Typically, one of the early things a new user on a Unix-like system will encounter is the need to understand the *nix file permissions system.

this process won't start because it can't read xx file

gpg: WARNING: unsafe enclosing directory ownership on configuration file '/home/user/.gnupg/gpg.conf'

ls -ltrh

-l use a long listing format
-t sort by modification time, newest first
-r –reverse – reverse order while sorting
-h –human-readable – with -l, print sizes in human readable format (e.g., 1K, 234M, 5G)

~/files $> ls -ltrh
total 40K
-rwxr-xr-x 1 user user 38K Jan 21 23:52 filename.txt
~/files $>

In this example we see that there is a file called “filename.txt” in this directory. The first section of the entry: -rwxr-xr-x is the description of the file permissions that are active. This entry consists of ten places, or bits, which tell the system what users and the system itself can or cannot do to this file. Let’s review what each of these bits means.

Unix File System – Bit Meanings

The ten place bits in a unix file permission entry are laid out like so:

1

2-10

The entry-type bit can be:

-

b

c

d

l

p

s

w

Unix file permission entries are broken into three groups of three bits:

2-4

5-7

8-10

Permissions entries can be:

r

-

w

-

S

s

x

-

10

T

mode 1000

t

mode 1000

Further explanation of the sticky bit: The sticky bit is often used on folders to prevent the deletion of a folder or its contents by other users, even though they may need to have write permissions. Once it is set on a folder, it can then only be deleted by its owner or by root. So users would still be able to modify or work on those files, but not delete them or the parent folder. This is a useful tool to preserve your file structure on a multi-user system.

Expanding On the List Command

So, let’s look back at our example, but let’s also expand it a bit:

~/files $> ls -ltrha
total 48K
drwxr-xr-x 67 user user 4.0K Jan 21 23:51 ..
drwxrwxr-x  2 user user 4.0K Jan 21 23:51 .
-rwxr-xr-x  1 user user  38K Jan 21 23:52 filename.txt
~/files $>

You’ll see the ‘a’ switch added to the end of the command there. This tells the ‘list’ command to show even hidden entries, which in this case are the *nix “this directory” and “parent directory” dot-entries. You’ll see on

filename.txt

-rwxr-xr-x

• The first bit is a dash. This is a regular file.
• The owner permissions bits are: read, write, execute. The owner can basically do anything to this file.
• The group permissions bits are: read and execute. Members of the same group can read this file, and execute it if it’s a program. They cannot write to it, so cannot change its contents.
• The other permissions bits are: read and execute. Others (users in different groups, daemons, etc.) can read it and also execute it. They cannot write to it, so cannot change its contents. 5. Owner and group are both “user”
• The size is 38 kilobytes.

Directory Permissions

This expanded example also shows us an important feature of *nix permissions as related to directories. You see the two entries there,

.

..

d

x

For instance:

~ $> chmod 300 files/
~ $> ls files/
ls: cannot open directory files/: Permission denied
~ $>

What I did here was set the folder permissions to take away execute from all parties. Then, when the owner tried to list the contents of the directory he received a permissions error. However:

~ $> cat files/filename.txt

This command still works, since the permissions on a file within the directory are still

-rwxr-xr-x

Applying More Restrictions With chmod

Now, if we wanted to change the file permissions to be more restrictive, perhaps to disallow anyone but the owner from reading or executing the file, we would have to change those bits to different values. This is accomplished with the ‘chmod’ tool. It “changes mode” on the file, telling the system how to treat the object. To tell the system whether we want read, write, execute, or some combination of the three, we need to know how ‘chmod’ describes these modes in relation to User, Group, and Other.

There are seven chmod Mode Set characters:

1

2

3

4

5

6

7

This means that to set permissions with the chmod tool, you would do something like:

chmod 700 filename.txt

This will set owner as read+write+execute, and set group and other both as ‘none’. Then,

ls -ltrh

~/files $> chmod 700 filename.txt
~/files $> ls -ltrh
total 40K
-rwx------ 1 user user 38K Jan 21 23:52 filename.txt
~/files $>

This example shows: The first bit as a dash

-

rwx

---

---

To demonstrate how this works, try taking away the owner’s “read” permissions:

~/files $> chmod 300 filename.txt
~/files $> cat filename.txt cat: filename.txt: Permission denied
~/files $>

What we just did was give the owner write+execute-only permissions. So the owner could still modify and execute the file, but could not read it. Thus, the

cat

Final Notes on Unix File Permissions

So with this basic understanding of Unix/Linux file permissions, you’ll be able to relatively easily manage what can be done to files on your system. This can aid in protecting configuration files, preventing sensitive information from being compromised, or simply be used as a safety check to keep yourself from deleting an important item.

Just remember- make sure you actually understand the chmod you’re about to do before you hit enter, or you may end up needing some root-level rescue.

The post Unix File Permissions appeared first on Hurricane Labs.