Understanding Linux File Permissions: r w x SUID SGID

What Are Linux File Permissions?

In Linux, every file and directory is associated with an owner and a group, and permissions are assigned to control how different users can interact with those files and directories. These permissions define who can read, write, and execute a file or directory.

The permissions are typically represented in two ways:

• Symbolic notation (e.g., rwxr-xr--)
• Numeric notation (e.g., 755)

The Structure of File Permissions :

Every file or directory in Linux has three types of users who can have permissions:

1. Owner: The user who owns the file.
2. Group: A group of users that share certain permissions to the file.
3. Others: All other users who are not the owner or in the group.

For each of these users, there are three basic types of permissions:

1. Read (r): Allows a user to read the contents of the file or list the contents of a directory.
2. Write (w): Allows a user to modify or delete the file, or add/remove files from a directory.
3. Execute (x): Allows a user to execute the file (if it’s a script or program) or access a directory.

These three permission types (read, write, execute) are grouped into three sets, one for the owner, one for the group, and one for others.

Symbolic Notation

Permissions are often displayed using symbolic notation in Linux. For example:

Here’s what it means:

• The first character (-) indicates the type of file (- for regular file, d for directory, etc.).
• The next three characters (rwx) are the permissions for the owner:
  • r: Read permission for the owner
  • w: Write permission for the owner
  • x: Execute permission for the owner
• The next three characters (r-x) are the permissions for the group:
  • r: Read permission for the group
  • -: No write permission for the group
  • x: Execute permission for the group
• The final three characters (r--) are the permissions for others:
  • r: Read permission for others
  • -: No write permission for others
  • -: No execute permission for others

In this example, the owner has full permissions (read, write, and execute), the group has read and execute permissions, and others have read-only permission.

Numeric Notation (Octal)

Permissions can also be represented using numeric notation, also known as octal notation. Each type of permission (read, write, execute) is assigned a numerical value:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1

The total permission value for each user (owner, group, others) is the sum of these numbers. For example:

• rwx (read, write, and execute) = 4 + 2 + 1 = 7
• r-x (read and execute) = 4 + 1 = 5
• r-- (read-only) = 4

So, the permissions rwxr-xr-- can be represented numerically as 755.

How to Change File Permissions: chmod

To modify the permissions of a file or directory, you use the chmod (change mode) command.

Using Symbolic Mode :

With symbolic mode, you specify which permissions to change using the following syntax:

chmod [who][operator][permissions] filename

• Who:
  • u for user (owner)
  • g for group
  • o for others
  • a for all (user, group, and others)
• Operator:
  • + to add a permission
  • - to remove a permission
  • = to set the permission exactly
• Permissions:
  • r for read
  • w for write
  • x for execute

For example, to give the owner execute permission for a file:

chmod u+x filename

Remove write permission from the others:

chmod o-w filename

Using Numeric Mode (Octal)

In numeric mode, you use the octal value to directly set the permissions:

chmod 755 filename

This sets the owner’s permissions to rwx (7), the group’s to r-x (5), and others’ to r-- (5).

Special Permissions: SUID, SGID, and Sticky Bit

In addition to the standard permissions, Linux offers special permissions that enhance security:

• SUID (Set User ID): When set on an executable file, the process will run with the privileges of the file’s owner rather than the user running it.
• SGID (Set Group ID): When set on a file, the process will run with the privileges of the file’s group. When set on a directory, new files created in the directory inherit the group of the directory.
• Sticky Bit: When set on a directory, it prevents users from deleting files they don’t own within that directory, even if they have write permissions.