Permission Groups
Each file and directory has three user based permission groups:
- owner - The Owner permissions apply only the owner of the file or directory, they will not impact the actions of other users.
- group - The Group permissions apply only to the group that has been assigned to the file or directory, they will not effect the actions of other users.
- all users - The All Users permissions apply to all other users on the system, this is the permission group that you want to watch the most.
Permission Types
Each file or directory has three basic permission types:
- read - The Read permission refers to a user's capability to read the contents of the file.
- write - The Write permissions refer to a user's capability to write or modify a file or directory.
- execute - The Execute permission affects a user's capability to execute a file or view the contents of a directory.
Use command "ls -l" to view permissions of the files
Explicitly Defining Permissions
The Permission Groups used are:
- u - Owner
- g - Group
- o - Others
- a - All users
The potential Assignment Operators are + (plus) and - (minus); these are used to tell the system whether to add or remove the specific permissions.
The Permission Types that are used are:
- r - Read
- w - Write
- x - Execute
For an example, file1 has the permissions set to _rw_rw_rw, which means that the owner, group and all users have read and write permission.
chmod a-rw file1: remove the read and write permissions from the all users group
chmod a+rw file1: Add the read and write permissions from the all users group
Using Binary References to Set permissions
The first number represents the Owner permission; the second represents the Group permissions; and the last number represents the permissions for all other users. The numbers are a binary representation of the rwx string.
- r = 4
- w = 2
- x = 1
You add the numbers to get the integer/number representing the permissions you wish to set. You will need to include the binary permissions for each of the three permission groups.
chmod 640 file1, which means that the owner has read and write permissions, the group has read permissions, and all other user have no rights to the file.
Owners and Groups
You use the chown command to change owner and group assignments, the syntax is chown owner:group filename.
chown user1:family file1: change the owner of file1 to user1 and the group to family.
Advanced Permissions
The special permissions flag can be marked with any of the following:
- _ - no special permissions
- d - directory
- l- The file or directory is a symbolic link
- s - This indicated the setuid/setgid permissions. This is not set displayed in the special permission part of the permissions display, but is represented as a s in the read portion of the owner or group permissions.
- t - This indicates the sticky bit permissions. This is not set displayed in the special permission part of the permissions display, but is represented as a t in the executable portion of the all users permissions.
Setuid/Setgid Special Permissions
The setuid/setguid permissions are used to tell the system to run an executable as the owner with the owner\'s permissions.
Be careful using setuid/setgid bits in permissions. If you incorrectly assign permissions to a file owned by root with the setuid/setgid bit set, then you can open your system to intrusion.
You can only assign the setuid/setgid bit by explicitly defining permissions. The character for the setuid/setguid bit is s.
chmod g+s file2.sh: set the setuid/setguid bit on file2.sh
How the optimal permissions should be set
- home directories- The users\' home directories are important because you do not want other users to be able to view and modify the files in another user\'s documents of desktop.
To remedy this you will want the directory to have the drwx______ (700) permissions, so lets say we want to enforce the correct permissions on the user user1\'s home directory that can be done by issuing the command chmod 700 /home/user1. - bootloader configuration files- If you decide to implement password to boot specific operating systems then you will want to remove read and write permissions from the configuration file from all users but root. To do you can change the permissions of the file to 700.
- system and daemon configuration files- It is very important to restrict rights to system and daemon configuration files to restrict users from editing the contents, it may not be advisable to restrict read permissions, but restricting write permissions is a must. In these cases it may be best to modify the rights to 644.
- firewall scripts - It may not always be necessary to block all users from reading the firewall file, but it is advisable to restrict the users from writing to the file. In this case the firewall script is run by the root user automatically on boot, so all other users need no rights, so you can assign the 700 permissions.
Reference
https://www.linux.com/learn/understanding-linux-file-permissions