An Intro to Unix File Permissions

Unix file permissions can be strange and confusing. This is a basic introduction and cheat sheet.

ls -l file.txt shows you file.txt’s permissions, among other things:

-rw-r--r--  1 mike  staff  0 Nov 1 20:09 file.txt

But what does this stuff mean?

The file name – file.txt – is reported on the far right. To its left, ls reports the date and time when file.txt was last modified: Nov 1 20:09. To the left of this, file.txt’s size – 0 – is shown in bytes. To its left, staff is the group that can access file.txt and mike is the file’s owner. The 1 to the left of mike represents file.txt’s hard link count.

Let’s focus on the first column, though.

The first column – -rw-r--r-- – represents the permissions access modes associated with file.txt.

In Unix-based operating systems, there are 3 things that can be done to a file:

1. read its content (represented by a r)
2. write to it and/or modify its content (represented by a w)
3. execute it, as done when running a program (represented by a x)

Every file has permissions attributes associated with…

1. owner - What actions can the owner perform on the file?
2. group - What actions can a user who is a member of a group that a file belongs to perform on the file?
3. other (world) - What actions can all other users perform on the file?

Let’s examine ls -l file.txt’s output again:

-rw-r--r--  1 mike  staff  0 Nov 1 20:09 file.txt

file.txt’s access modes – -rw-r--r-- – can be subdivided into three groups of three, where each character in each group represents permissions pertaining to (1) the owner (the first group of three characters), (2) the group (the second group of three characters), and (3) the world (the third group of three characters):

1. rw- - the owner (mike) can read from and write to the file (but cannot execute the file)
2. r-- - the group (staff) can read the file (but cannot write to the file or execute the file)
3. r-- - all others (“the world”) can read the file (but cannot write to the file or execute the file)

Changing permissions mode

The chmod command can be used to change mode.

chmod can be used in two ways:

1. symbolic mode
2. absolute mode

Symbolic mode

Using chmod with symbolic mode allows setting permissions using a few operators:

Symbolic mode leverages users flags, which specify the users for whom the permissions settings should be applied:

• u - owner permissions
• g - group permissions
• o - all other users
• a - all users

For example:

• chmod u-x file.txt removes owner execute permissions from the owner
• chmod o+wx file.txt adds user write and execute permissions to other users
• chmod g=rx file.txt sets group read and execute

Note that if no users flag is provided, a (all users) is the default. For example, the following makes file.txt executable for all users:

chmod +x file.txt

Absolute mode

In contrast to symbolic mode, absolute mode allows the use of chmod with an octal notation system where a number from 0 through 7 represents permissions:

For example, let’s review the original permissions on file.txt:

-rw-r--r--  1 mike  staff  0 Nov 1 20:09 file.txt

Expressed as octal notation, file.txt’s permissions are 644:

1. rw- (6) - the owner (mike) can read from and write to the file (but cannot execute the file)
2. r-- (4) - the group (staff) can read the file (but cannot write to the file or execute the file)
3. r-- (4) - all others (“the world”) can read the file (but cannot write to the file or execute the file)

To change file.txt’s permissions and add write access to the group (staff):

chmod 664 file.txt

ls -l file.txt
-rw-rw-r--  1 mike  staff  0 Nov 1 20:10 file.txt