Linux Permissions

Think of Linux permissions like a security system for your files and folders. Just like how you might have different keys for different rooms in your house, Linux uses permissions to control who can access and modify your files. Understanding permissions helps you keep your work safe and share it with others when needed.

Quick Reference

When to Use Permissions

• When you need to protect your files from others
• When you want to share files with specific people
• When you need to run scripts or programs
• When you want to control who can modify your work
• When you need to organize group projects

Understanding Permission Types

Think of permissions like different levels of access to a room:

User Categories

Think of user categories like different groups of people who might need access to your files:

Assigning a Document or Folder to a Group

In the basic permission system, every file and folder has one owner and one group. The group is the set of users who get the "group" permissions (the middle set of rwx in ls -l). You don't assign a file to "multiple groups" in the traditional sense—you choose which single group owns it, then set what that group can do.

How to assign a file or folder to a group:

1. Change the group owner with chgrp (change group, shown later in this chapter). Only the file owner or an administrator can do this.

# Assign report.pdf to the group "biology101"
chgrp biology101 report.pdf

# Assign a whole folder (and optionally its contents) to a group
chgrp biology101 project_folder/

# To change the group of the folder and everything inside it, use -R (recursive)
chgrp -R biology101 project_folder/

After you run chgrp, the file or folder is "owned" by that group. Everyone in biology101 then gets whatever permissions you set for the group (e.g. with chmod g+rw project_folder). If you need a different group to have access later, run chgrp again with the new group name—the file can only have one group at a time in this basic model.

What if more than one group needs access?

Sometimes you want several groups to use the same file or folder (for example, both "biology101" and "tas" for a shared handout). In the basic permission system you can only set one group per file. What you can do is create a shared group that contains everyone who should have access (e.g. "course_staff"), assign the file to that group with chgrp, and give that group the right permissions. Everyone in the group gets the same access.

In short: use chgrp to assign a document or folder to a single group; set the group’s permissions with chmod; and if more than one group needs access, use one shared group.

Viewing Permissions

You can see permissions using the ls -l command. Let's break down what you see:

$ ls -l
-rwxr-xr-- 1 user group  4096 Jul 10 14:55 file.txt

Understanding Permission Strings

Let's decode the permission string -rwxr-xr--:

Numeric Permissions

Numeric permissions in Linux use a three-digit number system (like 755 or 644) to represent file permissions. Each digit represents a different user category (owner, group, others) and is calculated by adding up the values of individual permissions:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1

To understand how this works, let's break it down:

1. First Digit (Owner): Controls what the file owner can do
2. Second Digit (Group): Controls what group members can do
3. Third Digit (Others): Controls what everyone else can do

For example, the number 7 (4+2+1) means full permissions (read, write, execute). Here's how to calculate common permission numbers:

When you see a three-digit number like 755, it means:

• First digit (7): Owner has full access (4+2+1 = read, write, execute)
• Second digit (5): Group can read and execute (4+1)
• Third digit (5): Others can read and execute (4+1)

This system makes it easy to set permissions with a single command. For example, chmod 755 file.txt sets the permissions to rwxr-xr-x in one step.

# 755: Owner has full access, others can read and execute
# rwxr-xr-x
chmod 755 script.sh

# 644: Owner can read and write, others can only read
# rw-r--r--
chmod 644 document.txt

# 750: Owner has full access, group can read and execute, others have no access
# rwxr-x---
chmod 750 private/

# 600: Only owner can read and write
# rw-------
chmod 600 secret.txt

Symbolic Mode

Think of symbolic mode like using simple words to set permissions. You can use letters to specify who gets what permissions:

You can use these operators to change permissions:

# Add execute permission for owner
chmod u+x script.sh

# Remove write permission from group
chmod g-w document.txt

# Set read and write for others
chmod o=rw shared.txt

# Add execute for all users
chmod a+x program

# Set read and execute for group and others
chmod go=rx file.txt

Tips for Success

• Always check permissions before trying to access files
• Use ls -l to see current permissions
• Remember that directories need execute permission to be entered
• Start with restrictive permissions and add more as needed
• Use groups to manage permissions for multiple users

Common Mistakes to Avoid

• Giving too many permissions (especially execute)
• Forgetting to set directory permissions
• Not checking group membership
• Using 777 permissions (too open)
• Not understanding the difference between file and directory permissions

Best Practices

• Use the principle of least privilege (give only needed permissions)
• Regularly review and update permissions
• Use groups for collaborative projects
• Document permission changes
• Test permissions after changing them

Practical Examples

# Check current permissions
ls -l

# See permissions for a specific file
ls -l file.txt

# See permissions for a directory
ls -ld directory/

# Check your own permissions
ls -l ~/myfile.txt

# Check group permissions
ls -l /group/project/