Managing File and Directory Permissions

If you’re the administrator of the system, or if you can run the sudo command, you can change the permissions on files and directories anywhere on your system.

The files structure you made in your home directory is something other users on the machine could use, so let’s copy the structure into the /var directory so others can access it. Use the sudo command since you don’t have write access to the var directory:

Next, get a long listing of the /var/files directory, showing all hidden files. This lets you view the permissions of the /var/files directory itself:

As you recall from ​Listing Files and Directories​, the first entry in the list, (.), represents the directory itself, in this case, /var/files:

If you recall, the permissions break down like this:

In this case, the root user can read, write, and execute files in this directory. Other users on the system can read from this directory structure and execute any files there, but they won’t be able to create new files or even make changes to the contents of the files. Execute permissions on directories also allow users to list their contents.

There are two methods you can use to alter access to this structure. You can change the permissions, or you can change the owner.

Let’s change the owner first so your user can manipulate this structure.

Changing Ownership

Changing ownership is the easier method, and it’s often the only method you need. In most cases, the permissions are set correctly, but they’re applied to the wrong user and group. That’s the case here, as well.

The chown command lets you change the owner and group of a directory.

Get a new directory listing to check the ownership:

The chown command changed the ownership on the /var/files directory. Unfortunately, it didn’t do anything to the directory’s contents. To do that, add the -R switch:

Then get a new directory listing:

You can now make modifications to the directory without using sudo. Try it out: add a new directory named dropbox, which you’ll use to let every user on the system write files. Create this directory without using the sudo command:

The command completes without any error messages. Use ls -alh to look at the permissions for the new directory as well as its parent:

The new directory inherits the permissions from the parent directory. Your user has full access to the directory, while your group and all other users can only list the contents and navigate there. Let’s change who can modify files in this directory.

Changing Permissions

To change file or directory permissions, use the chmod command. You can set permissions a couple of ways. Let’s look at symbolic mode first. In symbolic mode, you will use combinations of letters and symbols to add or remove permissions.

Time to experiment. Create a file in the /var/files/dropbox directory named permissions.txt:

Then look at its permissions:

The permissions for this file give read and write permissions to your user and allow everyone else access to read the file.

To remove the ability to write to this file for your user, use the chmod -w command:

To add write permission back for your user, use chmod +w:

Notice that this only changed the permissions for your user. To allow other members of the associated group to write to the file, prefix the permission with the letter g:

To add the ability for others to write to this file, prefix the permission with the letter o, for “others”:

Now everyone has access to write to the file.

You can remove write access for yourself, your group, and everyone, all at once. Use the u prefix to reference your user, and the g and o prefixes for your group and everyone else:

Now add that write permission back with +w:

You’ve controlled access to a file, but what about the directory itself? Use ls -lhd to view the current permissions for the /var/files/dropbox directory:

Right now, your user has full access, but nobody else does. Use chmod on the directory to grant write permissions for everyone so they can add or remove files:

Then use ls -lhd to view the directory to review its permissions:

Now everyone has access to modify files here.

The chmod command can also act recursively if you use the -R switch, so to remove write permissions from the /var/files/dropbox directory and all of its contents for other users, execute this command:

Notice that the permissions.txt also lost write permissions. The permissions set at the directory were applied recursively to the files in the directory. You’ll want to be very mindful about this when you set permissions recursively, especially since file permissions and directory permissions work differently.

Things get a little tricker when you want to assign completely different permissions for yourself and everyone else. The easiest way to do that is by changing the permission bits.

Changing Permission Bits

One of the most common ways to change permissions is to use absolute mode, where you specify numbers to set the permissions. This can be more effective if you need to make more granular changes.

Wnen you’re looking at the permissions for a file, you know you can break them down like this:

The first three letters are the permissions for the user that owns the file, the next three are for the group, and the last three are for all the other users. In this case, the user has full access (rwx), while the group and other users have read and execute access (r-x).

If you think of each one of these as a switch, where 1 is “on” and 0 is “off,” you can represent the permissions as a bunch of bits, like so:

If you convert each group of three to decimal numbers, it’ll look like this:

Converting binary to decimal is beyond the scope of this book. If you’re not comfortable converting binary numbers to decimal numbers, you can use this table for now, and then brush up on that later:

To apply these permissions to a file, you pass all three numbers to the chmod command. Let’s apply these permissions to the permissions.txt file:

Using this approach, you can quickly assign different sets of permissions to a file or group of files.

If you wanted to give yourself read and write access but only allow others to read the file, you’d figure this out the same way:

The permissions end up being 644. Apply the new permissions to the file:

Finally, since the chmod command lets you set permissions recursively, you can set permissions for the entire contents of a directory. Let’s make sure nobody else can read the source code we put in the /var/files/code directory. Retain full control for your user, but revoke access from others:

Now check the permissions on the /var/files/code directory:

Your user is now the only user who can access these files.

Before wrapping up, make sure that everyone can read and write files in the /var/files/dropbox directory. And since it’s a directory, you’ll want to make it executable so people can switch to it:

Now, check the permissions:

Look at the permissions for the permissions.txt file. The permissions.txt file is readable, writable, and executable by everyone, since that’s what you told the chmod command to do; it recursively set all permissions on all of the files and directories.

Be Careful with chmod

Opening up permissions on a file or directory can have devastating results. It gives everyone access to read and execute files, and if those files are accessible through a web server or a shared disk, you could be in some serious trouble. Before you reach for the chmod command, see if you can find another solution. If you ever see anyone suggest running chmod -R 777 anywhere, you can probably ignore that advice, since it opens things up to everyone. A better solution than that is almost always available.

Generally, you don’t want files to be executable, and we probably don’t need everyone else reading this file’s contents, so change the permissions on that file back to being readable and writable by you, but only readable by everyone else:

Verify the permissions one last time to make sure they’re what you want:

To avoid situations like this in the future, where you accidentally set the wrong permissions recursively, you could set the permissions on the directory without using the -R option so it won’t apply recursively, or use letters instead of permission bits. For example, the command chmod -R go+rwX /var/files/dropbox would apply read and write permissions on all files and directories, but the capital X would only apply execute permissions to directories.

Permissions on a Unix-based system is a very complex topic. You have used both symbolic mode and absolute mode to set file permissions, and you will find yourself using both methods depending on the situation you are in. View the documentation for the chmod and chown commands by using man chmod and man chown respectively, and practice changing permissions on files until it becomes second nature.

Next, let’s explore links, which let you create a filesystem object that points to another object.