Linux File Permissions

All file system objects on Unix-like systems have three main types of permissions: read, write, and execute access. Furthermore, permissions are bestowed upon three possible classes: the user that owns the file system object, the user group that owns the file system object, and all system users. To view the file permissions of a set of files, use the ls -lha command. The output will resemble the following:

drwxr-xr-x 2 squire squire       4.0K 2009-08-13 10:16 docs
-rw-r--r-- 1 squire squire       8.1K 2009-07-09 16:23 roster.py
lrwxrwxrwx 2 squire squire       4.0K 2009-08-13 10:16 team.docs

The first block of data contains information regarding the file permissions and settings, and we'll focus on that in this section. The first column specifies the type of file system object. d indicates that the object is a directory. - indicates that the object is a normal file. l indicates that the object is a symbolic link.

The remaining characters represent the core permissions. In groupings of three, these characters represent read, write, and execute permissions. The first grouping represents the owners permissions, the second grouping represents the usergroup that owns the file, and the final grouping represents the permissions of all users on the system.

Any object on the file system may have any combination of permissions. Note, access to the files targeted by symbolic links is controlled by the permissions of the targeted file, not the permissions of the link object. There are additional file permissions that control other aspects of access to files.

The Chmod Command

Consider the following invocation of chmod:

chmod g+w ~/group-project.txt

This grants all members of the usergroup that owns the file ~/group-project.txt write permissions. To remove this permission later, switch the + sign to a -, as in the following example.

chmod g+w,o-rw,a+x ~/group-project-files/

chmod g-w ~/group-project.txt

You can specify multiple permissions by separating them with a comma, as in the following example:

This adds write permissions to the usergroup members, and removes read and write permissions from the "other" users of the system. Finally the a+x adds the execute permissions to all categories. This value may also be specified as +x. If no category is specified, the permission is added or subtracted to all permission categories. In this notation the owner of the file is referred to as the user (e.g. "u+x").

chmod -R +w,g=rw,o-rw, ~/group-project-files/

The -R option applies the modification to the permissions recursively to the directory specified and all of its contents. You may also specify file permissions using the = sign rather than the + or - operators to signify only the specified permissions if you need to specify a set of permissions without relation to the current state of the file's permission.

The notation used in this document thus far can be confusing for particularly complex file permission requirements. chmod provides an alternate "octal" notation that you may find more sensible:

0 ---      indicates no permissions
1 --x      indicates execute permissions
2 -w-      indicates write permissions
3 -wx      indicates write and execute permissions
4 r--      indicates read permissions
5 r-x      indicates read and execute permissions
6 rw-      indicates read and write permissions
7 rwx      indicates read, write, and execute permissions