1. Overview
The Linux operating system uses access permissions to maintain security on files directories. When we create a file or directory, Linux assigns default permissions to them. In this tutorial, we’ll discuss different ways of changing permissions for directories and files within the directory.
2. Access Permissions
In many Linux distributions when we create a user, the Linux system creates a group having the same name as the user and assigns that user’s files to that group. The relationship between files and users is that each file can belong to one user and one group.
2.1. Listing File and Directory Permissions
We can use the ls -ld command to show us the permissions on a directory:
$ ls -ld folder
drwxrwxr-x 2 baeldung baeldung 4096 Jul 14 08:50 folder
Additionally, we can apply the ls -l command to show us the permissions on the files in a directory:
$ ls -l
total 0
-rw-rw-r-- 1 baeldung baeldung 0 Jul 14 08:50 file1
-rw-rw-r-- 1 baeldung baeldung 0 Jul 14 08:50 file2
Moreover, we use ls -l command for a specific file that shows us the permissions on that file:
$ ls -l file1
-rw-rw-r-- 1 baeldung baeldung 0 Jul 14 08:50 file1
2.2. Default Access Permission
*When we create a new file or directory, it is created with default access or permission 666 (rw-rw-rw-) or 777 (rwxrwxrwx), respectively.* However, we can change the default permission by using umask command. The umask command tells the system what permissions should not be given to a new file as default. The umask is the value that is subtracted from the default permission. By default umask is equal to 0002, and will remove write permissions from files (rw-rw-r–) when creating it:
$ umask 0002
$ echo "test" > file
$ ls -l file
-rw-rw-r-- 1 baeldung baeldung 0 Jul 14 09:36 file
Also, the new directory will be created with the 775 (rwxrwxr-x) permissions.
3. Change Permission of Directory and File
We can change the permissions of files and directories using the chmod command. There are two ways to change permission:
- Using short/soft/symbolic codes
- Using octal codes
3.1. chmod Codes
We can use symbolic code plus (+) to add permissions and use minus (–) to remove permissions. Therefore, to give read permission we use +r. In addition, we use +w to give write permission and +x to give execute permission. For removing these permissions, we use -r to remove read permission**,** -w to remove write permission and -x to remove execute permission.
In addition, we can use octal codes to change the permissions. For example, when using octal codes, we can use numbers instead of r,w,x.
3.2. Change Permission Recursively
Sometimes, we need to change the permissions of a directory and all its subfolders and files. In these cases, we use -R option to recursively apply permission to all subfolders and files:
chmod -R <permissions> <directory>
For example, we want to assign read, write, and execute permissions, to the owner (7) for the current directory and all its subfolders and files. Also, we want to assign read and execute permissions to both group (5) and others (5).
Let’s look at an example:
$ ls -ld folder
drwxrwxr-x 2 baeldung baeldung 4096 Jul 14 08:50 folder
$ ls -l file1
-rw-rw-r-- 1 baeldung baeldung 0 Jul 14 08:50 file1
$ chmod -R 751 folder/
After preceding command:
$ ls -ld folder
drwxr-x--x 2 baeldung baeldung 4096 Jul 14 08:51 folder
$ ls -l file1
-rwxr-x--x 1 baeldung baeldung 0 Jul 14 08:51 file1
4. Access Modes
Normally when we run a program it runs with your access level but there are times we should change our password or use programs that need access to system files. We should be able to access /etc/passwd or /etc/shadow to change our password but we should not be able to access other people’s files. In such a case, the Linux system has special bits on each file:
- suid: set user-id
- sgid: set group id
- *sticky
*
If we set suid on a file, that file will be executed with the access of the owner of the file, and no matter which user is running it. We can set the suid bit with u+s command:
$ ls -l file1
-rw-rw-r-- 1 baeldung baeldung 0 Jul 12 11:26 file1
$ chmod u+s file1
$ ls -l file1
-rwSrw-r-- 1 baeldung baeldung 0 Jul 12 11:26 file1
The S character is in the place of executable bit for the user. If we set the sgid bit on a file, members of the same group can run the file. We can set sgid bit with g+s command:
$ ls -l file1
-rw-rw-r-- 1 baeldung baeldung 0 Jul 12 11:50 file1
$ chmod g+s file1
$ ls -l file1
-rw-rwSr-- 1 baeldung baeldung 0 Jul 12 11:50 file1
The sgid on a directory will force any new file in that directory to have the sgid of the directory. It is possible to set or unset, the suid and sgid using chmod and +s or -s instead of x. If we set the sticky bit on a file, only the owner of the file can delete it even if all users have to write access to that directory. The sticky bit is identified by t and will be shown on the last bit of a directory. We can set sticky bit with o+t command:
$ ls -l file1
-rw-rw-r-- 1 baeldung baeldung 0 Jul 12 12:07 file1
$ chmod o+t file1
$ ls -l file1
-rw-rw-r-T 1 baeldung baeldung 0 Jul 12 12:07 file1
The T character is in the place of executable bit for the other. Let’s review how we can set these access modes:
access mode | octal | symbolic
suid | 4000 | u+s
guide | 2000 | g+s
sticky | 1000 | t
We can set the access modes of a directory and all its subfolders and files using -R option:
chmod -R <access modes> <directory>
Let’s look at an example:
$ chmod -R u+s folder/
After preceding command:
$ ls -ld folder
drwsr-x--x 2 baeldung baeldung 4096 Jul 14 08:51 folder
$ ls -l file1
-rwsr-x--x 1 baeldung baeldung 0 Jul 14 08:51 file1
5. Changing Owner and Group
If we need to change the ownership or group of a file or directory, we use the chown command. The general style for changing owner and group is:
chown newuser:newgroup file
Let’s give it a try:
$ ls -l file1
-rw-rw-r-T 1 baeldung baeldung 0 Jul 12 12:07 file1
$ chown baeldung:adm file1
$ ls -l file1
-rw-rw-r-T 1 baeldung adm 0 Jul 12 12:07 file1
Also, we can use another format of chown:
chown :newgroup file
Let’s look at an example:
$ chown :adm file1
$ ls -l file1
-rw-rw-r-T 1 baeldung adm 0 Jul 12 12:07 file1
We changed the default group (baeldung) to adm group.
We can change the ownership of a directory and all its subfolders and files recursively using -R option:
$ chown -R newuser:newgroup directory
6. Conclusion
In this tutorial, we described permissions on files and directories. Also, we assessed the access modes and changing the ownership and group of files and directories.