[Linux] - Managing Permissions and Ownership

Topic A: Modify File and Directory Permissions

Permissions

# ls -l: a long list of files and directories in your current working directory

Permission Attributes

# - r: Read

# -w: Write

# -x: Execute

Permission Context:

# Owner (u): user

# Group (g)

# Other (o)

Permission String

Chmod Command

Modify the permissions of a file or directory. It has two forms: Chmod symbolic mode and Chmod absolute mode.

Chmod symbolic mode

# Permission contexts: u/g/o/a

# Permission operators: +/-/=

# Permission attributes: r/w/x

# chmod +x <filename>: add execution permissions on the installation file  

# chmod g+r file1: give group read permission to file

# chmod o-r: removes read for others

# chmod go+rw file1: give group and other read and write permission

# chmod go+rw file1

# ls -l

# chmod go-rwx DirA

# ls -l

# chmod go-w file1

# ls -l

Chmod absolute mode

# chmod 764 file1: user=rwx; group=rw; others=r

# chmod 700 file1: user=rwx; group =-, others =-

# chmod 640 file1: user =rw; group =r, others =-          

# 755: u=rwx, g=rx, o=rx

# 700: u=rwx, g=, o=

# 644: u=rw, g=r, o=r

# 600: u=rw, g=, o=

# mkdir permissions-demo

# cd permissions-demo

# mkdir DirA

# touch file1

# ls -l

# chmod 755 DirA

# ls -l

# chmod 660 file1

# ls -l 

# chmod 750 DirA

# ls -l

# chmod 744 file1

# ls -l

# sudo mkdir /Graphics

# sudo touch /Graphics/file1

# sudo touch /Graphics/file2

# sudo touch /Graphics/file3

# ls -l /Graphics

# sudo chmod -R 774 /Graphics

# sudo ls -l /Graphics

Default permissions:

# Files created by root user: 644

# Directories created by root user: 755

# Files created by users with limited access rights: 664

# Newly created directories: 755

Umask: alter the default permissions on newly created files and directories

# cd /home/cmason/.bashrc

# Use Page down to move the cursor to the bottom of the file

# Press i to enter insert mode

# umask 022

# Esc

# wq

# su - cmason

# umask

# touch test-file

# ls -l

TOPIC B: Modify File and Directory Ownership 

chown

To set the group association as GraphicsDept group:

# sudo chown -R :GraphicsDept /Graphics

# sudo ls -ld /Graphics

# sudo chown rstanley /Graphics/file2

# ls -l /Graphics

# chgr

TOPIC C: Configure Special Permissions and Attributes

SUID (Set User ID): is the permission that allows a user to have similar permissions as the owner of the file.  

SYNTAX

The following is the syntax for setting the SUID on a file, using symbolic and absolute mode, respectively:

# chmod u+s {file names}

# chmod 4### {file names}

SGID (Set Group ID): is the permission that allows a user to have similar permissions as the group owner of the file

# chmod g+s {directory names}

# chmod g-s {directory names}

# ls -ld /Grpahics

# sudo chmod g+s /Graphics

# ls -ld /Graphics

# su - rstanley

# cd /Graphics

# ls -l

The following is the syntax for setting the SGID on a directory, using symbolic and absolute mode, respectively:

# chmod g+s {directory names}

# chmod 2### {directory names}

Removing the SUID and SGID is as simple as using the - (minus) operator in symbolic mode, or setting the first permission bit to 0 in absolute mode.

Sticky bit

is a special permission bit that provides protection for files in a directory

SYNTAX

The syntax for setting the sticky bit is as follows, using symbolic mode and absolute mode, respectively:

# chmod +t {directory names}

# chmod 1### {directory names}

# chmod -t {directory name}

# sudo chmod +t /Graphics

# su - jrobinson

# cd /Graphics

# rm file4

Immutable flag

is an attribute of a file or directory that prevents it from being modified, even by the root user

# lsattr <file1>

# chattr +i <file1>

# chattr -i <file1>

# sudo touch /Graphics/README

# sudo ls -l /Graphics

# sudo chattr + i /Graphics/README

# sudo ls -l /Graphics

# sudo lsattr /Graphics/README

# sudo rm /Graphics/README

getfacl 

to retrieve the ACLs of files and directories

setfacl

to change the permissions associated with the ACL of a file or directory

# sudo setfacl -R -m g:MarketingDept:r /Graphics

# getfacl /Graphics

TOPIC D: TROUBLESHOOTING

Permissions Troubleshooting

First and foremost, verify the permissions of the relevant object

# ls -al

1. The owner of a text file is denied permission to view the contents of the text file => use chmod to grant read privileges to the owner context
2. A user is denied permission to remove a directory, despite having a write permission => use chmod to add execute permissions to the directory for the appropriate context
3. A user is denied permission to enter into a directory, despite having read permission => use chmod to add execute permission to the directory for the appropriate context
4. A user is denied permission to remove a file, despite having full permission on that file => use chmod to add write permission to the directory for the proper context
5. A user is denied permission to create files in a directory they have write and execute permission to => use chattr to remove the immutable flag
6. The root user is denied permission to modify a file => use chattr to remove the immutable flag
7. All users have the ability to list the contents of a directory, when only the owner, group members, and a specific service account should => The read permission is set on the directory for the others context. Add the service account to the directory's ACL using the setfacl command, granting the account read access
8. A user is denied permission to execute a script that they themselves created => use chmod to add execute permission to the script for the file owner
9. A user is denied permission to execute a script, despite having execute permission => Use chmod to add read permission to the script for the appropriate context
10. All users are able to delete a file, but they should be able to write to it => By default, the write and execute permissions on directories enable users to delete the objects therein. Add the sticky bit permission to the container directory so that only the owner or root can delete the file.

Ownership Troubleshooting

# ls -al: to verify user and group ownership of a file or directory

1. A user is unable to access a file, despite the owner context having full permissions => Use the chown command to make the user the owner of the file 
2. A user is unable to delete a file, despite the containing directory granting full permissions to the group => Use the chgrp command to make the directory's owning group the same as the user's
3. Several users are able to modify a file despite the others context only having read permission => Use chgrp to change the file's owning group to some other group
4. When a user creates files in a shared directory, the files take on the user's group ID, when they should take on the directory's group ID => Use chmod to set the SGID permission on the containing directory
5. When a user creates files in shared directory, the files take on the directory's group ID, when they should take on the user's group ID => Use chmod to remove the SGID permission on the containing directory

Group Membership Troubleshooting

# groups {user name}: to discover what group a user is a member of

# /etc/group