Reading Permissions

Who you are

Linux was built for many people sharing one computer, so every file belongs to someone. A user can own files and directories and controls who else may use them. Users belong to groups, and an owner can give a group access. Everyone else is called others, or “the world” ¹.

id shows who you are ¹:

me@linuxbox:~$ id
uid=1000(me) gid=1000(me) groups=1000(me),4(adm),24(cdrom),27(sudo),46(plugdev)

• uid: your user ID number. The system tracks numbers; names are for people.
• gid: your primary group. Modern Linux gives each user a private group with the same name ¹.
• groups: everything you belong to. On Ubuntu, membership in sudo is what lets you run sudo ².

Where users and groups live

Like most things on Linux, accounts are defined in text files ^{1 2}:

• /etc/passwd: one line per account: name, user ID, group ID, real name, home directory, and login shell. Despite the name, no passwords.
• /etc/group: groups and their members.
• /etc/shadow: the password hashes, readable only by root.

me@linuxbox:~$ grep me /etc/passwd
me:x:1000:1000:Me,,,:/home/me:/bin/bash
me@linuxbox:~$ less /etc/shadow
/etc/shadow: Permission denied

/etc/passwd lists many accounts that aren’t people. root is always user ID 0. IDs below 1000 are system accounts that run services; people start at 1000 on Ubuntu ^{1 2}.

Owner, group, and everyone else

Back to ls -l ¹:

me@linuxbox:~$ ls -l budget.ods
-rw-r----- 1 me family 18734 Oct  5 07:40 budget.ods

After the type character come nine permission letters in three groups of three ¹:

 -   rw-     r--     ---
type owner   group   others

Each group says, in order, whether that class of people may read (r), write (w), and execute (x); a dash means no. So budget.ods can be read and changed by me, read by members of family, and not touched by anyone else.

Linux checks only one group of three: if you’re the owner, the owner bits apply; otherwise, if you’re in the file’s group, the group bits; otherwise the others bits. Root skips the checks entirely.

What r, w, and x mean

They mean slightly different things for files and directories, and the directory column is where people get surprised ¹:

Two consequences ¹:

• Deleting or renaming a file is controlled by the directory, not the file. A file you can’t write can still be deleted by someone who can write to its folder; a file you own can’t be deleted from a folder you can’t write to.
• A directory needs x to be usable at all. r without x lets you see the names but not open anything; that’s why folders are almost always given r and x together.

Some typical strings ¹:

Your turn

So

Every file has an owner, a group, and nine bits: read, write, and execute for the owner, the group, and others. On files they mean read, change, and run; on directories, list, change the contents, and enter. Deleting is controlled by the directory, and id, /etc/passwd, and /etc/group tell you who’s who.