4.11. Ownership and Permissions

4.11.1. The chmod Command

Use the chmod command to change permissions. This example shows how to change the permissions on foo.txt with the chmod command.

The original file looks like this, with its initial permissions settings:

 -rw-rw-r--    1 user user     150 Mar 19 08:08 foo.txt 

If you are the owner of the file or are logged into the root account, you can change any permissions for the owner, group, and others.

Right now, the owner and group can read and write to the file. Anyone outside of the group can only read the file (r--).

	Caution
	Remember that file permissions are a security feature. Whenever you allow anyone else to read, write to, and execute files, you are increasing the risk of files being tampered with, altered, or deleted. As a rule, you should only grant read and write permissions to those who truly need them.

In the following example, you want to allow everyone to write to the file, so they can read it, write notes in it, and save it. That means you must change the "others" section of the file permissions.

Take a look at the file first. At the shell prompt, type:

ls -l foo.txt

The previous command displays this file information:

 -rw-rw-r--    1 user user     150 Mar 19 08:08 foo.txt 

Now, type the following:

chmod o+w foo.txt

The o+w command tells the system you want to give others write permission to the file foo.txt. To check the results, list the file's details again. Now, the file looks like this:

 -rw-rw-rw-    1 user user     150 Mar 19 08:08 foo.txt 

Now, everyone can read and write to the file.

To remove read and write permissions from foo.txt use the chmod command to take away both the read and write permissions.

chmod go-rw foo.txt

By typing go-rw, you are telling the system to remove read and write permissions for the group and for others from the file foo.txt.

The result looks like this:

 -rw-------    1 user user    150 Mar 19 08:08 foo.txt 

Think of these settings as a kind of shorthand when you want to change permissions with chmod, because all you really have to do is remember a few symbols and letters with the chmod command.

Here is a list of what the shorthand represents:

Want to test your permissions skills? Remove all permissions from foo.txt — for everyone.

chmod a-rwx foo.txt

Now, see if you can read the file with the command cat foo.txt, which should return the following:

 cat: foo.txt: Permission denied

Removing all permissions, including your own, successfully locked the file. But since the file belongs to you, you can always change its permissions back with the following command:

chmod u+rw foo.txt

Use the command cat foo.txt to verify that you, the file owner, can read the file again.

Here are some common examples of settings that can be used with chmod:

• g+w — adds write access for the group

• o-rwx — removes all permissions for others

• u+x — allows the file owner to execute the file

• a+rw — allows everyone to read and write to the file

• ug+r — allows the owner and group to read the file

• g=rx — allows only the group to read and execute (not write)

By adding the -R option, you can change permissions for entire directory trees.

Because you can not really "execute" a directory as you would an application, when you add (or remove) the execute permission for a directory, you are really allowing (or denying) permission to search through that directory.

Examine the dir1/ directory you created in section FIXME by listing all of the files in your home directory.

ls -l /home/>user</

The permissions on this directory are:

drwxrwxr-x   2 mgoldin mgoldin  4096 Jan  6 15:05 dir1

If you do not allow others to have execute permission on the dir1/ directory, it does not matter who has read or write access. No one can access the directory unless they know the exact file name.

For example, type

chmod a-x dir1/

to remove everyone's execute permissions.

Here is what happens when you try to change directories using the cd dir1/ command after removing everyone's execute permissions:

 bash: dir1/: Permission denied	

Next, restore your own and your group's access:

chmod ug+x dir1/

If you check your work with ls -l, you can see that only others are denied access to the /dir1/ directory.

4.11.2. Changing Permissions With Numbers

Another way to change permissions uses numeric representations.

Go back to the original permissions for foo.txt:

 -rw-rw-r--    1 user user     150 Mar 19 08:08 foo.txt 

Each permission setting can be represented by a numerical value:

• r = 4

• w = 2

• x = 1

• - = 0

When these values are added together, the total is used to set specific permissions. For example, if you want read and write permissions, you would have a value of 6; 4 (read) + 2 (write) = 6.

For foo.txt, here are the numerical permissions settings:

 -  (rw-)   (rw-)  (r--)

The total for the user is six(4+2+0), the total for the group is six(4+2+0), and the total for others is four(4+0+0). The permissions setting is read as 664.

If you want to change foo.txt so those in your group do not have write access, but can still read the file, remove the access by subtracting two (2) from that set of numbers.

The numerical values then become six, four, and four (644).

To implement these new settings, type:

chmod 644 foo.txt

Now verify the changes by listing the file. Type:

ls -l foo.txt

The output should be:

 -rw-r--r--    1 user user     150 Mar 19 08:08 foo.txt 

Now, neither the group nor others have write permission to foo.txt. To return the group's write access for the file, add the value of w (2) to the second set of permissions.

chmod 664 foo.txt

	Warning
	Setting permissions to 666 allows everyone to read and write to a file or directory. Setting permissions to 777 allows everyone read, write, and execute permission. These permissions could allow tampering with sensitive files, so in general, it is not a good idea to use these settings.

Here is a list of some common settings, numerical values and their meanings:

Here are some common settings for directories: