Understanding Linux File Permissions: A Comprehensive Guide

Linux File Permissions

The Foundation of Linux Security

In Linux, everything is considered a file—from text documents and compiled programs to hardware devices and network sockets. Because everything is a file, the system that controls who can access and modify these files forms the absolute bedrock of Linux security.

Understanding Linux file permissions (often colloquially referred to as "chmodding") is mandatory for anyone managing a server. A misconfigured permission can either break a critical application (because it cannot read its configuration file) or expose sensitive data (like a database password) to unauthorized users.

The Three Actor Categories (UGO)

Linux assigns access rights to three distinct categories of users for every file and directory:

  • User (u): The individual owner of the file. By default, the person who creates the file becomes its owner.
  • Group (g): A collection of users. If a file belongs to the 'developers' group, any user assigned to that group inherits the group's permissions.
  • Others (o): "World" permissions. This applies to absolutely everyone else on the system who is not the owner and not in the group.

The Three Permission Types (RWX)

For each of the three actors (User, Group, Others), you can assign three specific types of permissions:

  • Read (r):
    • For files: Allows viewing the contents of the file.
    • For directories: Allows listing the files within the directory (using ls).
  • Write (w):
    • For files: Allows modifying or deleting the file's contents.
    • For directories: Allows creating, deleting, or renaming files within that directory.
  • Execute (x):
    • For files: Allows running the file as a program or script.
    • For directories: Allows "entering" the directory (using cd) to access the files within it.

Reading Permissions with ls -l

When you run ls -l, the first column displays a 10-character string representing the permissions. For example: -rwxr-xr--

  • Character 1 (-): File type (- for normal file, d for directory).
  • Characters 2-4 (rwx): User (owner) permissions. (Read, Write, Execute).
  • Characters 5-7 (r-x): Group permissions. (Read, Execute, but NOT Write).
  • Characters 8-10 (r--): Others permissions. (Read only).

Modifying Permissions with chmod

The chmod (Change Mode) command alters these permissions. There are two ways to use it: Symbolic mode and Numeric (Octal) mode.

Symbolic Mode

Symbolic mode is intuitive for small changes. You specify the actor (u, g, o), an operator (+ to add, - to remove, = to set exactly), and the permission (r, w, x).

chmod u+x script.sh    # Adds execute permission for the user
chmod g-w config.yml   # Removes write permission from the group
chmod o=r public.txt   # Sets 'others' to exactly read-only

Numeric (Octal) Mode

Numeric mode is faster for setting the entire permission string at once. Each permission has a numerical value: Read = 4, Write = 2, Execute = 1. You sum these values for each actor.

  • 7 = 4+2+1 (Read, Write, Execute)
  • 6 = 4+2 (Read, Write)
  • 5 = 4+1 (Read, Execute)
  • 4 = 4 (Read only)
  • 0 = No permissions
chmod 755 server.py    # User: 7 (rwx), Group: 5 (r-x), Others: 5 (r-x)
chmod 644 index.html   # User: 6 (rw-), Group: 4 (r--), Others: 4 (r--)
chmod 600 id_rsa       # User: 6 (rw-), Group: 0 (---), Others: 0 (---) Highly Secure

Conclusion

Mastering chmod and chown (Change Owner) is non-negotiable for system administration. Always adhere to the Principle of Least Privilege: grant only the minimum permissions necessary for a file or application to function correctly. By securing your filesystem, you establish a formidable defense against both external attackers and internal mistakes.