Permissions and Ownership

ls -l shows a file's permissions as ten characters at the start of each line:

$ ls -l
-rw-r--r-- 1 erin erin      32 Sep 30 09:14 report.txt
drwx------ 2 erin erin    4096 Sep 30 09:14 private

The first character is the type: - for a file, d for a directory. The other nine are three groups of three:

 -   rw-   r--   r--
type owner group others

Each group says whether that set of people may read, write and execute (run) it. A dash means "no". The two names after the link count are the owner (erin) and the group (erin).

So -rw-r--r-- means: the owner may read and write, and everyone else may only read.

On a directory the letters mean slightly different things: r lets you list what's inside, w lets you create and delete files in it, and x lets you go into it (and reach the files inside).

Each rwx group can also be written as a single digit by adding up its parts:

So rw- is 4+2 = 6, r-x is 4+1 = 5, r-- is 4 and --- is 0. Three digits (owner, group, others) describe the whole thing:

You'll see octal everywhere, because it's quicker to type. And you'll sometimes see 777 (everyone may do everything). On a real system that's almost always a mistake, because it lets any user change or replace the file.

chmod changes permissions. Either give the octal number:

$ chmod 600 budget.csv

or change just one part with a letter (u owner, g group, o others, a all), + or -, and the permissions:

$ chmod u+x run.sh        # let the owner run it
$ chmod go-r notes.txt    # take read away from the group and others

You can change the permissions of your own files, even ones you can't currently read. Only root can change the permissions of other people's files.

chown changes the owner (and, with owner:group, the group). Giving files away is a root job, so you'll usually see it as sudo chown ada:ada file.

Groups let several users share access. id (or groups) shows which groups you're in:

$ id
uid=1004(erin) gid=1004(erin) groups=1004(erin),1010(auditors)

A file whose group is auditors, with group read permission, can be read by every member of auditors, and by nobody else except its owner.

Erin works on the audit team. Her home folder holds a few shared files, and she has locked herself out of her own vault.

1. Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as erin.
2. Look at the permissions: ls -l ~/shared, ls -ld ~/vault, ls -l ~/vault.
3. Check which groups Erin is in with id, then look at /srv/audit and read the findings.
4. Try cat ~/vault/flag.txt. It fails. Look at its permissions and fix them.