# File Permissions and Access Control Lists 1. **Understanding File Permissions:** Each of the three permissions are assigned to three defined categories of users. The categories are: * **Owner:** The owner of the file or application. * Use `chown` to change the ownership permission of a file or directory. * **Group:** The group that owns the file or application. * Use `chgrp` to change the group permission of a file or directory. * **Others:** All users with access to the system (outside the users in a group). * Use `chmod` to change the other users' permissions of a file or directory. Let's break down the steps for creating a file, viewing its permissions using **ls -ltr,** and modifying the permissions using **chown, chgrp**, and **chmod.** 1. Create a simple file and run `ls -ltr` to see the details of the files. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728652672806/e6fea4e6-0017-43fb-90fe-96237d918117.png align="center") touch will create an empty file view the file's details and permissions, run: ls -ltr 2. Change Ownership and group : The **chown** and **chgrp** command to change the ownership of the file ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728653330444/69488c69-26df-4993-9678-ab7d1fbc4cd3.png align="center") 3. Change Permissions : The **chmod** command to change file permission of file ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728653487494/b92e6b46-4ccb-414a-9e66-36443881ccf0.png align="center") added execute permission to user and group 2. **Understanding File Permissions in Linux :** Linux is a powerful operating system known for its flexibility and control, particularly in managing file permissions. Understanding file permissions is crucial for maintaining system security and ensuring proper access control in a multi-user environment. This article delves into the various types of file permissions in Linux, including the traditional permissions model. **Traditional File Permissions** In Linux, every file and directory has three types of permissions associated with it: 1. **Read (r)**: Allows users to view the contents of a file or list the contents of a directory. 2. **Write (w)**: Permits users to modify or delete a file or add/remove files in a directory. 3. **Execute (x)**: Allows users to run a file as a program or script. **User Types** Permissions are assigned to three categories of users: * **Owner (u)**: The user who created the file. * **Group (g)**: A group of users that the file belongs to. * **Others (o)**: All other users on the system. **Permission Representation** Permissions can be represented in two ways: 1. **Symbolic Notation**: * For example, `rwxr-xr--` indicates: * Owner: read, write, execute * Group: read, execute * Others: read 2. **Numeric (Octal) Notation**: * Permissions can also be represented as numbers, where: * Read = 4 * Write = 2 * Execute = 1 * The permission `rwxr-xr--` translates to `755` in octal (4+2+1 for owner, 4+0+1 for group, and 4+0+0 for others). 3. **Access Control Lists (ACL):** ACL stands for Access Control List. It’s a more flexible way of managing permissions in a file system compared to traditional Unix permissions (owner, group, and others). **What is an ACL?** An ACL allows you to specify permissions for multiple users or groups on a single file or directory. Instead of just having the standard read, write, and execute permissions for the owner, group, and others, ACLs let you fine-tune access rights. **Why Use ACLs?** 1. **Granular Control**: You can specify different permissions for different users or groups without changing ownership. 2. **Complex Scenarios**: They are useful in scenarios where you need to share files among various users with varying access levels. **Use Case Example** Imagine you have a project folder that needs to be accessed by multiple team members: * **User A**: Needs full access (read, write, execute). * **User B**: Needs read access only. * **User C**: Needs read and write access but not execute. With ACLs, you can set these specific permissions for each user without changing the group or owner of the folder. **How to Use ACLs** 1. **Check if ACL is Supported**: * Most modern filesystems support ACLs (like ext4, xfs). You can check if a filesystem is mounted with ACL support by looking at `/etc/fstab`. 2. **Set ACLs**: * Use the `setfacl` command to set permissions. For example, to give User B read access to a file called `example.txt`, you would run: ```basic setfacl -m u:UserB:r example.txt ``` 3. **View ACLs**: * You can see the ACLs on a file using: ```basic getfacl example.txt ``` 4. **Remove ACLs**: * To remove a specific ACL entry: ```basic setfacl -x u:UserB example.txt ``` * Task: Create a directory and set specific ACL permissions for different users and groups. Verify the permissions using `getfacl` * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728654398429/33ee8662-8621-429e-91df-dacc234f628f.png align="center") **Conclusion** ACLs enhance file security and accessibility by allowing precise control over who can do what with files and directories. If you're working in a multi-user environment or have specific access needs, using ACLs can be a great solution! If you have more questions about ACLs or anything else, feel free to ask! 4. **Additional Tasks** * **Task:** Create a script that changes the permissions of multiple files in a directory based on user input. * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728654700332/f77b0b01-6f25-4996-b7ee-3992a5e78728.png align="center") * **Task:** Write a script that sets ACL permissions for a user on a given file, based on user input. * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728654900191/b0c6e945-02b7-4e47-b123-af1ed0186994.png align="center") 5. **Understanding Sticky Bit, SUID, and SGID:** **1\. Sticky Bit** #### What It Is: The sticky bit is a special permission that can be set on a directory. When applied, it restricts file deletion within that directory. #### How It Works: * Only the owner of a file or the root user can delete or rename files within a directory that has the sticky bit set, regardless of the directory's permissions. * It’s commonly found on directories like `/tmp`, where many users have write access but shouldn't be able to delete each other's files. #### Use Case: If you have a shared directory for temporary files, you would set the sticky bit to prevent users from accidentally or maliciously deleting files created by others. ```basic # Setting the sticky bit on /tmp chmod +t /tmp ``` **2\. SUID (Set User ID)** #### What It Is: SUID is a permission setting that allows a user to run an executable with the permissions of the executable’s owner (usually root) rather than the user who is running it. #### How It Works: * When an executable has the SUID bit set, it allows regular users to execute it with the elevated privileges of its owner. * This is useful for programs that need to perform tasks that require higher permissions. #### Use Case: A common example is the `passwd` command, which allows users to change their passwords. Since it needs to modify system files, it has the SUID bit set. ```basic # Setting SUID on an executable chmod u+s /path/to/executable ``` **3\. SGID (Set Group ID)** #### What It Is: SGID is similar to SUID but applies to group permissions. When set on a directory, new files created within it inherit the group of the directory rather than the group of the user creating the file. #### How It Works: * This ensures that files created in that directory belong to the specified group, making collaboration easier. * For executables, running a file with the SGID bit set executes it with the group permissions of the file's group. #### Use Case: A shared project directory can use SGID to ensure all files created within it have the same group ownership, allowing easy collaboration among team members. ```basic # Setting SGID on a directory chmod g+s /path/to/directory ``` **Summary** * **Sticky Bit**: Prevents file deletion in a shared directory (e.g., `/tmp`). * **SUID**: Allows users to execute a program with the permissions of the program's owner. * **SGID**: Ensures files created in a directory inherit the directory's group ownership. 6. **Backup and Restore Permissions:** * * Task: Create a script that backs up the current permissions of files in a directory to a file. * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728661361430/6716f444-072a-453f-89d8-9c20d2d7a0ec.png align="center") * Task: Create another script that restores the permissions from the backup file. * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1728661375146/f207c3fd-5cd8-4354-9d74-4b721f7de43a.png align="center") Happy Learning:)