Control who can read, change and run files

$ls -l /etc/passwd /etc/shadow
-rw-r--r--. 1 root root 2401 Oct 25 09:10 /etc/passwd
----------. 1 root root 1290 Oct 25 09:10 /etc/shadow
$ls -ld /tmp
drwxrwxrwt. 18 root root 4096 Oct 25 10:00 /tmp

Linux checks in this order and stops at the first match: owner? → group member? → others.

#chown lisa report.txt
#chown lisa:sales report.txt
#chown :sales report.txt
#chgrp sales report.txt
#chown -R apache:apache /var/www/html/app

• -R changes a whole directory tree.
• A normal user can change the group of an own file, but only to a group he is a member of.

$ls -l report.txt
-rw-r--r--. 1 lisa sales 0 Oct 25 10:20 report.txt

$chmod u+x backup.sh
$chmod g+w,o-rwx shared.txt
$chmod a+r info.txt
$chmod o= secret.txt
$chmod -R g+rwX /srv/sales

• + adds, - removes, = sets exactly.
• Capital X adds x only to directories (and files that are already executable). Good with -R.

$umask
0022
$umask 027
$touch a; mkdir b; ls -ld a b
-rw-r-----. 1 student student 0 Oct 25 10:30 a
drwxr-x---. 2 student student 6 Oct 25 10:30 b

1. A umask command in the shell is valid only for that shell.
2. For one user, put it in ~/.bashrc.

   $echo "umask 027" >> ~/.bashrc

3. For all users, put it in a file in /etc/profile.d/.

   #echo "umask 027" > /etc/profile.d/umask.sh

$ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 32656 Oct 21 12:00 /usr/bin/passwd
#chmod g+s /srv/sales
#chmod o+t /srv/sales
#chmod 3770 /srv/sales

In ls -l you see s or t instead of x. A capital S or T means the bit is set but x is not there (often a mistake).

1. Create the group and add the members.

   #groupadd sales
   #usermod -aG sales anna; usermod -aG sales bob

2. Create the directory and give it to the group.

   #mkdir -p /srv/sales
   #chown root:sales /srv/sales

3. Give the group full rights, others nothing, plus SGID and sticky.

   #chmod 3770 /srv/sales

$ls -ld /srv/sales
drwxrws--T. 2 root sales 6 Oct 25 10:40 /srv/sales
#su - anna -c 'touch /srv/sales/plan.txt; ls -l /srv/sales'
#su - bob -c 'rm -f /srv/sales/plan.txt'
rm: cannot remove '/srv/sales/plan.txt': Operation not permitted

#setfacl -m u:carol:rx /srv/sales
#setfacl -m g:account:rwx /srv/sales
#getfacl /srv/sales
#setfacl -d -m g:account:rwX /srv/sales
#setfacl -x u:carol /srv/sales
#setfacl -b /srv/sales

• -m adds or changes an entry, -x removes one, -b removes all.
• -d sets a default ACL: new files in the directory get it.
• ls -l shows a + after the permissions when a file has an ACL.

1. Check every directory in the path (x needed on each).

   $namei -l /srv/sales/plan.txt

2. Check owner, group, mode and your groups.

   $ls -l /srv/sales/plan.txt; id

3. Check ACLs and attributes.

   $getfacl /srv/sales/plan.txt; lsattr /srv/sales/plan.txt

4. If everything looks right, check SELinux (see the SELinux chapter).

   #ausearch -m avc -ts recent

• Every file has an owner, a group and permissions for user, group and others (ugo).
• r read, w write, x execute. On a folder: r = list names, w = create and delete files, x = enter the folder.
• Numbers: r = 4, w = 2, x = 1, so 750 = rwx r-x ---. Letters: chmod g+w,o-rwx file.
• chown user:group file changes owner and group; chgrp group file changes only the group.
• umask removes permissions from new files: umask 022 gives files 644 and folders 755.
• Special permissions: SUID (4, run as the owner), SGID (2, on a folder new files get the folder's group), sticky bit (1, only the owner can delete own files).
• ACLs give extra users or groups access: setfacl -m u:lisa:rx file, read them with getfacl; default ACLs (-d) apply to new files.
• Attributes like immutable (chattr +i) protect files even from root.