A quick run-through/reference.
Each file or directory in Linux have permissions like below (ls -la lists these).
-rwxrwxrwx (files) drwxrwxrwx (directories, specified by the prefix d)
Each pair of rwx specifies read, write and execute permission for (in order) the user (owner of the file/directory), the group and all others. Execute permission on a directory means permission to list the files and directories inside the directory. Some examples:
-rwx------ (the owner of the file can read, write and execute the file) -rw-r-x--- (the owner of the file can read and write, the group can read and execute) drwxr-x--- (the owner of the directory can read, write and list subitems in the directory, the group can read and list subitems)
The permission pair rwx can also be expressed as a single number.
- the read permission is represented by 4
- the write permission is represented by 2
- the execute permission is represented by 1
The numbers are then added to get the final permission. For example, rwx is set by 4+2+1 = 7. 4+2 = 6 means rw-. 4+1 means r-x. This makes it possible to represent the three permission pairs (user, group and others) using three numbers, such as 777 for -rwxrwxrwx or 775 for -rwxrwxr-x.
Permissions on a Linux-based system is commonly altered using three commands.
chmod
Alters the permissions of a file or directory. Some examples:
chmod u+rwx file to add the rwx-permission to the user. chmod g-w,o+x file to remove the w-permission from the group and add execute permission to others. chmod -R 777 dir to recursively change the permissions on dir (all three permission pairs) to rwxrwxrwx.
chgrp
Changes the group of a file/directory. For example, chgrp guest file sets the group to be affected by the group permissions to be guest. The -R option can be used here as well.
chown
Changes the owner AND group of a file/directory. Works as chgrp, but instead of a single group name argument, chown is used as chown root:guest file. And the -R option can be used here as well. I kid you not.
Now to the interesting parts! What determines what permissions the files and folders we create get by default? The answer is: the default permissions together with something called an umask. The default permissions are
- 777 (
drwxrwxrwx) for directories, and - 666 (
-rw-rw-rw-) for files.
But how come the files and directories you create won't have these permissions? Here is where the umask comes into play. The umask is set to 002 by default on any modern Linux system (probably on not-so-modern Linux systems as well...). This value is subtracted (digit per digit, minimum 0) from the default permissions for any new file or directory you create. So if you create a file, the default permission is 666 - 002 = 664. This means newly created files should get the permissions -rw-rw-r--. Go try. For directories, this will instead be 777 - 002 = 775, which corresponds to drwxrwxr-x. The execute permission is added by default to directories so all users are allowed to list contents in directories (as opposed to files, which all users certainly should not be allowed to execute).
The umask can be set by running the command - you guessed it - umask. For example, umask 022 sets the umask to be 022 for the current session. If you want it "forever", put it in ~/.bashrc or similar.
Another nice-to-know feature is the s option to the group permission pair. Usually, created files and directories are given the current user and the current user's primary group as user and group. This might not be what you want, for example if you have a team file share which all members of the team should be able to access, but you don't want to change all users' primary groups. This can be solved by setting the s-bit on the group permission pair, chmod g+s teamdir. Any files or directories created inside the teamdir directory will then get the group of the parent directory (recursively). This will however not affect directories already inside teamdir, so a command like find team -type d -exec chmod g+s {} \; might be useful here to set the s-bit on any existing directories.
The above is often mistakenly referred to as the "sticky bit". That is however not what setting the sticky bit means. The sticky bit can be set on directories, and, when set, only the file's owner, the directory's owner or a superuser can rename or delete created subfiles and subdirectories. The sticky bit is set using chmod +t dir and can be seen running ls -la as drwxr-xr-t (the t, or T if x is not set for permission pair o).
