User Permissions in Linux

Today, GNU/Linux based operating systems are considered to be among the most secure available. They're used by a majority of the largest super computers we have available, far outpacing the amount of computers running UNIX or Windows. And one of the reasons Linux holds its reputation for security is the way it handles user access. Its user and group control functions was developed around the time of the first UNIX systems, and these controls allow file owners to control access to reading, execution, and writing of files, directories, processes and other system tools.

This access control system inside Linux OSs fundamentally works by assigning each object in its file system two attributes: owner and group. Owner is a user that owns any given file or directory. The owner has unlimited access to the files/directories, and has full control of other users' permissions to these files/directories. A group consists of multiple users that have access to any given file or directory. A system user could belong to multiple user groups. 

The id -a command will return the user and group that's currently using the file. The command 
  $ /usr/bin/id -a
will give you something like this:
  uid=1000(username) gid=1000(groupname1) groups=1000(groupname1), 1001(groupname2)

In this case, groupname1(gid=1000) is the effective group, and the group groupname2(gid=1001) is not. As you can expect, a user in a group that has access permission will also be allowed access. Which gid is considered effective is important when creating new directories and files. The list of system users is located in /etc/passwd, and list of groups is located in /etc/group. If that looks kinda weird to you, the /etc/passwd file used to store passwords in previous versions of this system, but this list is now located in /etc/shadow. You can pull the file up using $ sudo /bin/grep username /etc/shadow, though access to this file is usually restricted to normal users.

Another command you'll likely use a lot is the stat command, that will look something like:

 $ /usr/bin/stat /etc/fstab | grep "Access: ("
Access: (0644/-rw-r--r--) Uid: ( 0/root) Gid: ( 0/root)

What this command is doing here is returning the attributes of a file. So we can see in our example, that the /etc/fstab file is owned by the user root (uid=0) within a group of the same name. The access rights are displayed here in form of the 0644 and of the access attributes as (-rw-r--r--).

Each digit in the 0644 can go from 0 to 7 (base 8). We can look at this number in binary (base 2) and it will look like 110 100 100 which we can then compare to the analoguous attributes rw-r--r--. As you can see, these sequences become almost identical (every letter a 1, every dash a 0). Each of the letters can either be (read), w (write), and x (execute). The format there is a rwx slot for every "level" of permissions (user, group, world). So we get a rw- for user, r-- for group, and r-- for world in this example. You might notice there's another dash in the front of that original readout (-rw--r--r--). The first symbol (which is a "-" in this case) is defined by the file type. The dash (-) is for a regular file, but you might also see d for a directory, for a symbolic link file, c for character device file, p for named pipe, s for socket, and b for block file.

So let's get back to the original numerics though (0644). The attributes here break down as follows; read (4), write (2), and execute (1). They combine together arithmetically, so the 6 in the sequence is a combination of read and write (and 2) but not execute (1).  

With the information in our example in mind, we can conclude that the file owner (root) can read and write to the /etc/fstab file, but not execute it. The group root, however, can only read it. 

We talked earlier about passwords stored in the /etc/shadow file, that normally can't be read by regular users. Let's use our stat command to see its attributes:

$sudo /usr/bin/stat /etc/shadow | grep "Access: ("
Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)

Just like we expected, only root user has read/write access, the group has only read access, and everyone else is locked out entirely.

Besides the stat utility, there are a few other methods of going through permissions for files and directories. One of the more popular alternatives is the ls utility with a -l flag, which will also return user permissions in the rwx format we talked about earlier. It looks something like this:

$ /bin/ls -l /etc/fstab
-rw-r--r-- 1 root root 1047 jan 11 2018 /etc/fstab

You can see how similar the return values are to the ones for the stat command. 

There's also the umask utility, which sets default permissions for all new files and directories. By default, it will assign permissions in the form of 0022 which, if you look at our earlier example, means the newly created file will have full access permissions, and the group and other users will only have read and execute rights.

The utility chmod is the standard method of controlling these access rights in Linux. 

If we have a text.txt file with 0644 rights and want to change it so that every user can write to it, you'll use chmod to do something like this:

$ touch text.txt
$ /bin/ls -lh text.txt

$ /bin/chmod 666 text.txt
$ /bin/ls -lh text.txt

Now you can write to the file with something like:
# su Jack -s /bin/bash
$ echo hello > test.txt
$ cat test.txt

There's also an utility for permissions called Access Control Lists (abbreviated ACL) that allows for access permissions to be delegated with much more granularity. However, I think we've been here long enough and our coverage of ACL will have to wait for another article. 

Hope this was helpful to you, and if you have any questions about this article or anything else ServerSuit, leave a comment or reach out through our Twitter and Facebook. Like and follow us for ServerSuit updates and our follow up articles. 

Until Next Time!

January 08 2018

Add or review comments

Please leave your comment

Existing comments

Comments 114

Wow because this is great job! Congrats and keep it up.
Regards for sharing your neat web site.
Surprisingly individual pleasant site. Immense info offered on couple of clicks.
Great web website! It looks very good! Keep up the excellent job!
Appreciate it! This is definitely an superb web site.
Maintain the good work and generating the group!
How are you, well put together web page you've gotten there.
Cool webpage you possess in here.
Highly enlightening, looking forwards to coming back again.
Thanks a lot for sharing your amazing web-site.
Cool internet site you've gotten in here.
Unbelievably individual friendly site. Tremendous details available on few clicks.
You've remarkable thing at this point.
Love the website-- extremely user friendly and whole lots to see!
Thanks pertaining to offering these superior articles.
I adore this site - its so usefull and helpfull.
Sustain the good work and delivering in the crowd!
Thanks with regard to offering this type of superior subject matter.
Thanks, this website is extremely helpful.
Great internet site! It looks really good! Maintain the excellent job!
You're a very valuable website; couldn't make it without ya!
You've got amazing thing in this article.
Wow cuz this is excellent job! Congrats and keep it up.
I love this website - its so usefull and helpfull.
You've gotten very good info these.
Great looking site. Presume you did a great deal of your very own html coding.
Thank you! It is definitely an remarkable webpage!
Greetings, great web-site you've got right now.
Wow cuz this is great work! Congrats and keep it up.
Merely want to express Now i am lucky that i stumbled on your web site.
Hi there, neat webpage you've got there.
Thanks very practical. Will share website with my buddies.
Incredible, such a handy webpage.
Great website! It looks very expert! Keep up the excellent work!
You're a really valuable web site; couldn't make it without ya!
Wonderful internet site you have right here.
Sustain the awesome job !! Lovin' it!
Wow, lovely site. Thnx ...
Many thanks really beneficial. Will share site with my friends.
You have among the best web sites.
Great looking internet site. Presume you did a bunch of your very own coding.
Wow....such a advantageous internet site.
I like this site - its so usefull and helpfull.
Nice webpage you possess right here.
Rather revealing looking forwards to visiting again.
Especially educational....looking frontward to returning.
Just simply want to point out I'm thrilled that i happened onto your internet page!
Thanks with regard to delivering many of these amazing written content.
You're a really beneficial web site; couldn't make it without ya!
I love this website - its so usefull and helpfull.
Your advice is extremely fascinating.
You have got possibly the best internet websites.
Nice internet site you've here.
Just simply needed to stress Now i'm delighted I stumbled onto your website.
<a href="">buy hemp </a> [url=]buy hemp oil [/url] cbd vape
<a href=" ">tru bliss cbd gummies </a> <a href="">best cbd for pain </a> [url=]buy cbd oil cure cbd oil [/url] [url=]cbd tincture [/url]
<a href="">cbd oil reviews </a> [url=]trubliss cbd [/url] best cbd oil 2020 [url= ]cbd oil with thc [/url] <a href=" ">cali naturals cbd </a>
<a href="">cbd oil for sleep </a> [url=]cbd superbugs [/url] walgreens cbd products [url= ]what does cbd do [/url] <a href=" ">cbd hemp oil </a>
<a href="">best cbd for pain </a> [url=]what is the difference between hemp oil and cbd oil [/url] buy cbd oil cure cbd oil [url= ]what is hemp [/url] <a href=" ">where can i buy cbd oil </a>
<a href="">buy hemp </a> [url=]cbd [/url] cbd oil [url= ]cbd vape [/url] <a href=" ">buy cbd </a>
<a href=" ">buy cbd oil </a> <a href="">buy hemp oil </a> [url=]buy cbd oil [/url] [url=]buy cbd oil [/url]
<a href="">cbd cream </a> [url=]cbd vape [/url] hemp cbd [url= ]buy cbd [/url] <a href=" ">cbd </a>
<a href="">buy cbd oil </a> [url=]cbd online [/url] cbd tinctures [url= ]buy cbd oil [/url] <a href=" ">hemp cbd </a>
<a href="">buy cbd oil </a> [url=]cbd oil [/url] cbd oil online [url= ]cbd online [/url] <a href=" ">cbd online </a>
<a href=" ">cbd oil </a> <a href="">cbd oil online </a> [url=]cbd [/url] [url=]cbd tinctures [/url]
casino games play casino online casinos [url=]online casinos[/url] best online casinos
casino games play casino online casinos [url=]online casinos[/url] best online casinos
canadian pharmacy cialis
Cephalexin Chlamydia haurrehigh [url=]cialis online pharmacy[/url] Engeda viagra cialis levitra comparison Awagosoods <a href=>is generic cialis available</a> noinly Cvs Viagra 100mg Price 380
cheap generic cialis
cheapest brand cialis haurrehigh [url=]Cialis[/url] Engeda Propecia Ot Minoxidil Awagosoods <a href=>Cialis</a> noinly cialis 5 mg precio
buy viagra online with paypal <a href="">cheap generic viagra</a> is viagra generic yet
viagra online canadian pharmacy <a href="">viagra online without prescription</a> viagra online canadian pharmacy
viagra 100mg <a href="">viagra online</a> viagra online by paypal
viagra online <a href=""></a> buy generic viagra online delivery fast
viagra indian brand <a href=""></a> viagra for free trial
viagra for sale <a href="">buying viagra montreal</a> cheap viagra
risks viagra heart attack <a href="">coiffeuse russe viagra</a> viagra und atacand
hoe lang van te voren viagra slikken <a href="">viagra precio farmacias ahumada</a> che cos ГЁ un viagra
sublingual viagra <a href="">viagra price comparison canada</a> sildenafil mexico price
Kbrghifs <a href="">sildenafil canadian online pharmacy</a> buy sildenafil no prescription
online pharmacy for viagra <a href="">buy viagra online from india</a> purchase viagra with paypal
buy real viagra online india <a href="">best viagra uk</a> discount viagra pharmacy
man myth viagra <a href="">viagra para mujeres uruguay</a> is it ok to take 150mg of viagra
viagra&dapoxetine <a href="">purchasing viagra online</a> viagra mail order canada
college essays that got accepted <a href="">homework good or bad</a> i need help with my homework
college application essay about yourself <a href="">help writing dissertation</a> research paper 4th grade
tok essay help <a href="">historical research proposal</a> buy an essay
write compare and contrast essay <a href="">writing a conclusion</a> college essays for sale
do my math homework please <a href="">application essay</a> solve my homework
compare and contrast essay help <a href="">essay writing tip</a> research paper euthanasia
dissertations help <a href="">college essay about myself</a> essay writing criteria
write an analytical essay <a href="">persuasive essay for kids</a> first day of college essay
cialis in egypt <a href="">cialis no perscrption</a> buy generic cialis australia
I delight in, cause I found exactly what I was taking a look for. You have ended my four day lengthy hunt! God Bless you man. Have a great day. Bye credit score scale
I delight in, cause I found exactly what I was taking a look for. You have ended my four day lengthy hunt! God Bless you man. Have a great day. Bye credit score scale
california viagra <a href="">ordering viagra gold online</a> viagra 50mg canada
Generique Baclofen haurrehigh [url=]generic cialis online pharmacy[/url] Engeda Buy Wellbutrin Xl 300 Mg Online
20 mg 30 pills cialis <a href="">cialis canada generic</a> cialis no prescription
cialis 20 mg tablets and prices <a href="">cialis on line australia</a> cialis australia paypal
brand cialis sale <a href="">cialis uk</a> cialis dominican resort
non generic viagra without a prescription <a href="">viagra cheap fast delivery</a> discount viagra
cialis and viagra taken together <a href="">generic viagra chewable</a> buy viagra dublin
best prices generic viagra 100mg <a href="">viagra professional o superactive</a> viagra without prescription
prescription viagra australia <a href="">dapoxetine viagra</a> generic viagra
quick delivery viagra <a href="">generic viagra sale</a> viagra pills sale in greenville
online pharmacy canada <a href="">board of pharmacy</a> mexican pharmacy
erectile dysfunction medications <a href="">pharmacy online</a> rx pharmacy
pharmacy rx one reviews <a href="">rx plus pharmacy</a> cheapest pharmacy
discount pharmacy <a href="">impotence</a> canadian online pharmacy
universal drugstore <a href="">pharmacy open near me</a> canadian pharmacy online
best drugstore lipstick <a href="">best drugstore shampoo</a> us pharmacy
pharmacies canadian online pharmacies
uk pharmacy <a href="">online pharmacies</a> canada rx pharmacy
buy viagra <a href="">walgreen viagra cost per pill</a> viagra store in las vegas is viagra prescription only <a href="">shop for viagra online</a> next day viagra delivery usa penis pump viagra <a href="">viagra australia paypal</a> viagra 100mg viagra purchase in melbourne <a href="">buy viagra online uk paypal</a> viagra online paypal buy viagra with dapoxetine <a href="">viagra online mexican pharmacy</a> viagra for dogs online
buy strong viagra <a href="">viagra under 50</a> viagras 100mg viagra for sale cheapest <a href="">sildenafil citrate tablets viagra</a> cheap viagra hawaii viagra overnight delivery <a href="">viagra blue vision</a> viagra online in usa red viagra online <a href="">viagra in dubai</a> canada generic viagra generic viagra canada <a href="">how long does 100mg of viagra last</a> cheapviagrathatacceptsmastercard
50 mg viagra reviews <a href="">viagra generica</a> viagra no presription is a prescription needed for viagra <a href="">viagra online sales australia</a> cost of viagra 50mg viagra usa <a href="">what is better viagra or cialis</a> how much does viagra cost with insurance buy viagra with dapoxetine <a href="">viagra cheap</a> viagra online by paypal buy cheap viagra on line <a href="">viagra 500mg</a> viagra online, mastercard