The Linux Permissions Journey: Understanding and Mastering File Access Control

Introduction

Linux, as a multi-user operating system, is built on Unix principles, emphasizing file ownership and permissions to ensure file system security. A solid grasp of these concepts is crucial for effectively managing a cloud server. While navigating file ownership and permissions can be complex, this tutorial aims to offer a comprehensive introduction. It will delve into the fundamentals of viewing and comprehending Linux ownership and permissions.

This tutorial will cover how to view and understand Linux ownership and permissions. If you are looking for a tutorial on how to modify permissions.

About Users

As highlighted earlier, Linux operates as a multi-user system, making it crucial to grasp the basics of Linux users and groups before diving into ownership and permissions, as these entities are the foundation of ownership and permission settings.

In the Linux ecosystem, users fall into two main categories: system users and regular users. System users are typically assigned to run background or non-interactive processes, whereas regular users are meant for interactive login and process execution. When you initially set up and log into a Linux system, you'll notice the presence of numerous system users already in place to manage the services essential for the operating system's functionality. This setup is standard practice and ensures the smooth operation of the OS.

You can view all of the users on a system by looking at the contents of the /etc/passwd file. Each line in this file contains information about a single user, starting with its username (the name before the first :). You can print the contents of the passwd file with cat:

$ cat /etc/passwd

Superuser

In addition to the two user types, there is the superuser, or root user, that can override any file ownership and permission restrictions. In practice, this means that the superuser has the right to access anything on its server. This user is used to make system-wide changes.

It is also possible to configure other user accounts with the ability to assume “superuser rights”. This is often referred to as having sudo, because users who have permission to temporarily gain superuser rights do so by preceding admin-level commands with sudo. Creating a normal user that has sudo privileges for system administration tasks is considered to be best practice. This way, you can be more conservative in your use of the root user account.

About Groups

Groups are essentially clusters of zero or more users. Each user is associated with a default group and can additionally belong to any number of other groups within a server.

You can view all the groups on the system and their members by looking in the /etc/group file, as you would with /etc/passwd for users. This article does not cover group management.

Now that you know what users and groups are, let’s talk about file ownership and permissions!

Viewing Ownership and Permissions

In Linux, every file is owned by a single user and a single group, and has its own access permissions. Let’s look at how to view the ownership and permissions of a file.

The most common way to view the permissions of a file is to use ls with the long listing option -l, e.g. ls -l myfile. If you want to view the permissions of all of the files in your current directory, run the command without the myfile argument, like this:

ls -l

Note: If you are in an empty home directory, and you haven’t created any files to view yet, you can follow along by listing the contents of the /etc directory by running this command: ls -l /etc .

Here is an example screenshot of ls -l output, with labels for each column of output:

Each file lists its mode (which contains permissions), owner, group, and name are listed. To help explain what all of those letters and hyphens mean, let’s break down the mode column into its components.

Understanding the modes

To help explain what all the groupings and letters mean, here is a breakdown of the mode metadata of the first file in the above example:

File Type

In Linux, there are two types of files: normal and special. The file type is indicated by the first character of the mode of a file — in this guide, this will be referred to as the “file type field”.

Normal files can be identified by a hyphen (-) in their file type fields. Normal files can contain data or anything else. They are called normal, or regular, files to distinguish them from special files.

Special files can be identified by a non-hyphen character, such as a letter, in their file type fields, and are handled by the OS differently than normal files. The character that appears in the file type field indicates the kind of special file a particular file is. For example, a directory, which is the most common kind of special file, is identified by the d character that appears in its file type field (like in the previous screenshot). There are several other kinds of special files.

Permission Classes

From the diagram, you can see that the mode column indicates the file type, followed by three triads, or classes, of permissions: user (owner), group, and others. The order of the classes is consistent across all Linux systems.

The three permissions classes work as follows:

• User: The owner of a file belongs to this class.

• Group: The members of the file’s group belong to this class. Group permissions are a useful way of assigning permissions on a given file to multiple users.

• Other: Any users that are not part of the user or group classes for this file belong to this class.

Reading Symbolic Permissions

The next thing to pay attention to are those sets of three characters. They denote the permissions, in symbolic form, that each class has for a given file.

In each triad, read, write, and execute permissions are represented in the following way:

• Read: Indicated by an r in the first position

• Write: Indicated by a w in the second position

• Execute: Indicated by an x in the third position. In some special cases, there may be a different character here

A hyphen (-) in the place of one of these characters indicates that the respective permission is not available for the respective class. For example, if the group (second) triad for a file is r--, the file is “read-only” to the group that is associated with the file.

Understanding Read, Write & Execute

Now that you know how to read the permissions of a file, you should know what each of the permissions actually allow users to do. This tutorial will cover each permission individually, but keep in mind that they are often used in combination with each other to allow for useful access to files and directories.

Here is a breakdown of the access that the three permission types grant to user:

• Read:- For a normal file, read permission allows a user to view the contents of the file. For a directory, read permission allows a user to view the names of the files in the directory.

• Write:- For a normal file, write permission allows a user to modify and delete the file. For a directory, write permission allows a user to delete the directory, modify its contents (create, delete, and rename files in it), and modify the contents of files that the user has write permission to.

• Execute:- For a normal file, execute permission allows a user to execute (run) a file — the user must also have read permission. Execute permissions must be set for executable programs and shell scripts before a user can run them.

For a directory, execute permission allows a user to access, or traverse into (i.e. cd) and access metadata about files in the directory (the information that is listed in an ls -l).

Examples Of Modes & Permissions

Now that you know how to read the mode of a file, and understand the meaning of each permission, you will see a few examples of common modes, with brief explanations, to bring the concepts together.

• -rw-------: A file that is only accessible by its owner

• -rwxr-xr-x: A file that is executable by every user on the system. A “world-executable” file

• -rw-rw-rw-: A file that is open to modification by every user on the system. A “world-writable” file

• drwxr-xr-x: A directory that every user on the system can read and access

• drwxrwx---: A directory that is modifiable (including its contents) by its owner and group

• drwxr-x---: A directory that is accessible by its group

The owner of a file usually enjoys the most permissions, when compared to the other two classes. Typically, you will see that the group and other classes only have a subset of the owner’s permissions (equivalent or less). This makes sense because files should only be accessible to users who need them for a particular reason.

Another thing to note is that even though many permission combinations are possible, only certain ones make sense in most situations. For example, write or execute access is almost always accompanied by read access, since it’s hard to modify, and impossible to execute, something you can’t read.

Conclusion

Understanding Linux permissions is fundamental for effectively managing and securing your system. By grasping the concepts of ownership, users, groups, and permissions, you gain the ability to control access to files and directories, ensuring the integrity and security of your system. While the complexities of Linux permissions may seem daunting at first, with practice and further exploration, you'll find yourself confidently navigating and managing permissions to suit your system's needs.