Setting linux group permissions

How to manage Linux permissions for users, groups, and others

Photo by Min An from Pexels

Managing access to resources is a fundamental task for sysadmins. This responsibility consists of three components: identities, resources, and permissions. This article covers several user, group, and file management commands to control access to resources. The article uses a «How do I…?» format, and it assumes you have a few resources to work with. Specifically, I cover the following topics:

• Creating directories and files
• Managing ownership and associated groups
• Setting permissions with absolute and symbolic modes

Linux security

Setting up a playground

I’ve been in IT for about 25 years, and most of that time was spent as a technical trainer. That means that the things that I write are usually structured as some sort of lab or other hands-on opportunity. It’s just how I cover material. With that in mind, I’ll assume you have a couple of identities and resources to experiment with as you read the rest of the article. You can use the following commands to set up a playground. It’s best to do this on a virtual machine rather than your personal Linux box, but these tasks are relatively harmless.

Create two new users and two new groups to work with. Note that you do not need to configure passwords for the users in this exercise, as you won’t log on with those accounts.

Note: You would use the passwd user01 command to set the user’s password.

In your home directory, create a new directory named playground :

Change into the

/playground directory by using the cd command. You are ready to work with the commands and concepts below.

When you’ve completed the article and learned the techniques I’ve covered, delete the two user accounts, the groups, and the playground directory. Use rm -fR /playground , userdel user01 , and groupdel groupA to remove the resources.

How do I create directories and files?

Use the mkdir command to create directories. The touch command is one of many ways to create files.

How do I create a directory named Resources ?

How do I create a directory path (a series of directories that don’t yet exist)?

Note: The goal here is to create the 2020data directory, but the given path’s data directory does not yet exist. The -p option creates parent directories as needed to complete the path.

How do I create a file named file1 ?

How do I create several files at once?

How do I manage ownership and groups?

In the playground directory, display the current owner and group associated with the Resources directory and the files.

How do I display permission, owners, and groups?

The ls -l command displays directory contents in long format. The long format contains both permissions and ownership. You can see that the user account that created the resources also owns those resources. The group association is also that user’s primary group.

How do I change the user/owner associated with file1 ?

How do I change the group associated with file1 ?

How do I change the owner and group at the same time for file2 ?

There is a specific chgrp command, but I prefer only to memorize one command ( chown ) and apply it to both functions (user and group associations) rather than chown for the user and then have to recall chgrp for the group.

So how do I use chgrp ?

How do I change the user/group for a directory and all of its contents?

The above task provides a recursive configuration. Technically, recursive commands are repeated on each specified object. Effectively, recursive means «this and everything in it.» In the above example, you are configuring the related user/group for the Resources directory and everything in it. Without the -R option, you would only affect the Resources directory itself, but not its contents.

How do I manage permissions?

The change mode or chmod command sets permissions. The syntax is straight-forward:

Here are two examples of manipulating permissions for file2 :

But wait! Those appear to be radically different examples (they’re not, actually). What are all those letters and numbers?

We need to discuss absolute mode and symbolic mode.

How do I use absolute mode?

Absolute mode is one of two ways of specifying permissions. I’ve seen this mode referred to as octal or numeric mode, but the term I learned was absolute. That term also makes the most sense to me because it’s an absolute statement of the desired permissions. I always told my students that this seemed like the most complex of the two modes but is actually the simplest. Usually, they agreed.

Each access level (read, write, execute) has an octal value:

Access level	Octal value
Read	4
Write	2
Execute	1

Each identity (user, group, others) has a position:

Identity	Position
User	First or left-most
Group	Middle
Others	Last or right-most

More Linux resources

The absolute mode syntax states the desired permissions from left to right.

How do I grant the user (owner) read, write, and execute, the group read-only, and all others no access to file2 by using absolute mode?

The three permissions values are associated with identities:
ugo
740

• The 7 is assigned to the user and is the sum of 4+2+1 or read+write+execute (full access)
• The 4 is assigned to the group and is the sum of 4+0+0 (read-only)
• The 0 is assigned to others and is the sum of 0+0+0 (no access)

In this example, the user has rwx, the group has r only, and all others have no access to file2 .

Let’s look at one more example.

How do I grant the user (owner) read and write, the group read-only, and all others read-only to file2 ?

• The user has 6 (read and write)
• The group has 4 (read-only)
• All others have 4 (read-only)

I find this easier because there are no calculations involved. I’m not concerned with adding or subtracting specific permissions based on the current settings. Instead, I say, «set the permissions to be this,» and that’s the end result I get. It’s an absolute statement.

How do I set permissions for the Resources directory and all of its contents by using absolute mode?

How do I use symbolic mode?

Symbolic mode uses more symbols, but the symbols are simpler to understand. That’s attractive to sysadmins that are new to standard Linux permissions.

Each access level has a symbol:

Access level	Symbol
Read	r
Write	w
Execute	x

Each identity has a symbol:

Identity	Symbol
User	u
Group	g
Others	o

There are also operators to manipulate the permissions:

Task	Operator
Grant a level of access	+
Remove a level of access	—
Set a level of access	=

The general chmod command syntax is the same:

Here is an example:

How do I remove the read permissions from others for file2 by using symbolic mode?

This example removes ( — ) the read ( r ) permission from others ( o ) for file2 .

Here’s another simple example:

How do I grant the read and write permissions to the group for file2 ?

This one gives ( + ) read and write ( rw ) to the group ( g ) for file2 .

How do I set permissions for a directory and all of its contents by using symbolic mode?

Special permissions and Access Control Lists

The above discussion covers standard Linux permissions—applying rwx to the user, group, and all others. Linux has far more flexibility, however. Special permissions permit users to run applications with other credentials, control the inheritance of group associations, and keep files from being changed accidentally. Check out this great article on special permissions.

Linux also has a way of enforcing different permissions for different users and groups. Access Control Lists (ACLs) permit sysadmins to define permissions for more than just one user and one group, which adds a great deal more flexibility to standard permissions. For example, user01 can be granted rw- to file1 , while user02 can be granted r— to file1 . Here is a great article on ACLs.

Wrap up

Creating resources, managing users, and setting permissions are fundamental tasks for Linux users. My goal was to provide a quick and easy guide based on common questions or tasks that we must all accomplish regularly. If you’re new to Linux, having a solid grasp of the eight commands discussed above will make your sysadmin life much easier.

Источник

Ubuntu Documentation

Understanding and Using File Permissions

In Linux and Unix, everything is a file. Directories are files, files are files and devices are files. Devices are usually referred to as a node; however, they are still files. All of the files on a system have permissions that allow or prevent others from viewing, modifying or executing. If the file is of type Directory then it restricts different actions than files and device nodes. The super user «root» has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are referred to as bits.

To change or edit files that are owned by root, sudo must be used — please see RootSudo for details.

If the owner read & execute bit are on, then the permissions are:

There are three types of access restrictions:

Permission

Action

chmod option

There are also three types of user restrictions:

User

ls output

Note: The restriction type scope is not inheritable: the file owner will be unaffected by restrictions set for his group or everybody else.

Folder/Directory Permissions

Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes.

Permission

Action

chmod option

(view contents, i.e. ls command)

(create or remove files from dir)

(cd into directory)

read restricts or allows viewing the directories contents, i.e. ls command

write restricts or allows creating new files or deleting files in the directory. (Caution: write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!)

execute restricts or allows changing into the directory, i.e. cd command

» height=»16″ src=»/moin_static198/light/img/icon_cool.png» title=»Info » width=»16″/> Folders (directories) must have ‘execute’ permissions set (x or 1), or folders (directories) will NOT FUNCTION as folders (directories) and WILL DISAPPEAR from view in the file browser (Nautilus).

Permissions in Action

Using the example above we have the file «/etc/hosts» which is owned by the user root and belongs to the root group.

What are the permissions from the above /etc/hosts ls output?

Changing Permissions

The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access.

Источник

Linux Permissions Basics and How to Use Umask on a VPS

Published on July 10, 2013

Introduction

Linux permissions allow a file or directory owner to restrict access based on the accessor’s relationship to each file. This allows for control schemes that provide varying levels of access to different people.

The umask command is used to determine the default permissions assigned to files created by each user. It can be modified to provide strict security restrictions or relaxed permissions for file sharing scenarios, depending on the needs of the system and user.

This guide will explain the basics of Linux permissions, and will demonstrate the usefulness of configuring umask correctly. It will also briefly cover the chmod command as an associated permissions tool.

Table of Contents

Permission Categories

Linux permissions can seem obscure and difficult to understand to new users. However, once you are familiar with the way that permissions are represented, it is trivial to read and change the permissions of a file or directory with ease.

Owner Permissions

The first concept necessary to understand permissions is that Linux is fundamentally a multi-user operating system.

Each file is owned by exactly one user. Even if you are the only person using your VPS, there are still a number of different «users» created to run specific programs. You can see the different users on your system by typing:

The /etc/passwd file contains a line for every user that has been created on your operating system. The first field on each line is the name of a unique user. As you can see, many of these users are associated with services and applications.

Configuring services to operate as a distinct user allows us to control the service’s access by taking advantage of the user permissions assignment. Many programs are configured to create a username and perform all operations using that user.

Group Permissions

The second category that we can assign permissions to is the «group owner» of the file.

As with the owner category, a file can be owned by exactly one group. Each user can be a member of multiple groups and each group can contain multiple users.

To see the groups that your user currently belongs to, type:

This will show you all of the groups that your user is currently a member of. By default, you might only be a member of one or two groups, one of which might be the same as your username.

To show all of the groups currently available on your system, type:

The first field of each line is the name of a group.

Linux allows you to assign permissions based on the group owner of a file. This allows you to provide custom permissions to a group of people since only one user can own a file.

Other Permissions

The last category that you can assign permissions for is the «other» category. In this context, other is defined as any user that is not the file owner and is not a member of the group that owns the file.

This category allows you to set a base permissions level that will apply to anyone outside of the other two control groups.

Types of Permissions

Each permissions category (owner, group owner, and other) can be assigned permissions that allow or restrict their ability to read, write, or execute a file.

For a regular file, read permissions are required to read the contents of a file, write permissions are necessary to modify it, and execute permissions are needed to run the file as a script or an application.

For directories, read permissions are necessary to ls (list) the contents of a directory, write permissions are required to modify the contents of a directory, and execute permissions allow a user to cd (change directories) into the directory.

Linux represents these types of permissions using two separate symbolic notations: alphabetic and octal.

Alphabetic Notation

Alphabetic notation is easy to understand and is used by a few common programs to represent permissions.

Each permission is represented by a single letter:

• r = read permissions
• w = write permissions
• x = execute permissions

It is important to remember that alphabetic permissions are always specified in this order. If a certain privilege is granted, it is represented by the appropriate letter. If access is restricted, it is represented by a dash (-).

Permissions are given for a file’s owner first, followed by the group owner, and finally for other users. This gives us three groups of three values.

The ls command uses alphabetic notation when called with its long-format option:

The first field in the output of this command represents the permissions of the file.

Ten characters represent this data. The first character is not actually a permissions value and instead signifies the file type (- for a regular file, d for a directory, etc).

The next nine characters represent the permissions that we discussed above. Three groups representing owner, group owner, and other permissions, each with values indicating read, write, and execute permissions.

In the example above, the owner of the «acpi» directory has read, write, and execute permissions. The group owner and other users have read and execute permissions.

The «anacrontab» file allows the file owner to read and modify, but group members and other users only have permission to read.

Octal Notation

The more concise, but slightly less intuitive way of representing permissions is with octal notation.

Using this method, each permissions category (owner, group owner, and other) is represented by a number between 0 and 7.

We arrive at the appropriate number by assigning each type of permission a numerical value:

• 4 = read permissions
• 2 = write permissions
• 1 = execute permission

We add up the numbers associated with the type of permissions we would like to grant for each category. This will be a number between 0 and 7 (0 representing no permissions and 7 representing full read, write, and execute permissions) for each category.

For example, if the file owner has read and write permissions, this would be represented as a 6 in the file owner’s column. If the group owner requires only read permissions, then a 4 can be used to represent their permissions.

Similar to alphabetic notation, octal notation can include an optional leading character specifying the file type. This is followed by owner permissions, group owner permissions, and other permissions respectively.

An essential program that benefits from using octal notation is the chmod command.

Using the Chmod Command

The most popular way of changing a file’s permissions is by using octal notation with the chmod command. We will practice by creating an empty file in our home directory:

First, lets view the permissions that were given to this file upon creation:

If we interpret the permissions, we can see that the file owner and file group owner both have read and write privileges, and other users have read capabilities.

If we convert that into octal notation, the owner and group owner would have a permission value of 6 (4 for read, plus 2 for write) and the other category would have 4 (for read). The full permissions would be represented by the triplet 664.

We will pretend that this file contains a bash script that we would like to execute, as the owner. We don’t want anyone else to modify the file, including group owners, and we don’t want anyone not in the group to be able to read the file at all.

We can represent our desired permissions setting alphabetically like this: -rwxr——. We will convert that into octal notation and change the permissions with chmod:

As you can see, the permissions were assigned correctly.

If we want to change the permissions back, we can easily do that by giving chmod the following command:

Setting Default Permissions with Umask

The umask command defines the default permissions for newly created files based on the «base» permissions set defined for files and directories.

Files have a base permissions set of 666, or full read and write access for all users. Execute permissions are not assigned by default because most files are not made to be executed (assigning executable permissions also opens up some security concerns).

Directories have a base permissions set of 777, or read, write, and execute permissions for all users.

Umask operates by applying a subtractive «mask» to the base permissions shown above. We will use an example to demonstrate how this works.

If we want the owner and members of the owner group to be able to write to newly created directories, but not other users, we would want to assign the permissions to 775.

We need the three digit number that would express the difference between the base permissions and the desired permissions. That number is 002.

This resulting number is the umask value that we would like to apply. Coincidently, this is the default umask value for many systems, as we saw when we created a file with the touch command earlier. Let’s try again:

We can define a different umask using the umask command.

If we want to secure our system more, we can say that by default, we want users who are not the file owner to have no permissions at all. This can be accomplished with the 077 umask:

If we have a process that creates shared content, we may want give full permissions to every file and directory that it creates:

By default, the settings you assign to umask will only apply to the current shell session. When you log in next time, any new files and directories will be give the original settings chosen by your distribution.

If you would like to make your umask settings persist across sessions, you can define the umask settings in your .bashrc file:

Search to see if there is already a umask value set. Modify the existing value if there is one. Otherwise, add a line at the bottom of the file with your desired umask settings:

Here, we have chosen to give the owner full permissions, and take away write permissions for both the group owner and other categories. Adjust this setting to your liking to make your preferences available next time you log in.

A Word of Caution

An important point to remember when changing permissions is that certain areas of the filesystem and certain processes require specific permissions to run correctly. Inadequate permissions can lead to errors and non-functioning applications.

On the other hand, settings that are too permissive can be a security risk.

For these reasons, it is recommended that you do not adjust permissions outside of your own home directory unless you are aware of the repercussions that can arise due to improperly configured settings.

Another good rule to abide by, especially when configuring software manually, is to always assign the most restrictive permissions policy possible without affecting functionality.

This means that if only one user (such as a service) needs to access a group of files, then there is no need to allow the rest of the world to have write or even read access to the contents. This is especially true in contexts where passwords are stored in plain-text.

You can fine-tune permissions more fully by correctly utilizing group owner permissions and adding necessary users to the appropriate group. If all of the users who need access to a file are members of the group owner, then the other permission category can be locked down for more security.

Источник