Who can do what: permissions and chmod

Recall from lesson 2-3 that each line of ls -l output begins with the file's permission string, the cryptic ten characters that look like -rw-r--r--.

Up to now it has just been noise at the left edge of the listing. This lesson is where it becomes readable.

Reading -rw-r--r--

You will meet permissions the hard way soon enough: a script that refuses to run, a Permission denied on a file you can plainly see, or ssh rejecting your key because other users could read it. Being able to read the permission string turns each of those from a mystery into a ten-second fix.

Linux is multi-user, meaning several accounts can share one machine, so every file records who may do what. There are three actions and three audiences:

• Actions: read, write, and execute, where execute means run it as a program, or enter it if it is a directory
• Audiences: the file's user (its owner), its group, and others, meaning everyone else

The ten-character string packs all of that into one field:

Reading -rw-r--r-- through that table gives: a regular file, whose owner can read and write it, whose group can read it, and which everyone else can also read. A dash in any slot means that permission is not granted.

Changing permissions: chmod

chmod (change mode) speaks two dialects:

Numeric: one digit per audience, adding r=4, w=2, x=1.

chmod 755 script.sh   # rwx r-x r-x
chmod 600 secret.txt  # rw- --- ---

Symbolic: who, then + or -, then what.

chmod u+x script.sh   # give the owner execute
chmod go-r notes.txt  # remove read from group and others

The one you'll type most in your career is chmod +x script.sh: make a script executable. That's the doorway to unit 8.

Turning on the execute bit

A fresh file starts life as rw-r--r--, and chmod 755 adds execute permission for everyone. The cut -c1-10 trims each ls -l line down to its first ten characters, which is exactly the permission string, and umask 022 pins the default permissions so the before-state is predictable.

umask 022
touch tool.sh
ls -l tool.sh | cut -c1-10
chmod 755 tool.sh
ls -l tool.sh | cut -c1-10

Output

-rw-r--r--
-rwxr-xr-x

The three digits map onto the three audiences in order. 7 is rwx for the owner, and the two 5s are r-x for group and others, granting read and execute but withholding write. Comparing the two output lines shows exactly which characters the command changed.

chmod 600 diary.txt allows only the owner to read and write the file, and grants nothing at all to anyone else.

The digits decompose cleanly. The 6 is 4 + 2, read plus write, for the owner, and the two 0s strip every permission from group and others. This is the classic setting for private files such as SSH keys, which unit 10 introduces.

Locking a file down to its owner takes a single numeric chmod. The owner needs read (4) plus write (2), which is 6, and group and others get 0, giving chmod 600.

umask 022
touch secret.txt
chmod 600 secret.txt
ls -l secret.txt | cut -c1-10

Output

-rw-------

The six trailing dashes are the visible proof. Everything past the owner's rw- triplet is empty, so no other account on the machine can read the file, let alone change it.