File Permissions

Every file and folder has an owner, a group, and a set of permissions for three audiences: the owner, members of the group, and everyone else.

Reading permissions

ls -l /etc/shadow

-rw-r----- 1 root shadow 1234 Aug 20 10:15 /etc/shadow

The first block is the permission string. Read the first character, then three groups of three:

Part	Here	Meaning
Type	-	Regular file. d is a directory, l a symbolic link.
Owner	rw-	The owner (root) can read and write
Group	r--	Members of shadow can read
Others	---	Everyone else: nothing

r is read, w is write, x is execute (for a folder, x means you can enter it). A dash means off.

That's why cat /etc/shadow fails as a normal user and works with sudo.

Changing permissions with chmod

Two notations. Letters are easier to read; numbers are faster to type.

LettersNumbers

chmod [who][+ - =][what] file

Who	Meaning
u	user (owner)
g	group
o	others
a	all three

+ adds, - removes, = sets exactly.

chmod o-r hello2.txt      # others can no longer read
chmod u+x script.sh       # owner can execute
chmod g=r report.txt      # group gets read only, whatever it had before
chmod a-w config.txt      # nobody can write

No spaces inside o-r.

Each permission has a value: read 4, write 2, execute 1. Add them up per audience, owner first.

Digits	Owner	Group	Others
644	rw-	r--	r--
640	rw-	r--	---
600	rw-	---	---
755	rwx	r-x	r-x
700	rwx	---	---

chmod 640 secret.txt
chmod 755 script.sh

Add -R to apply to a folder and everything inside it.

Danger

chmod 777 gives every account full control. It shows up in forum answers as a "fix" for permission errors. Don't. Find out which specific permission is missing and add that one.

Changing owner and group

sudo chown alice report.txt          # change owner
sudo chgrp staff report.txt          # change group
sudo chown alice:staff report.txt    # both at once
sudo chown -R alice:alice /home/alice   # recursively

Files worth checking on an image

File	Should be
/etc/passwd	644, owner root
/etc/shadow	640 (or 600), owner root, group shadow
/etc/sudoers	440, owner root
/etc/ssh/sshd_config	600 or 644, owner root
Users' home folders	750 or 700, owned by that user

Files that everyone can write, especially ones root runs, are a classic way to escalate privilege. Find them:

sudo find / -type f -perm -o+w -not -path "/proc/*" 2>/dev/null

Try it

1. touch test.txt and check its permissions with ls -l.
2. Remove read for others using the letter form. Check again.
3. Set it to 600 using the number form. Check again.
4. Run ls -ld /home/* and note which home folders other users can read.

Next

Password and Login Policies