Who Can Do What
Every file says who may read it, change it, and run it. Reading that one line of letters is the difference between "it just won't work" and knowing exactly why.
I keep seeing rwx and dashes when I list files. What is all that?
That is the whole security model of a shared system, written in ten characters. Learn to read it and half of "why won't this work" answers itself.
Three groups, three powers
Every file carries permissionsPermissionsThe rules on each file saying who may read it, change it, or run it — split between its owner, its group, and everyone else.: three powers — read, write, execute — granted separately to three audiences: the file's owner, its group, and everyone else. That is how a system many people share stops one person reading or wrecking another's files.
-rwxr-x r-- 1 wren staff 512 Aug 24 notes.sh
^\_/\_/ \_/
| | | |
| | | +-- everyone else: read only
| | +------ group "staff": read and execute
| +--------- owner "wren": read, write, execute
+----------- type: - is a file, d would be a directory
- Line 1Read the ten characters in groups: one type, then three for owner, three for group, three for everyone. Each is r, w, x, or a dash meaning "not allowed".
- Line 5"Everyone else" here can read the file but not change or run it. This is the audience you check first when worrying about a leak.
A script runs fine for you but a colleague gets "permission denied". You both can see the file. What is the most likely cause?
x; your colleague, in "everyone else", does not. The fix is to grant execute to the audience that needs it, no more.Changing them, precisely
chmod changes permissions. The clearest way to use it is by audience and power: chmod u+x file adds execute for the user (owner); chmod go-w file removes write from group and other. Add exactly what is needed, remove exactly what is not.
# a script you cannot run yet
$ ls -l deploy.sh
-rw-r--r-- 1 wren wren 128 Aug 24 deploy.sh
# add execute, for you only
$ chmod u+x deploy.sh
$ ls -l deploy.sh
-rwxr--r-- 1 wren wren 128 Aug 24 deploy.sh
# now it runs; nobody else gained any new power
A file holding a private key shows `-rw-r--r--`. Why is that a problem?
r-- means every other user on the system can read the file, and a private key must be secret. Many tools refuse to use a key with permissions this open, for exactly this reason. It should be -rw-------: readable and writable by the owner, and by nobody else.Your turn — grant just enough
Here is a deploy script you cannot run yet: its owner has no execute permission. Add execute for the owner — and nobody else — so it will run.
Making it "just work"
- chmod 777 everything until the error goes away (grants all powers to all)
- Leaving secrets world-readable because it "works"
- Not knowing who "everyone else" includes on a shared boxGranting deliberately
- Add the one bit that is missing (chmod u+x), for the one audience that needs it
- Keep secrets owner-only: chmod 600 for keys and credentials
- Read ls -l before assuming; the answer is usually right therechmod 777 is the "turn off the alarm to stop it beeping" of security. It makes the error vanish by removing the protection. Grant the specific power instead.
So permissions are not an obstacle. They are the answer to "who".
Right. Read the ten characters, grant the least that works, and keep secrets to their owner. That is most of file security on a real system.
And an over-open permission is a gift to me. A world-readable config with a password in it has ended more "secure" systems than any clever exploit.
Legal
Set permissions on files you own or administer. Changing permissions on another user's files, or widening them to reach something you are not entitled to, is unauthorised access — the mechanism is simple, the authorisation is the line.
Sort them yourself
Look only at the last three characters — what everyone else is allowed. Sort each mode by whether a stranger to the file can do anything with it.
-rwxr-x----rw--------rw-r--r---rwxr-xr-x
Show the answer
- Others can read it-rw-r--r--, -rwxr-xr-x
- Others get nothing-rw-------, -rwxr-x---
So ten characters say who may read, change, and run each file, chmod adjusts them by audience and power, and secrets stay owner-only. Next: who those three audiences actually are — owners and groups — and how ownership decides which powers fall to you.