Linux User Permissions

1. Basic Permissions

Permission Basics

Users and Groups

  • File Owner (User): The user who created the file, possessing the highest level of control.
  • Group: A set of users that share file permissions.
  • Others: Users who are neither the owner nor part of the group.

Three Basic Permissions

  • Read <span>r=4</span>: Permission to read. View file contents / list directory contents.
  • Write <span>w=2</span>: Permission to write. Modify file contents / create/delete files in a directory.
  • Execute <span>x=1</span>: Permission to execute. Run executable files / enter directories or access sub-contents.

Common File Types:

  • <span>-</span>: Regular file
  • <span>d</span>: Directory
  • <span>l</span>: Symbolic link
  • <span>c</span>: Character device, e.g., mouse, keyboard, serial port
  • <span>b</span>: Block device file, e.g., hard disk, USB drive
  • <span>s</span>: Socket file
  • <span>p</span>: Named pipe

Differences in File and Directory Permissions

Permission Type File Directory
r View contents List file names in the directory
w Modify contents Create or delete files within the directory
x Execute as a program Enter the directory or access sub-files/directories

Permission Management Commands

chmod Change File Permission Mode

chmod [options] permission_mode filename

Options:

  • <span>-R</span>: Set permissions recursively.

Permission Mode:

The format for chmod’s permission mode is <span>[ugoa][[+-=][permission]]</span>, which means <span>[user identity][[grant method][permission]]</span>.

  • User Identity
    • <span>u</span>: Represents the owner
    • <span>g</span>: Represents the group
    • <span>o</span>: Represents others
    • <span>a</span>: Represents all identities
  • Grant Method
    • <span>+</span>: Add permission
    • <span>-</span>: Remove permission
    • <span>=</span>: Set permission
  • Permission
    • <span>r</span>: Read
    • <span>w</span>: Write
    • <span>x</span>: Execute
chmod u+x file      # Owner adds execute permission
chmod g-w,o=r file  # Group removes write, others set to read-only

Using Numeric Mode

chmod 644 file      # Permissions: rw-r--r--

chown Change Owner and Group

chown [options] owner:group filename

Options:

  • <span>-R</span>: Set permissions recursively.
chown user:group file  # Change owner and group

umask Default Permissions

umask (User File Creation Mask) is used to control the default permissions for newly created files or directories.

View the system’s umask permissions

umask          # Output current value (e.g., 0022)
umask -S       # Symbolic mode display (e.g., u=rwx,g=rx,o=rx)

Temporarily set umask

umask 027      # Only effective in the current terminal session

Permanently set umask

# Modify user configuration files (e.g., ~/.bashrc, ~/.zshrc)
echo "umask 027" >> ~/.bashrc  # Effective permanently for the current user

# System-wide configuration (e.g., /etc/profile)
echo "umask 022" >> /etc/profile  # Effective for all users

umask Permission Calculation

Default Permissions:

  • Default directory permissions: 777 (binary 111 111 111, i.e., rwxrwxrwx).
  • Default file permissions: 666 (binary 110 110 110, i.e., rw-rw-rw-, default no execute permission).

Effect of umask:

  • The value of umask is a mask indicating the permission bits that need to be “masked”.
  • Actual permissions = Default permissions & (~umask) (where & is bitwise AND, ~ is bitwise NOT).

Calculation Steps (using umask=022 as an example):

  1. Convert permissions to binary
  • Default directory permissions:<span>777</span><span>111</span><span>111</span><span>111</span>
  • umask=022 → <span>000</span><span>010</span><span>010</span> (binary)
  • Calculate ~umask (bitwise NOT)
    • <span>~022</span><span>111</span><span>101</span><span>101</span> (each bit inverted: <span>000</span><span>111</span>, <span>010</span><span>101</span>, <span>010</span><span>101</span>).
  • Bitwise AND
    • Directory permissions = <span>111 111 111</span> & <span>111 101 101</span> = <span>111 101 101</span> → Decimal <span>755</span> (i.e., <span>rwxr-xr-x</span>).
    • File permissions = <span>110 110 110</span> & <span>111 101</span><span>101</span> = <span>110 100 100</span> → Decimal <span>644</span> (i.e., <span>rw-r--r--</span>).

    2. Special Permissions

    SUID (Set User ID) (s or 4000)

    When an executable file is set with SUID, any user executing that file will temporarily run with the permissions of the file owner, rather than the executor’s permissions.

    This is only meaningful for executable files and has no effect on directories or regular files.

    chmod u+s /path/to/bin   # Set SUID (symbolic)
    chmod 4755 /path/to/bin  # Numeric representation (starts with 4)
    

    The owner execute bit will display <span>s</span> (if originally had execute permission) or <span>S</span> (if no execute permission)

    root@debian:~# ls -la /usr/bin/passwd
    -rwsr-xr-x 1 root root 68248 Mar 23  2023 /usr/bin/passwd
    

    SGID (Set Group ID) (s or 2000)

    For files: When executing the file, the process’s group identity temporarily changes to that of the file’s group.

    For directories: New files or subdirectories created in that directory will inherit the directory’s group (rather than the creator’s primary group).

    chmod g+s /shared_dir    # Set SGID (symbolic)
    chmod 2770 /shared_dir   # Numeric representation (starts with 2)
    

    The group execute bit will display s (if originally had execute permission) or S (if no execute permission).

    test01@debian:~/share$ ls -l ~/
    
    drwxrwsrwx 2 share share 4096 May 13 23:05 share
    
    test01@debian:~/share$ touch bbb
    test01@debian:~/share$ ls -l
    -rw-r--r-- 1 test01 test01 0 May 13 23:05 aaa
    -rw-r--r-- 1 test01 share  0 May 13 23:07 bbb
    
    drwxr-Sr-- 2 share share 4096 May 13 23:07 share
    

    Sticky Bit (t or 1000)

    Only valid for directories. Once set, files in the directory can only be deleted or renamed by the file owner or root user, even if other users have write permissions.

    chmod +t /tmp            # Symbolic
    chmod 1777 /tmp          # Numeric (starts with 1)
    

    The other users execute bit will display t (if originally had execute permission) or T (if no execute permission).

    root@debian:~# ls -dl /tmp
    drwxrwxrwt 9 root root 4096 May 13 22:48 /tmp
    

    3. File System Attributes

    chattr is a command in Linux used to set extended attributes for files or directories, providing lower-level control at the file system level to enhance file security and behavior management. Unlike traditional rwx permissions, attributes set by chattr directly affect the file system’s metadata and take precedence, making it impossible to bypass even with root permissions (unless the attributes are removed using chattr).

    • Affects file systems (such as ext4, XFS, Btrfs, etc.), not relying on traditional permission models, requiring file system support.
    • Even with root permissions, protected files cannot be deleted or modified directly (attributes must be removed first).

    Setting File System Attributes

    chattr [+-=] [options] filename or directory name

    Options:

    • <span>i</span>: If the <span>i</span> attribute is set on a file, it cannot be deleted, renamed, or have data added or modified; if set on a directory, only the data of files within the directory can be modified, but files cannot be created or deleted.
    • <span>a</span>: If the <span>a</span> attribute is set on a file, data can only be added to the file, but not deleted or modified; if set on a directory, only new files can be created and modified, but not deleted.
    • <span>e</span>: Most files in Linux have the e attribute by default, indicating that the file is stored using the ext file system, and the <span>chattr -e</span> command cannot remove the e attribute.

    Viewing File System Attributes

    lsattr [options] filename

    Options:

    • <span>-a</span>: Display all files and directories.
    • <span>-d</span>: If the target is a directory, only list the attributes of the directory itself, not those of sub-files.
    # Example
    root@debian:~# lsattr -d /home/test01
    --------------e------- /home/test01
    root@debian:~# chattr +a /home/test01
    root@debian:~# lsattr -d /home/test01
    -----a--------e------- /home/test01
    root@debian:~# touch /home/test01/aaa
    root@debian:~# ls -l /home/test01
    total 4
    -rw-r--r-- 1 root  root     0 May 14 23:50 aaa
    drwxr-Sr-- 2 share share 4096 May 13 23:07 share
    root@debian:~# rm -rf /home/test01/aaa
    rm: cannot remove '/home/test01/aaa': Operation not permitted
    root@debian:~#
    

    4. ACL Permissions

    • ACL (Access Control List) provides more granular permission control.
    • Allows setting independent permissions for multiple users or groups, breaking the limitation of only one user/group.
    • Through default ACLs, new files/directories under a directory can automatically inherit permissions.
    • Suitable for shared environments, such as assigning different access levels to different users.

    Enabling ACL Permissions

    ext4 is enabled by default, but needs to be confirmed.

    root@debian:~# dumpe2fs -h /dev/sda1
    dumpe2fs 1.47.0 (5-Feb-2023)
    ...omitted...
    Default mount options:    user_xattr acl
    ...omitted...
    

    If not enabled, ACL permissions for the partition need to be manually enabled.

    root@debian:~# mount -o remount,acl /
    # Remount the root partition and add ACL permissions
    

    ACL permissions can also be permanently enabled by modifying the <span>/etc/fstab</span> file.

    root@debian:~# vim /etc/fstab
    UUID=845ea764-933b-49d7-862d-e153d99562e2 /               ext4    defaults,acl  1       1
    

    If prompted <span>-bash: setfacl: command not found</span>, the ACL toolkit needs to be installed.

    root@debian:~# apt update
    root@debian:~# apt install acl
    

    Basic ACL Commands

    setfacl Set ACL Permissions

    setfacl [options] [rule type]:[object]:[permission] filename/directory

    Key Parameter Descriptions

    Parameter Description Example
    <span>-m</span> Modify/Add rule <span>setfacl -m u:alice:rw file</span>
    <span>-x</span> Delete rule <span>setfacl -x u:bob file</span>
    <span>-b</span> Delete all extended ACLs <span>setfacl -b dir</span>
    <span>-d</span> Set default rule (must be used with **-m**) <span>setfacl -m d:g:team:rx dir</span>
    <span>-R</span> Recursive operation <span>setfacl -R -m g:staff:r-x /data</span>
    <span>-k</span> Delete all default rules <span>setfacl -k dir</span>

    Rule Type Prefixes

    Prefix Description Full Example
    <span>u:</span> User rule <span>u:username:rwx</span>
    <span>g:</span> Group rule <span>g:groupname:r-x</span>
    <span>d:u:</span> Default user rule <span>d:u:username:rwx</span>
    <span>d:g:</span> Default group rule <span>d:g:groupname:r--</span>
    (none) Owner/Group rule <span>u::rw, g::r-x</span>
    <span>m::</span> Mask rule <span>m::rwx</span>

    Options:

    • <span>-m</span>: Add or modify ACL permissions.
    • <span>-x</span>: Delete ACL (requires specifying user/group name, does not specify permission)
    • <span>-b</span>: Delete all ACLs
    • <span>-k</span>: Delete default ACL (only valid for directories)
    • <span>-d</span>: Set default ACL for directories (new files/directories inherit this permission)
    • <span>-R</span>: Recursive operation on directories and their subdirectories and files

    Types

    • <span>u</span>: User
    • <span>g</span>: Group
    • <span>m</span>: Mask
    • <span>o</span>: Others

    Object (omitting indicates file owner/group)

    • User: Username or UID
    • Group: Group name or GID

    Permissions

    • <span>r</span>: Read
    • <span>w</span>: Write
    • <span>x</span>: Execute
    1. Add permissions for a user
    # Add read, write, execute permissions for user bob
    setfacl -m u:bob:rwx project/
    
    # Add read permission for group contractors
    setfacl -m g:contractors:r-- project/
    
    1. Set default permissions (directory inheritance)
    # Set default ACL for the directory (newly created files automatically inherit)
    setfacl -d -m u:alice:rwx shared_dir/
    setfacl -d -m g:devteam:rwx shared_dir/
    

    When you first set a default ACL (using the d: prefix), the system automatically copies the directory’s basic permissions to the default ACL.

    # Default permissions
    ls -lad test
    drwxrwxr-x 5 root smbgroup 4096 May 31 17:33 test
    getfacl test
    # file: test
    # owner: root
    # group: smbgroup
    user::rwx
    group::rwx
    other::r-x
    
    # Set default user permissions
    setfacl -m d:u:test01:rwx test
    getfacl test
    # file: test
    # owner: root
    # group: smbgroup
    user::rwx
    group::rwx
    other::r-x
    default:user::rwx
    default:user:test01:rwx
    default:group::rwx
    default:mask::rwx
    default:other::r-x
    
    # Precisely control default permissions
    setfacl -m d:u:test01:rwx,d:g::--,d:o::--,d:u::-- test
    getfacl test
    # file: test
    # owner: root
    # group: smbgroup
    user::rwx
    group::rwx
    other::r-x
    default:user::---
    default:user:test01:rwx
    default:group::---
    default:mask::rwx
    default:other::---
    
    1. Delete ACL rules
    # Delete ACL rule for user bob
    setfacl -x u:bob project/
    
    # Delete all extended ACL rules (retain basic permissions)
    setfacl -b project/
    
    1. Recursive ACL setting
    # Recursively set permissions for the directory and all sub-contents
    setfacl -R -m g:auditors:r-x /financial_data/
    

    getfacl View ACL Permissions

    getfacl [options] filename/directory

    Options:

    • <span>-R</span>: Recursively list directory ACLs
    • <span>-c</span>: Omit comments (owner information)
    • <span>-p</span>: Display full path
    root@shared:/# getfacl test
    # file: test
    # owner: root
    # group: smbgroup
    user::rwx
    group::rwx
    other::r-x
    default:user::rwx
    default:user:test01:rwx
    default:group::rwx
    default:mask::rwx
    default:other::r-x
    

    Leave a Comment