Guide to Permission Management in Linux Operating System

1. Basic Concepts of Permissions

(1) Users and Groups

# View current user information
$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice),10(wheel)

# View system user file
$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
alice:x:1000:1000:Alice User:/home/alice:/bin/bash

# View user group information
$ cat /etc/group
root:x:0:wheel:x:10:alice,bob
developers:x:1001:alice,charlie

(2) Basic Structure of File Permissions

Permission bits example: -rwxr-xr--
Position description:
1st bit: File type (- regular file, d directory, l link, etc.)
2nd-4th bits: Owner permissions (u)
5th-7th bits: Group permissions (g)
8th-10th bits: Other users permissions (o)

2. Detailed Explanation of Ordinary Permissions

(1) Permission Type Description

Permission Character	Numeric Value	Effect on File	Effect on Directory
r (read)	4	Read file content	List directory contents (ls)
w (write)	2	Modify file content	Create/delete files in directory
x (execute)	1	Execute file program	Enter directory (cd)

(2) Methods to View Permissions

# Detailed view of file permissions
$ ls -l install.log
-rw-r--r--. 1 root root 2845 Jan 10 14:30 install.log

# View directory permissions
$ ls -ld /home/alice
drwx------. 15 alice alice 4096 Jan 10 14:35 /home/alice

# View permissions of multiple files
$ ls -la /etc/host*
-rw-r--r--. 1 root root 158 Jun 7 2023 /etc/host.conf
-rw-r--r--. 1 root root 27 Jan 10 10:15 /etc/hosts

(3) Permission Setting Commands

chmod — Modify Permissions

# Set permissions using numeric method
$ chmod 755 script.sh        # rwxr-xr-x
$ chmod 644 config.txt       # rw-r--r--
$ chmod 750 backup/          # rwxr-x---

# Set permissions using symbolic method
$ chmod u+x install.sh       # Add execute permission for owner
$ chmod g-w secret.txt       # Remove write permission for group
$ chmod o=r readme.txt       # Set read-only for other users
$ chmod a+x common_script.sh # Add execute permission for all users
$ chmod go-w sensitive.conf  # Remove write permission for group and others

# Recursively set directory permissions
$ chmod -R 755 /var/www/html/

chown — Change Owner and Group

# Change file owner
$ chown alice report.txt

# Change file group
$ chown :developers project/

# Change both owner and group
$ chown alice:developers app.py

# Recursively change directory ownership
$ chown -R alice:developers /opt/myapp/

# Change only group
$ chgrp developers shared_file.txt

(4) Common Permission Combinations

# Standard permissions for files and directories
755 # rwxr-xr-x   Executable files, scripts, directories
644 # rw-r--r--   Configuration files, documents
600 # rw-------   Private files, key files
700 # rwx------   Private directories, user home directories
750 # rwxr-x---   Protected scripts/directories
777 # rwxrwxrwx   Fully open (use with caution!)

3. Detailed Explanation of Special Permissions

(1) SUID (Set User ID)Concept Description

• Set onexecutable files

• Runs withfile owner’s permissions

• Display position: Owner’s execute bit shows as <span>s</span> or <span>S</span>

Setting and Viewing

# Set SUID permission
$ chmod 4755 /usr/bin/special_cmd    # Numeric method
$ chmod u+s /usr/bin/special_cmd     # Symbolic method

# View SUID files
$ ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 27856 Aug 1 2023 /usr/bin/passwd

# Find SUID files in the system
$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/pkexec

Practical Application Case

# Create a backup script that requires privileges
$ cat > /usr/local/bin/backup_system.sh << 'EOF'
#!/bin/bash
# This script requires root permissions to backup system files
tar -czf /backup/system_$(date +%Y%m%d).tar.gz /etc /var/www 2>/dev/null
echo "Backup completed: /backup/system_$(date +%Y%m%d).tar.gz"
EOF

# Set SUID permission
$ chown root:root /usr/local/bin/backup_system.sh
$ chmod 4750 /usr/local/bin/backup_system.sh

# Now ordinary users can execute the backup, but it runs with root permissions
$ ls -l /usr/local/bin/backup_system.sh
-rwsr-x---. 1 root root 245 Jan 10 15:00 /usr/local/bin/backup_system.sh

(2) SGID (Set Group ID)Concept Description

• Set onexecutable files: Executes with the file’sgroup permissions

• Set ondirectories: New files created in the directory inherit the directory’s group

• Display position: Group’s execute bit shows as <span>s</span> or <span>S</span>

Setting and Viewing

# Set SGID on a file
$ chmod 2755 /usr/local/bin/team_tool
$ chmod g+s /usr/local/bin/team_tool

# Set SGID on a directory
$ chmod 2775 /opt/shared_projects
$ chmod g+s /opt/shared_projects

# View SGID permissions
$ ls -ld /opt/shared_projects
drwxrwsr-x. 2 root developers 4096 Jan 10 15:10 /opt/shared_projects

Practical Application Case

# Create a team collaboration directory
$ mkdir /opt/team_workspace
$ chown root:developers /opt/team_workspace
$ chmod 2775 /opt/team_workspace

# Verify settings
$ ls -ld /opt/team_workspace
drwxrwsr-x. 2 root developers 4096 Jan 10 15:15 /opt/team_workspace

# Team members create file test
$ su - alice
$ touch /opt/team_workspace/alice_file.txt
$ ls -l /opt/team_workspace/alice_file.txt
-rw-r--r--. 1 alice developers 0 Jan 10 15:16 alice_file.txt
# Note: File group automatically inherits as developers

(3) Sticky BitConcept Description

• Set ondirectories

• Only file owner, directory owner, or root can delete/rename files

• Display position: Other users’ execute bit shows as <span>t</span> or <span>T</span>

Setting and Viewing

# Set sticky bit
$ chmod 1777 /tmp                    # Numeric method
$ chmod o+t /var/tmp                 # Symbolic method

# View sticky bit
$ ls -ld /tmp /var/tmp
drwxrwxrwt. 15 root root 4096 Jan 10 15:20 /tmp
drwxrwxrwt. 2 root root 4096 Jan 10 15:20 /var/tmp

# Remove sticky bit
$ chmod o-t /some/directory

Practical Application Case

# Create a public file upload directory
$ mkdir /var/www/uploads
$ chown www-data:www-data /var/www/uploads
$ chmod 1777 /var/www/uploads

# Test sticky bit functionality
$ su - user1
$ touch /var/www/uploads/user1_file.txt
$ su - user2  # user2 can view and modify the file but cannot delete user1's file
$ rm /var/www/uploads/user1_file.txt
rm: cannot remove '/var/www/uploads/user1_file.txt': Operation not permitted

4. Complete Reference for Numeric Representation of Permissions(1) Complete Numeric Structure of Permissions

Special Permissions | Owner Permissions | Group Permissions | Other User Permissions  4 bits   |   3 bits   |   3 bits    |    3 bits

(2) Special Permission Numeric Values

• SUID: 4

• SGID: 2

• Sticky Bit: 1

(3) Common Permission Combination Examples

# Ordinary file permissions
644 # rw-r--r--   Configuration files, documents
755 # rwxr-xr-x   Executable scripts
600 # rw-------   Private files

# Directory permissions
755 # rwxr-xr-x   Ordinary directory
700 # rwx------   Private directory
777 # rwxrwxrwx   Fully open directory

# Including special permissions
4755 # rwsr-xr-x  Executable file with SUID
2755 # rwxr-sr-x  Executable file with SGID
1777 # rwxrwxrwt  Public directory with sticky bit
2770 # rwxrws---  Team collaboration directory
3755 # rwsr-sr-x  Set both SUID and SGID

5. Practical Cases of Permission Management(1) Project Development Environment Setup

# Create development project directory structure
$ mkdir -p /opt/devproject/{src,bin,doc,test}
$ chown -R root:developers /opt/devproject
$ chmod -R 2775 /opt/devproject

# Set different permissions for subdirectories
$ chmod 755 /opt/devproject/bin    # Executable files directory
$ chmod 2770 /opt/devproject/src   # Source code collaboration directory
$ chmod 1777 /opt/devproject/test  # Test file sharing directory

# Verify permission structure
$ ls -la /opt/devproject
drwxrwsr-x. 5 root developers 4096 Jan 10 16:00 .
drwxr-xr-x. 3 root root       4096 Jan 10 16:00 ..
drwxr-xr-x. 2 root developers 4096 Jan 10 16:00 bin
drwxrws---. 2 root developers 4096 Jan 10 16:00 src
drwxrwxrwt. 2 root developers 4096 Jan 10 16:00 test
drwxr-sr-x. 2 root developers 4096 Jan 10 16:00 doc

(2) Web Server Permission Configuration

# Set website directory permissions
$ chown -R www-data:www-data /var/www/html
$ find /var/www/html -type f -exec chmod 644 {} \;
$ find /var/www/html -type d -exec chmod 755 {} \;

# Special directory settings
$ chmod 775 /var/www/html/upload    # Upload directory writable
$ chmod 755 /var/www/html/cgi-bin   # CGI script directory

# Set log directory
$ chown -R www-data:adm /var/log/apache2
$ chmod 2750 /var/log/apache2

(3) System Security Permission Check

#!/bin/bash
# Permission security check script
echo "=== System Permission Security Check ==="
echo
echo "1. Check SUID files:"
find / -perm /4000 -type f 2>/dev/null | while read file; do    echo "  $file"done
echo
echo "2. Check SGID files:"
find / -perm /2000 -type f 2>/dev/null | head -10
echo
echo "3. Check world-writable files:"
find / -perm -0002 -type f ! -path "/proc/*" ! -path "/sys/*" 2>/dev/null | head -10
echo
echo "4. Check files without owners:"
find / -nouser -o -nogroup 2>/dev/null | head -10
echo
echo "5. Check sensitive file permissions:"
for file in /etc/passwd /etc/shadow /etc/sudoers; do    if [ -f "$file" ]; then        perms=$(ls -l "$file" | awk '{print $1}')        echo "  $file: $perms"    fi
done

6. Troubleshooting and Fixing Permission Issues(1) Common Permission Issue Diagnosis

# Check file permission issues
$ ls -l problem_file.txt
$ stat problem_file.txt

# Check user and group information
$ id username
$ groups username

# Check directory permission path
$ namei -l /path/to/some/file

# Test permissions
$ sudo -u username ls /path/to/directory

(2) Permission Fixing Operations

# Fix dangerous permissions
$ find /home -type f -perm 777 -exec chmod 755 {} \;
$ find /home -type d -perm 777 -exec chmod 755 {} \;

# Remove unnecessary special permissions
$ find /home -perm /4000 -exec chmod u-s {} \;   # Remove SUID
$ find /home -perm /2000 -exec chmod g-s {} \;   # Remove SGID

# Fix file ownership
$ chown -R correct_user:correct_group /path/to/directory

# Reset standard permissions
$ find /var/www -type f -exec chmod 644 {} \;
$ find /var/www -type d -exec chmod 755 {} \;

(3) Permission Backup and Recovery

# Backup directory permissions
$ getfacl -R /important/directory > permissions_backup.acl

# Restore permissions
$ setfacl --restore=permissions_backup.acl

# Use stat to backup permission information
$ find /path -printf "%m %u %g %p\n" > permissions_list.txt

7. Permission Management and Best Practices(1) Principles of Permission Management

• Principle of Least Privilege: Grant only the minimum permissions necessary to complete the work

• Separation of Duties: Different users are responsible for different tasks, and permissions are allocated accordingly

• Regular Audits: Regularly check system permission settings

• Documentation: Document the reasons and duration for special permission settings

(2) Security Recommendations

# Dangerous operations to avoid
chmod 777 /any/path                    # Do not set 777 permissions
chown -R nobody:nogroup /system/path   # Do not change system file ownership arbitrarily
find / -perm -4000 -exec chmod u-s {} \; # Do not blindly remove all SUID

# Recommended security practices
umask 022                              # Set secure default umask
sudo visudo                            # Use sudo instead of SUID
Regularly audit /etc/passwd and /etc/group    # Monitor user and group changes