In this TechTip, the mysteries of working with and understanding Linux filesystem permissions on the command line will be explained and simplified.

When I started with Linux over five years ago, I came from the Windows way of working with files, directories, and users. Most commonly in Windows, you access file and directory permissions by choosing properties, and then you visually change settings. With the Linux desktop environment advancing, you can now easily access permissions similarly, using Linux file browsers. However, if you're going to administer Linux servers, often there is no GUI installed, so you'll need to learn Linux permissions and commands.

Linux Access Permissions

The Linux filesystem can be an intriguing mystery, and working with permissions when beginning can be very confusing. All files and directories have three access permission types. In short, this means what you can and cannot do with files. The three access levels are read access, write access, and execute access.

These access levels are then assigned with three types of users on the system: owners, groups, and other users. The combination of access levels and user types allows for nine bits of instructions. For files and directories, read and write access are either allowed or denied, and for programs and scripts, they are either allowed or denied execution attributes.

When you look at the permissions of a file, you'll notice there are three flags for every file. The permissions flags are indicated in the following list.

•        Read: r

•        Write: w

•        Executable: x

•        Denied: - (minus symbol)

Understanding Permission Bits

Create a sample text file in your user's home directory and call it testing.txt.

# touch testing.txt

Now, list the file's information using the ll command.

# ll testing.txt

-rw-rw-r-- 1 max max testing.txt

You'll notice there are 10 bits of information describing the file. The list displays who owns the file, followed by the group owner. In this case, max is the user, and max is the group. The following table numbers the bits of information.

Each numbered position represents the attribute of the level of access and describes what is allowed between the executable status of the file, and the users and groups.

•        Gray Bit 0: Type of file; d is a directory, l is a link, and minus (-) is a regular file.

•        Blue Bit 1, 2, 3: Permissions for the owner of the file

•        Red Bit 4, 5, 6: Permissions for the group of the file

•        Black Bit 7, 8, 9: Permissions for other users of the file

Bits 1, 4, and 7 indicate whether read access is set on the file. Bits 2, 5, and 8 indicate whether write access is set on the file. And bits 3, 6, and 9 indicate whether execution is permitted on the file.

To explain what "-rw-rw-r--" means for the sample text file you created, the file is a regular file, where max can both read and write the file. The group max can both read and write the file, and other users have read-only access. Since bit 3, 6, and 9 aren't set to an x status, no one--not the max user, the max group, or other users--can execute the file.

Changing File Access Permissions

The Linux command you'll use to change file access levels is chmod. To bring up the chmod manual at the command line, type man chmod. Before you start changing permissions, though, remember that only the owner of the file can change his own permissions, unless you're using the root account on the system.

You can use the chmod command to change permissions in two ways: You can use it either with the user and groups switches or with an octal set of numbers that sets the bits on files using numbers. When you first start, you'll probably find it easier to use it with the user and group switches, but I'll explain the code numbers also. Let's start with a list of user and group mode switches for chmod.

•        u = The owner user

•        g = The group user

•        o = Other users

•        a = All users

•        - (minus symbol) = Remove attribute

•        + (plus symbol) = Add attribute

•        r = Read

•        w = Write

•        x = Executable

Let's go back to the text file you created earlier and start changing some permissions. First, if you only want to remove write access for a user and group, specify it at the command line.

# chmod ug-w testing.txt

# ll testing.txt

-r--r--r-- 1 max max testing.txt

Now, the user max and group max can only read the file. Let's take it one step further and remove all other user read access.

# chmod o-r testing.txt

# ll testing.txt

-r--r----- 1 max max testing.txt

By doing that, only user and group max have read-only access to the file. All other users cannot read or write the file, and no one has executive rights.

To make a file executable, simply use the x switch to turn the executable attribute on for user, group, others, or all.

# chmod ug+x testing.txt

# ll testing.txt

-r-xr-x--- 1 max max testing.txt

Now, both user and group max can read and execute the file.

Using Numbered chmod

The other way of using chmod is with a set of numbers to set attributes. Using a set of three numbers, you can achieve the exact same results as with using the user switches. Each attribute for read, write, and execute has a number code assigned to it, which you then add up. The highest value for user, group, and others can be 7. This number means the user, group, or other users have read, write, and execute ability. The calculation is done based on read having a code of 4, write having a code of 2, and execute having a code of 1. Add them up, and you'll see the result below.

•        u: rwx = 4 + 2 + 1 = 7

•        g: rwx = 4 + 2 + 1 = 7

•        o: rwx = 4 + 2 + 1 = 7

With this example, if you want to set read, write, and execute attributes on the file for the user, group, and others, enter the value of 777 at the command line.

# chmod 777 testing.txt

# ll testing.txt

-rwxrwxrwx 1 max max testing.txt

Use the list above to take away or add attributes to users and groups. A common Linux permission for a file is the 644 code. This allows the owner of the file to have read and write permissions, but the group and others to have only read permission.

•        u: rwx = 4 + 2 + 0 = 6

•        g: rwx = 4 + 0 + 0 = 4

•        o: rwx = 4 + 0 + 0 = 4

# chmod 644 testing.txt

# ll testing.txt

-rw-r--r-- 1 max max testing.txt

For awhile, you might have to refer to the chart to figure out how to add up the values, but after some use, you'll quickly pick up the octal meanings.

Linux Permissions Are Quickly Learned

When you start out with an unfamiliar concept, it's frustrating and cumbersome to work with, and Linux permissions are no different. However, take some time to play with permissions, and you should find that they're not such a mystery after all, and they are in fact learned rather quickly. Linux permissions are also a necessity if you're going to be administering non-GUI Linux servers.