UNIX file system permissions tutorial
Checking and Understanding Permissions
Access permissions of every file and folder in a UNIX system is controlled by a system based on two identification numbers: user-identification number (UID) and group identification number (UID). Every file or folder should belong to a UID and GID. In practice is it hard to remember these numbers, so the accepted way is to map a user-name and a group-name to each number. In a typical stand-aloone, UNIX computer, all UIDs along with these mappings are listed in the UNIX file /etc/passwd. A typical entry of passwd file is like the following:
alex:x:503:100:Dr. Alexander the Great:/home/alex:/bin/bash
The fields of this entry (seperated by colons, :), relevant to this discussion are:
- alex: username (a short name to identify the user, which is normally used in place of UID). Typically a lowercase, single word.
- 503 : UID
- 100 : GID of the primary group the user belongs to.
- Dr. Alexander the Great : A descriptive name
The primary administrative user -- root, present in every UNIX system has UID 0.
root:x:0:0:root:/root:/bin/bash
There is another file, /etc/group, lising all the GIDs with their descriptive names. A typical entry is like:
kings:x:100:alex,ramses,menes
. The important fields are:
- kings : The name of the group (A lowercase word)
- 100 : GID
- alex,ramses,menes : users that are members of this group
It is possible for a user to belong to more than one group. However, there is only one primary group for a user.
Unless specific steps are taken beforehand, any files or directories created by a user belong to that ueser and that users primary group.
Checking permissions
The ls -l command lists files with a number of details in UNIX systems. Following is an example of the output of the command
drwx------ 2 alex kings 4096 Feb 21 13:47 backup -rw-rw-r-- 1 alex kings 4010 Mar 22 16:55 backup.tar.gz -rwx------ 1 alex kings 20372 Mar 14 14:04 battle-plans drwxrwxr-x 2 alex kings 4096 Mar 23 11:46 GMTstore drwxrwsr-x 2 alex greeks 4096 Apr 4 14:00 handh lrwxrwxrwx 1 alex kings 27 Feb 20 14:32 images -> /opt/images -rwxrw-r-- 1 root root 45458 Mar 23 11:55 install_gmt
Following is a description of the fields relevent to the present discussion.
- drwx------
- permission string.
- alex
- owning user
- kings
- owning group
- backup
- filename
The permission flag is a set of ten positions each describing an aspect of the file's permissions.
| Position | Possible values | |||||||||
| 1 | d : This is a directory. - : this is a normal file. (Occationaly some other things can appear) | 2 | r : owner is permitted read this file. - : He/she can't | 3 | w : owner is permitted to overwrite/append to this file. - : can't | 4 : owner is permitted to execute (run) this file, by calling it by its name. - : can't | 5-7 | : Permissions for group members (meaning same as above). | 8-10 | : Permissions for all others (Not owner, not group members). |
Setting default file permissions
When a user creates a file or a directory, the initial permissoins of those are determined by the 'uname' value which is set by
- uname command
- users initialization file
- system-wide initialization file
Typically the default configuration is equivalent to typing 'umask 22' which produces permissions of:
-rw-r--r-- for regular files, or drwxr-xr-x for directories.
In other words, user has full access, everyone else (group and other) has read access to files, lookup access to directories.
When working with group-access files and directories, it is common to use 'umask 2' which produces permissions of:
-rw-rw-r-- for regular files, or drwxrwxr-x for directories.
For private work, use 'umask 77' which produces permissions:
-rw------- for regular files, or drwx------ for directories.
umask Unmasked
umask is a ocatal number between 000 and 777, directly affecting the resulting file and directory permissions. The three numbers from left, governs the permissions for user, group and others respectively. Each number relates to the respective chmod value as follows.
umask File Directory 0 6 7 1 6 6 2 4 5 3 4 4 4 2 3 5 2 2 6 0 1 7 0 0
Some common umask settings in a more understandable way.
The results shown in the table can be obtained from this bash script.
umask file dirs files dirs
022 759 648 -rw-r--r-- drwxr-xr-x
027 754 643 -rw-r----- drwxr-x---
002 775 664 -rw-rw-r-- drwxrwxr-x
006 771 660 -rw-rw---- drwxrwx--x
007 770 659 -rw-rw---- drwxrwx---
077 714 603 -rw------- drwx------
Checking umask
The umask command can be used to check the current umask values. There are two ways to use this. Either
umask -p
to get the numeric umask value or
umask -S
to get a more human readable output. The results of these commands are like,
umask 0022
and
u=rwx,g=rx,o=rx
, respectively.
A note on source
This article has used sections from several outside sources.
I have assumed that I am not violating a copyright by doing so. Please contact me if this is not the case.
- Please use this e-mail address 3tv-assela@pathirana.net to contact me, if needed.
