File permissions, ownership and disk quotas

Who may do what to a file: reading an ls -l line, the two ways to express a mode, umask, and the three special bits that change what execution and directory membership mean.

Lesson 4 of 6 in objective 104. Devices, Linux filesystems, filesystem hierarchy standard, part of LPIC-1 Exam 101-500.

A mode line, read in threes. This one is 644. -rw-r--r-- — part 1, -: type: - file, d directory, l symbolic link; part 2, rw-: owner: read 4 + write 2 = 6. SUID shows as s in this block's x place; part 3, r--: group: read 4. An s in place of x here is SGID; part 4, r--: other: read 4. A t in place of x here is the sticky bit. 1 - 2 rw- 3 r-- 4 r-- 1 type: - file, d directory, l symbolic link 2 owner: read 4 + write 2 = 6. SUID shows as s in this block's x place 3 group: read 4. An s in place of x here is SGID 4 other: read 4. A t in place of x here is the sticky bit
A mode line, read in threes. This one is 644.

Reading and writing a mode

Permissions come in three sets — owner, group, other — each with read, write and execute. In octal, read is 4, write 2 and execute 1, so 640 is rw- r-- ---, and 755 is rwx r-x r-x. In symbolic form you name who and what: chmod u+x adds execute for the owner, chmod go-w removes write from group and other, chmod a=r sets everyone to read-only. Both spellings appear in questions and both must be readable on sight.

On a DIRECTORY the bits mean something different, and this is where marks are lost. Read lets you list the names in it. Write lets you create and delete entries — which means write permission on a directory lets you delete a file you cannot write to. Execute (often called the search bit) lets you traverse it and access things inside by name; a directory with r but not x gives you the names and nothing else.

chown changes the owner and chgrp the group; chown user:group does both at once. Only root may give a file away to another user.

Removing a file is settled by the directory it sits in, not by the file. From What actually grants the delete to No say in the delete at all: Write on the directory (creating and removing entries happens here), then Execute on the directory (without it you cannot reach the file by name), then The file's own mode (even a file you cannot write to is removed). What actually grants the delete Write on the directory creating and removing entries happens here Execute on the directory without it you cannot reach the file by name The file's own mode even a file you cannot write to is removed No say in the delete at all
Removing a file is settled by the directory it sits in, not by the file.

umask, and the special bits

New files are not created with the mode you might expect. The umask REMOVES bits from the maximum, which is 666 for files and 777 for directories, because nothing gets the execute bit merely by being created. With the common umask of 022, a new file is 644 and a new directory 755. A umask of 077 gives 600 and 700 — private by default.

The word usually used for this is "subtracted", and it is worth being careful with, because it only tells the truth when every digit of the umask fits inside the digit above it. The umask clears bits: a mask digit of 2 takes away write if write was there, and takes away nothing if it was not. Where subtraction and bit-clearing disagree, bit-clearing is what happens. Under umask 027 a new file is 640, not the 639 the arithmetic suggests — and 639 is not even a permission, since 9 is not an octal digit. Read each digit as "which of read, write and execute to withhold" and the awkward masks come out right.

Three special bits sit above the usual nine. SUID (4000) on an executable makes it run as its owner rather than as the user who launched it, which is how passwd can write to /etc/shadow. SGID (2000) does the same for the group on an executable, and on a DIRECTORY it means new files inherit the directory's group — the standard trick for a shared project folder. The sticky bit (1000) on a directory means only a file's owner may delete it, which is why /tmp is world-writable without being a free-for-all. In ls -l they appear in place of the x: s for SUID or SGID, t for sticky, and an uppercase S or T when the underlying execute bit is not set.

What the SGID bit means depends on where it is set. One test, and exactly one way out of it. The test is: Where does the SGID bit sit? (the same 2000 either way; only what it is set on differs). On an executable leads to It runs as the file's group (SUID, 4000, does exactly this for the owner instead); On a directory leads to New files there take the directory's group (the standard trick for a shared project folder). Where does the SGID bit sit? the same 2000 either way; only what it is set on differs On an executable On a directory It runs as the file's group SUID, 4000, does exactly this for the owner instead New files there take the directory's group the standard trick for a shared project folder
What the SGID bit means depends on where it is set.

Worth carrying in

chmod 640 file
Octal: read 4, write 2, execute 1, per owner/group/other.
chmod u+x,go-w
Symbolic: who (ugoa), operation (+-=), what (rwx).
chown user:group
Change owner and group together. Giving a file away needs root.
umask 022
Withholds bits from 666 for files and 777 for directories. 022 gives 644 and 755.
SUID 4000
Executable runs as its owner. Shows as s in the owner block.
SGID 2000
On an executable, runs as its group; on a directory, new files inherit the group.
sticky 1000
On a directory, only the owner of a file may remove it. /tmp is 1777.
ls -l
Type, then three permission triplets, links, owner, group, size, time, name.

What the exam does with this

Objective
104. Devices, Linux filesystems, filesystem hierarchy standard
Share of the exam
25% (the whole objective)
Questions in this lesson
15
Signed for by a person
0

Partly checked. None of the 15 questions here has been read against the cited source by a person. 15 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.

Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

Drill this lesson

A lesson is one sitting: the trainer draws a short run from these questions alone and spaces the ones you get wrong.

Practise File permissions, ownership and disk quotas

Questions in this lesson

Practise File permissions, ownership and disk quotas

The rest of objective 104