in a fresh folder and look:

drwxrwxr-x 1 marta marta 0 Oct  5 20:52 box
-rw-rw-r-- 1 marta marta 0 Oct  5 20:52 notes.txt

Nobody typed rw-rw-r--. So who chose it?

The umask is the list of permissions to take away from every new file or directory. New files start from 666 (rw-rw-rw-), new directories from 777 (rwxrwxrwx).

umask        # 0002 for a normal user on Debian 13

For these common values you can subtract digit by digit. That is a simplification: the real rule is "remove these bits", not arithmetic. And a new file never gets x from the umask, because it starts at 666, not 777.

umask 027
touch u027.txt       # -rw-r-----  (640)
mkdir d027           # drwxr-x---  (750)

A umask set in a terminal dies with that terminal.

Practical 5.4: one folder per department¶

Tramuntana Apps wants a folder for each department under /srv/tramuntana. Only the members of the department may enter. The owner is root, so no employee can change the rules. The full statement is on the Practical 5.4 sheet.

for g in dev design admin; do
    sudo mkdir -p /srv/tramuntana/$g
    sudo chown root:$g /srv/tramuntana/$g
    sudo chmod 770 /srv/tramuntana/$g
done
ls -l /srv/tramuntana

drwxrwx--- 2 root admin  4096 ... admin
drwxrwx--- 2 root design 4096 ... design
drwxrwx--- 2 root dev    4096 ... dev

A permission you have not tested as another user is a guess. So test as Pau (dev) and as Joan (design):

sudo su - pau
whoami                                   # pau
touch /srv/tramuntana/dev/pau.txt        # works: pau is in dev
exit
sudo su - joan
ls /srv/tramuntana/dev                   # Permission denied: joan is not in dev
exit
sudo ls -l /srv/tramuntana/dev           # -rw-rw-r-- 1 pau pau 0 ... pau.txt

Three things that confuse people:

• sudo su - pau asks for your password, not Pau's: sudo checks who you are, then runs su as root. Check who you are with whoami before every test.
• If you test as your own user, who is not in dev, you get denied. That is not a bug: that is the folder working.
• On Debian 13, homes are drwx------ (700). Nothing in someone else's home is visible. Shared work lives in /srv/tramuntana, not in a home.

Now look at pau.txt again. Its group is pau, not dev. Marta is in dev, but for this file she is neither the owner nor in its group: she falls in others, so she can read it but not change it. A shared folder where colleagues cannot edit each other's files is not really shared yet. You will fix that in the next session.

Key takeaways¶

• Every file has a card on the door: a type, three triplets (owner, group, others), one owner and one group. Linux uses only the first triplet that matches.
• On a file, r reads, w changes, x runs. On a directory, r lists the names, w changes the list, x lets you walk through.
• Deleting a file needs w on the directory, not on the file.
• chmod uses symbolic (u+x, g-w) or octal notation (r=4, w=2, x=1: 640 = rw-r-----).
• chown changes the owner (only root may give files away); chgrp changes the group.
• The umask takes permissions away from 666 (files) and 777 (directories): 0002 gives 664 and 775.

Quick check¶

The folders exist, but colleagues still cannot edit each other's files. Next you fix that, and solve the riddle of the s, in Special permissions and ACL.