🔐 File Permissions

The Big Idea

Linux is a multi-user system. Permissions answer three questions:

1. WHO can access this file?
2. WHAT can they do with it?
3. HOW strict are the rules?

---

The Three Permission Types

| Letter | Number | Meaning | For Files | For Directories | |--------|--------|---------|-----------|-----------------| | r | 4 | Read | View contents | List contents | | w | 2 | Write | Modify contents | Add/delete files | | x | 1 | Execute | Run as program | Enter directory |

---

The Three User Classes

| Class | Symbol | Who | |-------|--------|-----| | Owner | u | The user who owns the file | | Group | g | Users in the file’s group | | Others | o | Everyone else |

---

Reading Permissions

ls -l myfile.txt
-rw-r--r-- 1 alice developers 1024 Dec 30 10:00 myfile.txt

Breaking down -rw-r--r--:

 -    rw-    r--    r--
 │    └┬┘    └┬┘    └┬┘
 │     │      │      │
type  owner  group  others

- = regular file
d = directory
l = symbolic link

This means:

• Owner (alice): can read and write
• Group (developers): can only read
• Others: can only read

---

Octal Notation

Each permission class is a number from 0-7:

 r   w   x
 4 + 2 + 1 = 7 (full access)
 4 + 0 + 0 = 4 (read only)
 4 + 2 + 0 = 6 (read + write)

Common Permission Patterns

| Octal | Symbolic | Meaning | |-------|----------|---------| | 755 | rwxr-xr-x | Executable program | | 644 | rw-r—r— | Normal document | | 600 | rw------- | Private file | | 700 | rwx------ | Private executable | | 777 | rwxrwxrwx | DANGEROUS! Everyone can do anything |

---

chmod — Change Permissions

Octal Method

chmod 755 script.sh      # rwxr-xr-x
chmod 644 document.txt   # rw-r--r--
chmod 600 secret.key     # rw-------

Symbolic Method

chmod u+x script.sh      # Add execute for owner
chmod g-w file.txt       # Remove write for group
chmod o-rwx private.txt  # Remove all for others
chmod a+r public.txt     # Add read for all
chmod u=rwx,go=rx file   # Set exact permissions

Symbols:

• + add permission
• - remove permission
• = set exactly
• u owner, g group, o others, a all

---

chown — Change Ownership

Only root can change ownership:

sudo chown alice file.txt              # Change owner
sudo chown alice:developers file.txt   # Change owner and group
sudo chown :developers file.txt        # Change group only
sudo chown -R alice:alice directory/   # Recursive

---

Special Permissions

| Octal | Name | Effect | |-------|------|--------| | 4000 | SUID | Run as file owner | | 2000 | SGID | Run as file group | | 1000 | Sticky | Only owner can delete |

The /tmp directory has the sticky bit:

ls -ld /tmp
drwxrwxrwt 10 root root 4096 Dec 30 10:00 /tmp
       └── 't' means sticky bit

---

Security Best Practices

1. Never use 777 — Anyone can modify your files
2. Private keys should be 600 — SSH will refuse insecure keys
3. Scripts should be 755 — Readable but owner-modifiable
4. Home directory should be 755 or 700

---

Try It!

Use the terminal to practice permissions:

Exercises:

1. ls -l to see current permissions
2. Create a file: touch myfile.txt
3. Check its default permissions
4. Make it private: chmod 600 myfile.txt
5. Try to read /etc/shadow (you’ll get “Permission denied”)
6. Switch to root: su root and try again

Try it: change permissions

The matrix on the right shows every file’s mode, owner, and group as you run chmod and chown. Goal: chmod 755 script.sh.