Skip to contentExploitQuest

Who Can Do What

Every file says who may read it, change it, and run it. Reading that one line of letters is the difference between "it just won't work" and knowing exactly why.

4 min readNot yet reviewed
Wrenlearner

I keep seeing rwx and dashes when I list files. What is all that?

Rookmentor

That is the whole security model of a shared system, written in ten characters. Learn to read it and half of "why won't this work" answers itself.

Three groups, three powers

Every file carries permissionsPermissionsThe rules on each file saying who may read it, change it, or run it — split between its owner, its group, and everyone else.: three powers — read, write, execute — granted separately to three audiences: the file's owner, its group, and everyone else. That is how a system many people share stops one person reading or wrecking another's files.

-rwxr-x r-- 1 wren staff 512 Aug 24 notes.sh
^\_/\_/ \_/
| |  |   |
| |  |   +-- everyone else: read only
| |  +------ group "staff": read and execute
| +--------- owner "wren": read, write, execute
+----------- type: - is a file, d would be a directory
  1. Line 1Read the ten characters in groups: one type, then three for owner, three for group, three for everyone. Each is r, w, x, or a dash meaning "not allowed".
  2. Line 5"Everyone else" here can read the file but not change or run it. This is the audience you check first when worrying about a leak.

A script runs fine for you but a colleague gets "permission denied". You both can see the file. What is the most likely cause?

Changing them, precisely

chmod changes permissions. The clearest way to use it is by audience and power: chmod u+x file adds execute for the user (owner); chmod go-w file removes write from group and other. Add exactly what is needed, remove exactly what is not.

Granting the least that works
# a script you cannot run yet
$ ls -l deploy.sh
-rw-r--r-- 1 wren wren 128 Aug 24 deploy.sh
# add execute, for you only
$ chmod u+x deploy.sh
$ ls -l deploy.sh
-rwxr--r-- 1 wren wren 128 Aug 24 deploy.sh
# now it runs; nobody else gained any new power

A file holding a private key shows `-rw-r--r--`. Why is that a problem?

Your turn — grant just enough

Your turn

Here is a deploy script you cannot run yet: its owner has no execute permission. Add execute for the owner — and nobody else — so it will run.

you@practice
Practice shell — nothing here is real. Type 'help' to begin.

Making it "just work"

- chmod 777 everything until the error goes away (grants all powers to all)
- Leaving secrets world-readable because it "works"
- Not knowing who "everyone else" includes on a shared box

Granting deliberately

- Add the one bit that is missing (chmod u+x), for the one audience that needs it
- Keep secrets owner-only: chmod 600 for keys and credentials
- Read ls -l before assuming; the answer is usually right there

chmod 777 is the "turn off the alarm to stop it beeping" of security. It makes the error vanish by removing the protection. Grant the specific power instead.

Wrenlearner

So permissions are not an obstacle. They are the answer to "who".

Rookmentor

Right. Read the ten characters, grant the least that works, and keep secrets to their owner. That is most of file security on a real system.

Magpieadversary

And an over-open permission is a gift to me. A world-readable config with a password in it has ended more "secure" systems than any clever exploit.

Sort them yourself

Look only at the last three characters — what everyone else is allowed. Sort each mode by whether a stranger to the file can do anything with it.

  • -rwxr-x---
  • -rw-------
  • -rw-r--r--
  • -rwxr-xr-x
Show the answer
  • Others can read it-rw-r--r--, -rwxr-xr-x
  • Others get nothing-rw-------, -rwxr-x---

So ten characters say who may read, change, and run each file, chmod adjusts them by audience and power, and secrets stay owner-only. Next: who those three audiences actually are — owners and groups — and how ownership decides which powers fall to you.