All
file system objects on Unix-like systems have three main types of
permissions: read, write, and execute access. Furthermore,
permissions are bestowed upon three possible classes: the user that
owns the file system object, the user group that owns the file system
object, and all system users. To view the file permissions of a set
of files, use the ls -lha command.
The output will resemble the following:
drwxr-xr-x 2 squire squire 4.0K 2009-08-13 10:16 docs
-rw-r--r-- 1 squire squire 8.1K 2009-07-09 16:23 roster.py
lrwxrwxrwx 2 squire squire 4.0K 2009-08-13 10:16 team.docs
The
first block of data contains information regarding the file
permissions and settings, and we'll focus on that in this section.
The first column specifies the type of file system
object. d indicates
that the object is a directory. - indicates
that the object is a normal file. l indicates
that the object is a symbolic link.
The
remaining characters represent the core permissions. In groupings of
three, these characters represent read, write, and execute
permissions. The first grouping represents the owners permissions,
the second grouping represents the usergroup that owns the file, and
the final grouping represents the permissions of all users on the
system.
Any
object on the file system may have any combination of permissions.
Note, access to the files targeted by symbolic links is controlled by
the permissions of the targeted file, not the permissions of the link
object. There are additional
file permissions that
control other aspects of access to files.
The Chmod Command
Consider
the following invocation of chmod:
chmod g+w ~/group-project.txt
This
grants all members of the usergroup that owns the
file ~/group-project.txt write
permissions. To remove this permission later, switch the + sign
to a -,
as in the following example.
chmod g+w,o-rw,a+x ~/group-project-files/
chmod g-w ~/group-project.txt
You
can specify multiple permissions by separating them with a comma, as
in the following example:
This
adds write permissions to the usergroup members, and removes read and
write permissions
from
the "other" users of the system. Finally the a+x adds
the execute permissions to all categories. This value may also be
specified as +x.
If no category is specified, the permission is added or subtracted to
all permission categories. In this notation the owner of the file is
referred to as the user (e.g.
"u+x").
chmod -R +w,g=rw,o-rw, ~/group-project-files/
The -R option
applies the modification to the permissions recursively to the
directory specified and all of its contents. You may also specify
file permissions using the = sign
rather than the + or - operators
to signify only the specified permissions if you need to specify a
set of permissions without relation to the current state of the
file's permission.
The
notation used in this document thus far can be confusing for
particularly complex file permission requirements. chmod provides
an alternate "octal" notation that you may find more
sensible:
0 --- indicates no permissions
1 --x indicates execute permissions
2 -w- indicates write permissions
3 -wx indicates write and execute permissions
4 r-- indicates read permissions
5 r-x indicates read and execute permissions
6 rw- indicates read and write permissions
7 rwx indicates read, write, and execute permissions