controlling access to files

  • ‘-’ : normal file
  • ’d’ : directory
  • ‘l’ : link

permissions evaluated by: user > group > other

execute on directory means the content of that directory can be accessed

chmod chown

only the root user can transfer ownership

as separator between owner and group for chown, can use :newgroup for just group; newuser: ? or newuser ? for just user

. could be used in the past, still possible, but don’t, because you could have a period in the user’s name

1
2
3
4

chmod o+rwx
chmod o=rwx

chmod -R a=rX

-R for recursive permission set X means we’re going to give you read and execute to directory, but only read permissions to the content of the directory Cap means ignore on recurse?

managing default permissions

more than 3 permissions

sticky bit

can use leading 1

applicable only to directories

1
2
3
4
5
6

mkdir asdf
chmod o+t asdf
ls -alt
total 8
drwxrwxr-x.  3 someuser someuser   94 Dec  2 19:43 .
drwxrwxr-t.  2 someuser someuser    6 Dec  2 19:43 asdf

in a collaborative directory where you have write perms to the dir, sticky bit would mean you can only delete files that you are the owner of

lowercase t means execution perm for other, and also sticky bit; T would mean just sticky bit

blocked operation would return ‘Operation not permitted’

Setting the sticky bit with octals:

chmod 1770 thefile

the first octal is the sticky bit: 1 for set, 0 for unset

grid or ‘GroupID’ - ‘Set GroupID bit’

can use leading 2

applicable to dirs or files

1
2
3
4

# add
chmod g+s somefile
# remove
chmod g-s somefile

means executable runs with the permissions of the owning group of that executable

uid or ‘UserID’ - ‘Set UserID bit’

can use leading 4

applicable only to files

1
2
3
4

# add
chmod u+s somefile
# remove
chmod u-s somefile

default permissions, umask

dirs: 777 files: 666

1
2

someuser@somehost ~/workspace/someuser_/redhat_training > umask
0002

umask takes away from defaults, so 0002 will take away write from other

dirs: 775 files: 664

1
2
3
4

# means UID greater than 199; normal users start at 1000
[ $UID -gt 199 ]
# means primary group name equal to username
[ "`id -gn`" = "`id -un`"