File Security in Linux:
Permissions
In Linux, file security is fundamentally built around a robust permission system
that governs who can read, write, or execute a file or directory. This system is
crucial for multi-user environments and system stability.
Permissions
Linux permissions determine what actions users and processes are allowed to
perform on files and directories. Every file and directory on a Linux system has a
set of permissions associated with it, which are visible when you list files using
commands like ls -l.
Permission Category
Linux categorizes permissions into three primary entities:
1. User (u): The owner of the file or directory. By default, this is the person
who created the file.
2. Group (g): A group of users. A file can belong to a single group, and all
members of that group inherit the permissions assigned to the group for
that file.
3. Others (o): Everyone else on the system who is not the owner and not a
member of the file's group.
Permission Types
For each of the three categories (User, Group, Others), there are three distinct
types of permissions:
1. Read (r):
o For files: Allows viewing the contents of the file.
o For directories: Allows listing the contents of the directory (i.e.,
seeing what files are inside).
2. Write (w):
o For files: Allows modifying or deleting the file's contents.
o For directories: Allows creating, deleting, or renaming files within
that directory. (Note: To delete a file, you need write permission on
the directory it's in, not necessarily on the file itself).
3. Execute (x):
o For files: Allows running the file as a program or script.
o For directories: Allows entering or "cd-ing" into the directory and
accessing its contents (even if you can't list them without 'r'
permission).
These permission types are often represented by letters (r, w, x) or numerically
using an octal system:
• r=4
• w=2
• x=1
• - (no permission) = 0
So, rwx would be 4+2+1=7. rw- would be 4+2+0=6. r-x would be 4+0+1=5.
When you see permissions listed, for example, as -rwxr-xr--, it breaks down like
this:
• -: Indicates it's a regular file (d for directory, l for symbolic link, etc.)
• rwx: Permissions for the User (owner) - Read, Write, Execute (4+2+1=7)
• r-x: Permissions for the Group - Read, Execute (4+0+1=5)
• r--: Permissions for Others - Read only (4+0+0=4)
This would correspond to the numeric permission 754.
Changing Permissions
Changing permissions in Linux is primarily done using the chmod command
(change mode) and chown (change owner) or chgrp (change group).
1. Changing Permissions (chmod command):
The chmod command allows you to set or modify the read, write, and execute
permissions for the user, group, and others. You can use either symbolic mode or
octal (numeric) mode.
• Symbolic Mode:
o u: user, g: group, o: others, a: all (u+g+o)
o +: add permission, -: remove permission, =: set exact permission
o Examples:
▪ chmod u+x myfile.sh: Add execute permission for the owner
to myfile.sh.
▪ chmod go-w mydocument.txt: Remove write permission for
group and others from mydocument.txt.
▪ chmod a=rwx mydirectory/: Set read, write, and execute
permissions for everyone on mydirectory.
▪ chmod u+rw,go-rw myfile.txt: Add read and write for owner,
remove read and write for group and others.
• Octal (Numeric) Mode:
o This is often preferred for setting precise permissions for all three
categories at once. You combine the numeric values (4 for read, 2
for write, 1 for execute) for each category.
o The format is chmod [user_perms][group_perms][other_perms]
filename
o Examples:
▪ chmod 755 myscript.sh: Sets owner to rwx, group to r-x,
others to r-x. This is a common permission for executable
scripts and directories.
▪ chmod 644 mydocument.txt: Sets owner to rw-, group to r--,
others to r--. Common for files that only the owner should
modify.
▪ chmod 700 private_dir/: Sets owner to rwx, group to ---,
others to ---. Ensures only the owner can access private_dir.
• Recursive Change (-R option):
o chmod -R 755 myproject_folder/: Applies the permissions
recursively to all files and subdirectories within myproject_folder/.
Use with caution!
2. Changing Ownership (chown command):
The chown command allows you to change the owner of a file or directory. This
usually requires root (administrator) privileges.
• Examples:
o sudo chown newuser file.txt: Changes the owner of file.txt to
newuser.
o sudo chown newuser:newgroup file.txt: Changes both the owner to
newuser and the group to newgroup.
o sudo chown -R newuser:newgroup /var/www/html/: Recursively
changes the owner and group of all files/directories in
/var/www/html/.
3. Changing Group (chgrp command):
The chgrp command specifically changes the group ownership of a file or
directory. You must be a member of the target group to use this, or have root
privileges.
• Examples:
o chgrp sales_team report.pdf: Changes the group of report.pdf to
sales_team.
o sudo chgrp -R www-data /var/www/html/: Recursively changes the
group of web files to www-data.
Understanding and correctly applying Linux permissions is fundamental to
system security and efficient collaboration in a multi-user environment.
Incorrect permissions can lead to security vulnerabilities (e.g., world-writable
files) or functional issues (e.g., a web server unable to read its files).
