Users and permissions
Linux knows every user and group by a number. Every file records one owner, one group and nine permission bits: read, write and execute for the owner, the group and everyone else. Follow the kernel as it checks a request: it picks exactly one of the three sets, then says yes or Permission denied. Then change the rules with chmod, read the same bits as the number 640, and see why root skips the check.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01ls -l shows -rw-r----- for a file. What is its mode as a number?
Add r = 4, w = 2, x = 1 in each set: owner rw- = 6, group r-- = 4, others --- = 0. So the mode is 640.
02notes.txt is owned by alice, group team, mode 640. bob is in team. Can bob write to it?
The kernel uses exactly one set. bob is not the owner, but he is in the file's group, so the group bits count: r-- allows reading only.
03A file you own has mode 040 (owner ---, group r--) and you are in its group. Can you read it?
The kernel checks owner first. Once a set matches, the others are not looked at, so the owner is held to the owner bits even when the group bits would allow more. (As the owner you may still chmod it back.)
04What does chmod g+w notes.txt do to a file with mode 640?
g = the group, + = add, w = write. rw- r-- --- becomes rw- rw- ---, which is 660. chmod changes the bits; chown would change the owner.
05Why can root read a file with mode 600 that belongs to alice?
root (UID 0) is not held to the mode bits for reading and writing. That power is why sudo asks for your password and why commands run as root deserve extra care.
Glossary
- UID
- User ID: the number Linux uses for a user. root is 0; regular users start at 1000 on Debian, Ubuntu and Fedora.
- GID
- Group ID: the number of a group. A process carries its user's groups, and a file records one group.
- /etc/passwd
- The file that lists users, one per line: name, password placeholder, UID, GID, comment, home folder, shell.
- /etc/group
- The file that lists groups, one per line: name, password placeholder, GID, and the members.
- Mode
- A file's type and its nine permission bits, shown by ls -l as ten characters such as -rw-r-----.
- Permission bits
- r (read), w (write) and x (execute), once for the owner, once for the group and once for others.
- chmod
- The command that changes a file's mode, by letters (g+w) or by number (660). Only the owner or root may use it on a file.
- root
- The administrator account, UID 0. Its processes skip the read and write checks; sudo runs one command as root.
Notes and sources
- The users, their numbers and the group team are an example. On Debian, Ubuntu and Fedora the first regular user gets UID 1000 and, by default, a personal group of the same name. The ls -l lines on the card are cut after the group; the full line also shows the size, date and name.
- Strictly, the kernel compares the file with the process's filesystem user and group IDs, which normally equal its effective IDs. The order is fixed: owner, then group, then others; once one matches, the others are not looked at, so an owner with fewer rights than the group is still held to the owner bits.
- For execute, even root needs at least one of the three x bits to be set. Changing a mode needs the file's owner or the capability CAP_FOWNER. On Ubuntu members of the group sudo, and on Fedora members of wheel, may use sudo.
- On a folder the bits mean something slightly different: r lists the names, w creates and deletes entries, and x lets you enter it and reach the files inside.
- Linux man-pages: passwd(5), the password file
- Linux man-pages: group(5), the group file
- Linux man-pages: login.defs(5), UID_MIN and UID_MAX
- Linux man-pages: credentials(7), process identifiers
- Linux man-pages: path_resolution(7), the permission check
- Linux man-pages: inode(7), the file type and mode
- Linux man-pages: chmod(1)
- Linux man-pages: chmod(2), who may change a mode
- Linux man-pages: open(2), EACCES
- Linux man-pages: ls(1)
- Linux man-pages: id(1)
- Linux man-pages: capabilities(7), CAP_DAC_OVERRIDE and CAP_FOWNER
- GNU Coreutils manual: File permissions
- sudo(8) manual
- The Linux kernel documentation: Credentials in Linux
Quiz Unlocks after the last step.