> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/files-and-directory-permission-management.md). # Files and Directory Permission Management Linux permissions are represented by **ten-character strings** that define **access levels** for files and directories. **Example:** ```bash ls -l ``` **Output:** ```plaintext -rw-rw-r-- # Files drwxr-xr-x # Directory/Folder ``` A set 10 Character Permission Filed. `- --- --- ---` #### **Positions and Their Meaning** | Position | Character | Meaning | | -------- | --------- | ---------------- | | 1 | `-` | Normal file | | | `d` | Directory | | | `l` | Symbolic link | | | `p` | Process file | | | `b` | Block device | | | `c` | Character device | **Owner (Positions 2-4)** | Position | Character | Meaning | | -------- | --------- | ------------------------------- | | 2 | `-` | No read permission for owner | | | `r` | Read permission for owner | | 3 | `-` | No write permission for owner | | | `w` | Write permission for owner | | 4 | `-` | No execute permission for owner | | | `x` | Execute permission for owner | **Group (Positions 5-7)** | Position | Character | Meaning | | -------- | --------- | ------------------------------- | | 5 | `-` | No read permission for group | | | `r` | Read permission for group | | 6 | `-` | No write permission for group | | | `w` | Write permission for group | | 7 | `-` | No execute permission for group | | | `x` | Execute permission for group | **Others (Positions 8-10)** | Position | Character | Meaning | | -------- | --------- | -------------------------------- | | 8 | `-` | No read permission for others | | | `r` | Read permission for others | | 9 | `-` | No write permission for others | | | `w` | Write permission for others | | 10 | `-` | No execute permission for others | | | `x` | Execute permission for others | ### **Permission Methods in Linux** In Linux, file and directory permissions are managed using two methods: 1. **Symbolic Method** 2. **Numeric Method (umask Value)** *** ### **1. Symbolic Method** The symbolic method uses letters to represent permissions: * `r` → Read * `w` → Write * `x` → Execute #### **Syntax** ```bash chmod [who][operator][permission] filename ``` * `[who]`: Specifies the user category * `u` → User (Owner) * `g` → Group * `o` → Others * `a` → All (User, Group, Others) * `[operator]`: Specifies the operation * `+` → Add permission * `-` → Remove permission * `=` → Set exact permissions #### **Examples** **Grant Execute Permission to Owner** ```bash chmod u+x file.txt ``` Before: ``` -rw-r--r-- 1 user user 1234 Feb 16 12:00 file.txt ``` After: ``` -rwxr--r-- 1 user user 1234 Feb 16 12:00 file.txt ``` **Remove Write Permission from Group** ```bash chmod g-w file.txt ``` Before: ``` -rwxrw-r-- 1 user user 1234 Feb 16 12:00 file.txt ``` After: ``` -rwxr--r-- 1 user user 1234 Feb 16 12:00 file.txt ``` **Set Read and Execute for All Users** ```bash chmod a=rx file.txt ``` Before: ``` -rw-r--r-- 1 user user 1234 Feb 16 12:00 file.txt ``` After: ``` -r-xr-xr-x 1 user user 1234 Feb 16 12:00 file.txt ``` *** ### **2. Numeric Method** The numeric method assigns a three-digit to represent file permissions. #### **Octal Values** | Permission | Symbol | Numeric Value | | ----------------------------- | ------ | ------------- | | No Permission | `---` | 0 | | Execute (`x`) | `--x` | 1 | | Write (`w`) | `-w-` | 2 | | Write & Execute (`wx`) | `-wx` | 3 | | Read (`r`) | `r--` | 4 | | Read & Execute (`rx`) | `r-x` | 5 | | Read & Write (`rw`) | `rw-` | 6 | | Read, Write & Execute (`rwx`) | `rwx` | 7 | Each permission digit represents: * **First digit** → Owner's permissions * **Second digit** → Group's permissions * **Third digit** → Others' permissions #### **Example Calculation** For `chmod 754 file.txt`: * `7` (Owner) → `rwx` → Read, Write, Execute * `5` (Group) → `r-x` → Read, Execute * `4` (Others) → `r--` → Read #### **Examples** * **Give Full Permission to Owner, Read & Execute to Group, and Read to Others** ```bash chmod 754 file.txt ``` Permissions: ``` -rwxr-xr-- 1 user user 1234 Feb 16 12:00 file.txt ``` * **Make a File Read-Only for Everyone** ```bash chmod 444 file.txt ``` Permissions: ``` -r--r--r-- 1 user user 1234 Feb 16 12:00 file.txt ``` * **Give Read, Write, Execute to Everyone** ```bash chmod 777 file.txt ``` Permissions: ``` -rwxrwxrwx 1 user user 1234 Feb 16 12:00 file.txt ``` *** ### **Combining Symbolic and Numeric Methods** * **Set Read & Execute for Group, Write for Owner Using Both Methods** ```bash chmod g+rx,u+w file.txt chmod 750 file.txt ``` Both commands will result in: ``` -rwxr-x--- 1 user user 1234 Feb 16 12:00 file.txt ``` *** ### **Summary Table** | Command | Description | | --------------------- | ---------------------------------- | | `chmod u+x file.txt` | Add execute permission to owner | | `chmod g-w file.txt` | Remove write permission from group | | `chmod o=r file.txt` | Set read-only for others | | `chmod a=rx file.txt` | Set read & execute for all users | | `chmod 754 file.txt` | Set `rwxr-xr--` permissions | | `chmod 777 file.txt` | Set full permissions (`rwxrwxrwx`) | *** ## **Special Permissions in Linux** Special permissions in Linux are additional permission bits that extend standard file permissions. These permissions modify how users and groups interact with files and directories. There are three types of special permissions: 1. **Set User ID (SUID)** 2. **Set Group ID (SGID)** 3. **Sticky Bit** ### **1. Set User ID (SUID)** * Applied to executable files. * When a file with SUID is executed, it runs with the **owner’s** permissions instead of the user who executed it. * It is commonly used for system binaries that require elevated privileges, such as `passwd` (to change user passwords). **Example: Applying SUID** ```bash chmod u+s filename ``` ``` chmod 4755 filename ``` **Example: Removing SUID** ```bash chmod u-s filename ``` ``` chmod 0755 filename ``` **Verifying SUID** ```bash ls -l filename ``` * If SUID is set, the execute bit (`x`) for the owner (`rws`) will appear as **`s`** instead of `x`: ``` -rwsr-xr-x 1 root root 12345 Feb 16 10:00 myscript ``` ### **2. Set Group ID (SGID)** * Applied to **files**: When executed, it runs with the **group's** permissions instead of the user's. * Applied to **directories**: Files created inside inherit the **group** of the directory instead of the user's primary group. * Useful for shared project directories. **Example: Applying SGID** ```bash chmod g+s filename # For files ``` ``` chmod g+s directory # For directories ``` ``` chmod 2755 filename ``` ``` chmod 2775 directory ``` **Example: Removing SGID** ```bash chmod g-s filename ``` ``` chmod 0755 filename ``` **Verifying SGID** ```bash ls -l ``` * If SGID is set on a file, the group execute bit (`x`) appears as **`s`**: ``` -rwxr-sr-x 1 root users 12345 Feb 16 10:00 myscript ``` * If SGID is set on a directory: ``` drwxr-sr-x 2 root users 4096 Feb 16 10:00 shared-folder ``` *** ### **3. Sticky Bit** * Applied only to **directories**. * Prevents users from deleting files inside a directory **unless they are the owner**. * Commonly used on `/tmp` to allow file creation but restrict deletion. **Example: Applying Sticky Bit** ```bash chmod o+t directory ``` ``` chmod 1777 directory ``` **Example: Removing Sticky Bit** ```bash chmod o-t directory chmod 0777 directory ``` **Verifying Sticky Bit** ```bash ls -ld directory ``` * If the sticky bit is set, the last execute bit (`x`) for "others" (`rwx`) appears as **`t`**: ``` drwxrwxrwt 2 root users 4096 Feb 16 10:00 /tmp ``` #### **Summary Table** | Special Permission | Symbol | Numeric Code | Applied To | Effect | | ----------------------- | ----------------------------- | ------------------ | ------------------ | -------------------------------------------------------- | | **SUID** (Set User ID) | `s` in owner execute (`rws`) | `4` (e.g., `4755`) | Files | Runs with file owner's permissions | | **SGID** (Set Group ID) | `s` in group execute (`rws`) | `2` (e.g., `2755`) | Files, Directories | Files inherit group, directories enforce group ownership | | **Sticky Bit** | `t` in others execute (`rwt`) | `1` (e.g., `1777`) | Directories | Prevents users from deleting others' files | *** ## **Access Control Lists (ACL)** #### **Install ACL** ```bash yum install acl ``` #### **ACL Commands** | Command | Description | | --------------------------- | --------------------------------- | | `getfacl file` | Show ACL permissions | | `setfacl -m u:user:rw file` | Grant read/write access to a user | | `setfacl -x u:user file` | Remove ACL entry | **Example:** ```bash setfacl -m u:johndoe:rw file.txt getfacl file.txt ``` *** ## Switching Users and Groups **Commands:** * Switch to another user ``` su - username ``` ``` sg groupname ```