5. Permission Management

5.1 Understanding the Permission Model

Linux's permission model is the foundation of system security. Every file/directory has three sets of permissions, each corresponding to three types of users:

ls -l /etc/shadow

-rw-r----- 1 root shadow 1234 Jun 20 10:00 /etc/shadow

Breaking down -rw-r-----:

• Position 1 -: file type (regular file)
• Positions 2-4 rw-: owner permissions (read + write)
• Positions 5-7 r--: group permissions (read only)
• Positions 8-10 ---: others permissions (none)

Permission	Meaning for Files	Meaning for Directories	Numeric Value
r (read)	Read file contents	List directory contents	4
w (write)	Modify file contents	Create/delete files in directory	2
x (execute)	Execute file (if it's a program)	Enter directory	1
-	No permission	No permission	0

💡 Tip: 💡 Numeric calculation: Add up the numeric values for each group. For example, rwxr-xr-- = (4+2+1)(4+0+1)(4+0+0) = 754

5.2 chmod — Modify Permissions

# Numeric mode (recommended)
chmod 755 script.sh     # rwxr-xr-x
chmod 644 config.txt    # rw-r--r--
chmod 600 id_rsa        # rw-------
chmod 700 ~/.ssh        # rwx------

# Symbolic mode
chmod u+x script.sh     # Add execute permission for the owner
chmod g-w file.txt      # Remove write permission for the group
chmod o=r file.txt      # Set others to read-only
chmod a+r file.txt      # Add read permission for everyone

# Recursively modify directory permissions
chmod -R 755 /var/www/html/

Symbol meanings: u=owner, g=group, o=others, a=all.

Operators: +=add, -=remove, ==set to.

5.3 chown / chgrp — Modify Owner and Group

# Change owner
sudo chown user1 file.txt

# Change owner and group
sudo chown user1:group1 file.txt

# Change group only
sudo chgrp developers project/

# Recursive change
sudo chown -R www-data:www-data /var/www/html/

$ ls -l /var/www/html/
total 12
-rw-r--r-- 1 www-data www-data  405 Jun 20 10:00 index.html
-rw-r--r-- 1 www-data www-data 6.1K Jun 20 10:00 style.css
drwxr-xr-x 2 www-data www-data 4096 Jun 20 10:00 images

5.4 Special Permission Bits

SUID (Set User ID): When executing a file, temporarily gain the permissions of the file's owner.

# SUID example: passwd command needs to read/write /etc/shadow
ls -l /usr/bin/passwd

-rwsr-xr-x 1 root root 68208 Mar 23  2023 /usr/bin/passwd

Note the s in rws — that's the SUID flag.

# Set SUID
chmod u+s program
chmod 4755 program       # 4xxx = SUID

# SGID (Set Group ID)
chmod g+s directory      # New files in directory inherit the group
chmod 2755 directory     # 2xxx = SGID

# Sticky Bit
chmod +t /tmp            # Only the file owner can delete their own files
chmod 1777 /tmp          # 1xxx = Sticky Bit

📝 Note: 📝 Classic example: The /tmp directory has permissions drwxrwxrwt — the t at the end is the Sticky Bit. All users can write files in /tmp, but can only delete their own files.

umask — Default Permission Mask

# View current umask
umask

# Set umask (022 means new files get 644, new directories get 755)
umask 022

# Set a stricter umask
umask 077   # New files get 600, new directories get 700

$ umask
0022
$ touch test.txt && ls -l test.txt
-rw-r--r-- 1 user user 0 Jun 20 10:00 test.txt
# File default permission = 0666 - 0022 = 0644 (rw-r--r--)