Can you explain briefly the main concepts and command line tools used to manage file permissions?
Warning: Changing permissions of files and directories is potentially harmful and may render your system unusuable. When run recursively as root on the wrong path we may come to a point from where we will have to reinstall Ubuntu. It is therefore a good idea to not change permissions outside of HOME directories, and running the commands recursively as root should be avoided whenever possible.
Ubuntu has inherited the concept of permissions from Unix when for files or directories there are three tasks we can permit or deny:
- r (read) file/directory may be opened for read access.
- w (write) file/directory may be opened for write/edit access.
- x (execute) file may be executed as a program/directory may be traversed.
In addition we have three cases as to whom we grant a permission:
- u (user) the owner of a file is granted any of the permissions.
- g (group) group the file belongs to is granted a permission.
- o (other) all others are granted a permission.
Now to get the combination of these sorted we use a binary system where each bit defines a permission. This can be best shown in the following Table
Permission | Binary | Octal | User | Group | Other | ====================================================== r | 100 | 4 | | | | w | 010 | 2 | | | | x | 001 | 1 | | | | ======================================================= Number
Now if we want for example
a) the owner of a file (= user) has read, write, and execute permission,
b) the file's group granted read and execute permissions, and
c) all others should only have read access.
Then the resulting file permission will be:
u g o rwx r-x r--
To get this in the octal numbers, eg. for the
chmod command or when we have to understand an error message we need to fill above table as below:
Permission | Binary | Octal | User | Group | Other | ====================================================== r | 100 | 4 | 4 | 4 | 4 | w | 010 | 2 | 2 | 0 | 0 | x | 001 | 1 | 1 | 1 | 0 | ====================================================== Numbers add to 7 5 4
Each permission number needs to be added to sum up for a user (4+2+1=7), group (4+0+1=5), and other (4+0+0=4). The resulting number then is:
u g o 7 5 4
We now have two options to change the permission bits with
chmod u+rwx g+rx o+r filename
or much simpler with
chmod 751 filename
Both commands will do the same.
The default permission of a newly created file in our home will be 664 (-rw-rw-r--).
If we want files to be executable as programs we will have to change this permission.
Note that we will also have to change the permission of the directory this executable may be in. Only if both, the file's and the directory's executable bit are set we will be allowed to run this file as a program.
When copying a file to our home it will lose it's permissions which will be replaced by our own default permissions (unless we copy using advanced options e.g. an archive option).
Also note that file may inherit their permission from their mount point, resp. mount options. This is important when mounting Windows formatted drives which do not support Unix permissions.
Users and Groups
We soon realize that this was only half of the story. We also need to sort out belongings. To do this each file or folder has a defined owner, and a defined group membership.
Each time we create a file we will be the owner of a file, and the file's group will also be us. With
ls -l we can see permissions, ownership, and group as seen from the following example output:
-rw-rw-r-- 1 takkat takkat 4096 Sep 12 20:25 test
- We are only allowed to change permissions, groups or ownership of a file that is our's.
If we are not the file owner we will get a
Permission denied error. Only root can change this for all files. This is why we have to use
sudo when editing permission of files that are not ours. There are two commands to do so
chown for users and groups and
chgrp for groups only.
To change a file ownership from anybody to user
takkat and - optionally - the group
takkat we may issue this command:
sudo chown takkat[:takkat] testfile
To only change a file's group to
takkat we issue
sudo chgrp takkat testfile
Read the manpages of the commands for more details and options. There also is this nice more elaborate guide recommended for further reading:
- Ubuntu Community Help: File Permissions
Also find some related questions here:
Each file has rights for three different categories:
- the owner of the file,
- the group associated with the file, and
- everybody else.
Rights mean the right to read the file, the right to write to the file, or the right to execute the file in case of a script or program.
On the CLI, you may
- change the owner with
- change the group with
- change the rights with
chmod u+w filename.ext(Adds writing permission for the owner of the file
If you'd like to know more about each of these tools, open a terminal and type
man [tool], e.g.