The Quick Part
Linux, like every machine, is used by users (real or not) each with their own UID. The normal ones are the humans like you and me, the root, and some psuedo users that are used to isolate system level services such daemons, nvidia, systemd-* etc (check cat /etc/passwd).
What we are concerned about usually is us and the one above us, root.
Users and Groups
All these users are assorted into groups, which form the core part of how kernel enforces permissions.
Each group have its own GID (check cat /etc/group)
Membership
A user belongs to at least one group, its primary group. Other groups the user is part of are known as its supplementary groups.
By default, any user belongs to primary group of their own username (human:human, user human belongs to group human), and this can be changed.
id # UID, GIDs
whoami # username
groups [username] # group names
Enter fullscreen mode Exit fullscreen mode
Permissions
Permission, relvant to a user, is the ability to perform an action on an entity.
These permissions apply to files, and everything is a file. So, permissions apply to files, directories, devices, sockets, named pipes and many other things.
The users who perform actions are divided into 3 types, with respect to the file.
- User (u) – owner user
- Group (g) – owner group
- Others (o) – catch all
When a file is first created, the current user in context becomes the owner user and their primary group becomes the owner group for that file.
The imporant part – above assignment is the only point of relation between owner user and group.
So, the owner user and owner group are essentially independent from each other.
ex. a file’s owner group is supplmentary for its owner user. or the owner user may not be part of the owner group at all.
Recipe
For each of the 3 types, 3 values are used for Read, Write and Execute, with their 3 octal values.
- Read (r) value = 4
- Write (w) value = 2
- Execute (x) value = 1
For none, (-) value = 0
Think of these as each user type independenty getting their own triplet of read, write and execute.
These are also written in decimal notation by summing the triplet.
rwx = 4+2+1 = 7
rw- = 4+2+0 = 5
and rwxrw-rw- becomes 755
Enter fullscreen mode Exit fullscreen mode
Check
The decision to grant a particular permission is a sequence of checks.
Commands
1. chmod
Who Can Run?
- root
- owner user
Description
Modifies the permission values of the file
chmod 754 file // overwrite
chmod u+rx file // append
chmod u+r-x file // append that overwrites
chmod g-w, o+r file
chmod -R 754 dir // recursive in directory
Enter fullscreen mode Exit fullscreen mode
Note the subtle difference between u+rx and u+r-x, the first one will retain the original setting of write, while second one unsets it.
2. chown
Who Can Run?
- root
Description
Sets wner user and owner group
chown human file // owner user
chown human:sapiens file // both owner user and group
Enter fullscreen mode Exit fullscreen mode
3. chgrp
Who Can Run?
- root
- owner user only if it belongs to destination group
Description
Sets owner group
chgrp sapiens file
Enter fullscreen mode Exit fullscreen mode
Important Note when assigning new owner group through chgrp that the command executing user must also be a member of the group they are assigning, this prevents vulnerabilities.
Root
the root user has the highest elevated prviliges and can work on top of existing users and groups.
Hence, it can run the above commands for any file and also has implcit rwx access to every file
One caveat is if the permission for some file is 000, meaning no permission set, it can still read and write but can’t execute the file.
Although, can simply do chmod +x file to give itself that permission.
There are some special values like SGID and SUID but I will cover in next post.
Thanks.