The Fundamentals of Linux Permisssions

In a Linux environment, system security and multi-user management rely on a structured permission model. Understanding how Linux handles user roles and file access is essential for system administration.

User Classifications

• Superuser (root): Possesses unrestricted access to the entire system. Identified by the # prompt.
• Standard User: Restricted to their own home directory and specific shared areas. Identified by the $ prompt.

You can switch between accounts using the su [username] command.

Permission Categoreis

Every file or directory in Linux identifies three categories of accessors:

• User (u): The owner of the file.
• Group (g): Other users who belong to the same group as the file.
• Others (o): All other users on the system.

File Modes and Symbols

Linux uses specific characters to define file types:

• d: Directory
• -: Regular file
• l: Symbolic link
• b: Block device (e.g., HDD)
• c: Character device (e.g., serial ports)
• p: Named pipe
• s: Socket

Access Modifiers

Permissions are defined by three base operations, often represented numerically:

• Read (r = 4): View file contents or list directory entries.
• Write (w = 2): Modify files or create/delete items within a directory.
• Execute (x = 1): Run a binary/script or enter a directory.

Managing Permissions

Modifying Permissions with chmod

The chmod utility changes the access mode of a file or directory.

# Numeric method: Set owner to read/write/exec (7), group to read/exec (5), others to read (4)
chmod 754 example.sh

# Symbolic method: Grant execution rights to the owner
chmod u+x example.sh

# Symbolic method: Revoke write permissions from group and others
chmod go-w data.txt

Changing Ownership with chgrp

To assign a file to a different group, use chgrp:

# Change the primary group of a file
chgrp development project.py

# Recursively change group ownership for a directory
chgrp -R engineering ./work_dir

Identifying File Types with file

The file command performs a deep scan of file headers to determine the underlying format, regardless of the file extension.

file archive.tar.gz
file /usr/bin/python3

Securing Shared Directories: The Sticky Bit

In shared directories like /tmp, any user with write access can normally delete any file, even if they don't own it. The Sticky Bit prevents this behavior. When applied to a directory, it ensures that only the file owner, the directory owner, or the root user can remove files.

# Apply sticky bit to a directory
chmod +t /shared_data

# Verify the setting; notice the 't' in the permissions string (e.g., drwxrwxrwt)
ls -ld /shared_data