Andrew Hudson - Fedora™ Unleashed, 2008 edition

Directories are also files under Linux. For example, again use the ls command to show permissions like this:

$ mkdir foo

$ ls -ld foo

drwxrwxr-x 2 andrew andrew 4096 2007-10-23 19:06 foo

In this example, the mkdir command is used to create a directory. The lscommand and its -ld option is used to show the permissions and other information about the directory (not its contents). Here you can see that the directory has permission values of 775(read+write+execute or 4+2+1, read+write+execute or 4+2+1, and read+execute or 4+1).

This shows that the owner and group members can read and write to the directory and, because of execute permission, also list the directory's contents. All other users can only list the directory contents. Note that directories require execute permission for anyone to be able to view their contents.

You should also notice that the ls command's output shows a leading d in the permissions field. This letter specifies that this file is a directory; normal files have a blank field in its place. Other files, such as those specifying a block or character device, have a different letter.

For example, if you examine the device file for a Linux serial port, you will see the following:

$ ls -l /dev/ttyS0

crw-rw---- 1 root uucp 4, 64 2007-10-23 18:11 /dev/ttyS0

Here, /dev/ttyS0is a character device (such as a serial communications port and designated by a c) owned by root and available to anyone in the uucpgroup. The device has permissions of 660(read + write, read + write, no permission).

On the other hand, if you examine the device file for a hard drive, you see the following:

$ ls -l /dev/sda

brw-r----- 1 root disk 8, 0 2007-10-23 18:11 /dev/sda

In this example, bdesignates a block device (a device that transfers and caches data in blocks) with similar permissions. Other device entries you will run across on your Linux system include symbolic links, designated by s.

You can use the chmodcommand to alter a file's permissions. This command uses various forms of command syntax, including octal or a mnemonic form (such as u, g, o, or aand rwx, and so on) to specify a desired change. The chmod command can be used to add, remove, or modify file or directory permissions to protect, hide, or open up access to a file by other users (except for root, which can access any file or directory on a Linux system).

The mnemonic forms of chmod's options (when used with a plus character, +, to add, or a minus sign, -, to take away) designate the following:

► u — Adds or removes user (owner) read, write, or execute permission

► g — Adds or removes group read, write, or execute permission

► o — Adds or removes read, write, or execute permission for others not in a file's group

► a —Adds or removes read, write, or execute permission for all users

► r — Adds or removes read permission

► w — Adds or removes write permission

► x — Adds or removes execution permission

For example, if you create a file, such as a readme.txt, the file will have default permissions (set by the umasksetting in /etc/bashrc) of the following:

-rw-rw-r-- 1 andrew andrew 0 2007-10-23 19:08 readme.txt

As you can see, you and members of your group can read and write the file. Anyone else can only read the file (and only if it is outside of your home directory, which will have read, write, and execute permission set only for you, the owner). You can remove all write permission for anyone by using chmod, the minus sign, and aw, as follows:

$ chmod a-w readme.txt

$ ls -l readme.txt

-r--r--r-- 1 andrew andrew 12 Jan 2 16:48 readme.txt

Now, no one can write to the file (except you, if the file is in your home or /tmpdirectory because of directory permissions). To restore read and write permission for only you as the owner, use the plus sign and the uand rwoptions, like this:

$ chmod u+rw readme.txt

$ ls -l readme.txt

-rw------- 1 andrew andrew 0 2007-10-23 19:08 readme.txt

You can also use the octal form of the chmodcommand (for example, to modify a file's permissions so that only you, the owner, can read and write a file). Use the chmodcommand and a file permission of 600, like this:

$ chmod 600 readme.txt

If you take away execution permission for a directory, files might be hidden inside and may not be listed or accessed by anyone else (except the root operator, of course, who has access to any file on your system). By using various combinations of permission settings, you can quickly and easily set up a more secure environment, even as a normal user in your home directory.

Other useful commands for assigning and managing permissions include the following:

► chgrp — Changes the group ownership of a file or directory

► chown — Changes the owner of a file or directory

These commands, which modify file ownerships and permissions, can be used to model organizational structures and permissions in the real world onto your Fedora system. For example, a human resources department can share health-benefit memos to all company employees by making the files readable (but not writable) by anyone in an accessible directory. On the other hand, programmers in the company's research and development section, although able to access each other's source code files, would not have read or write access to HR payscale or personnel files (and certainly would not want HR or Marketing poking around R&D).

These commands help you easily manage group and file ownerships and permissions from the command line. It is essential that you know these commands because some times you might have only a command-line interface to work with; perhaps some idiot system administrator set incorrect permissions on X11, rendering the system incapable of working with a graphical interface.

Another type of permission is "set user ID" ( suid ) and "set group ID" ( sgid ) permissions. These settings, when used in a program, enable any user running that program to have program owner or group owner permissions for that program. These settings enable the program to be run effectively by anyone, without requiring that each user's permissions be altered to include specific permissions for that program.

One commonly used program with suid permissions is the passwdcommand:

$ ls -l /usr/bin/passwd

-rwsr-xr-x 1 root root 25604 2007-04-05 09:54 /usr/bin/passwd

This setting allows normal users to execute the command (as root) to make changes to a root-only accessible file, /etc/passwd.

You also can assign similar permission using the chfncommand. This command allows users to update or change fingerinformation in /etc/passwd. You accomplish this permission modification by using a leading 4(or the mnemonic s) in front of the three octal values.