Unix/Linux script tutorial : file permissions/ chmod recursive

What is Unix Users?

A UNIX system serves many users. Users are an abstraction that denotes a logical entity for assignment of ownership and operation privileges over the system. UNIX identifies each user by a User ID (UID) and the username (or login) such as ‘oracle’ and ‘applmgr’ is just an alias to the UID that makes humans more comfortable.

What is Unix Groups?

Users can be organized in groups. A user may belong to one or more groups of users. The concept of groups serves the purpose of assigning sets of privileges for a given resource and sharing them among many users that need to have them. For example in Oracle apps env, we have dba group whose members are oracle and applmgr

Unix file permissions decoded

Each file and directory on your Unix system is assigned access rights for the owner of the file, the members of a group of related users, and everybody else. Rights can be assigned to read a file, to write a file, and to execute a file (i.e., run the file as a program).

We can use ls -l command to list the file permission

Lets take an example to explain it

$ls -l x1

-rwxrw-r– 1 oracle dba 10 Jan 10 12:41 x1

x1	Filename
oracle	is a user of the Unix system and owner of the  file
dba	is a group and group assigned to the file
r	It stand for read permission
w	It stands for write permission
x	It stands for execute permission
First three letter( rwx)	determine the file permission for the owner. So owner can read,write and execute the file
Second three letter (rw-)	determine the file permission for the group.So any user in that group has read and write permission on the file
The last three letter(r–)	determine the file permission for everybody else. So anybody who is not the owner nor in file group can read the file only

We can write file permission in another form also.It is Called Octal Number
1) read means 4,write means 2 and execute means 1
2) so rwx for owner means 7
3) so rw- for groups means 6
4) so r– for everybody else means 4
5) We can say 764 as the file permission in short

How these permission are defined for the file

You can use the umask command to set default access permissions. This will ensure that any files and directories you create have consistent permissions.

Without the mask the system would set permissions of 666 for files and 777 for directories when first created. The values in the mask are subtracted from these values to give a default value for access permissions for the files and directories created by you.

For example:
777 (system value for directories)
-077 (value of the umask)
—
700 (default access permission of rwx——)
To change your default access permissions you use the command:
umask nnn
Each “n” is a number from 0 to 7

Octal number Access permissions given
——————————————————————————–
0 rwx read, write and execute
1 rw- read and write
2 r-x read and execute
3 r– read only
4 -wx write and execute
5 -w- write only
6 –x execute only
7 — no permissions

chmod and chown

We can use chmod and chown to manipulate the file permission

chmod

chmod options mode filename filename1…
chmod options mode directory_name

The “mode” consists of three parts: who the permissions apply to, how the permissions are set and which permissions to set.
who is specified as one of:
u (user) the owner of the file
g (group) the group to which the owner belongs
o (other) everyone else
a (all) u, g and o (the world)
how is given as one of:
+ add the specified permission
– subtract the specified permission
= assign the specified permission, ignoring
whatever may have been set before.
which are specified by one or more from:
r read
w write
x execute
Options:
-R Recursively descend through directory arguments, setting the mode for each file as described above. When symbolic links are encountered, the mode of the target file is changed, but no recursion takes place.

chmod u+x file1 : It means giving execute permission to file owner
chmod g-x file1 : It means revoking execute permission from file group

We can also use Octal numbers for chmod
chmod 700 file1 : It means giving read/write/execute permission to file owner but revoke every permission from group and everybody else

Examples of Chmod command /chmod recursive

chmod -r 755	It means giving 755 permission to the all the files in recursive manner
chmod -r 777	It means giving 777 permission to the all the files in recursive manner
chmod -r a+w	It means giving all  (user+group+world) write permission to the all the files in recursive manner
chmod -r g+w	It means giving group  write permission to the all the files in recursive manner
chmod -r-xr-xr-x	It means giving read and execute to owner,group and world
chmod -rw-r—–	It means giving read ,write  to owner and read to group
chmod -rw-rw—-	It means giving read ,write  to owner and group
chmod -rw-rw-rw-	It means giving read ,write  to owner , group,world
chmod 755	It means giving read ,write,execute  to owner  and read ,execute to group and wold
chmod 777	It means giving read ,write,execute  to owner  ,group and world

chown

chown options username:group name filename
chown options username:group name filename

username: To assign the file to a particular user
groupname:To assign the file to a particular group

This is generally execute with root command to avoid any privilege issue
Options:
-R Recursively descend through directory arguments, setting the mode for each file as described above.

chown oracle:dba file1 : It means assigning user oracle and group dba to the file1

Chmod command for handling file permissions

File permissions are one of the important security features, in order to restrict unauthorized users to restrict access.

Check the file permissions:

We can see the permissions assigned to a file with ls -l command.

ls -l

[admin@linbox1 ~]$ ls -l abc*
-rw-r--r--. 1 root  root  17 Jul 25 17:13 abcfile1
-rw-r--r--. 1 root  root  17 Jul 25 17:13 abcfile2
-rw-rw-r--. 1 admin admin  0 Jul 26 07:59 abcfile3
drwxr-xr-x. 2 admin admin  6 Jun 16 05:47 Desktop
drwxr-xr-x. 2 admin admin  6 Jun 16 05:47 Documents

In the above-highlighted output is the file and directory access permissions.

This indicates access permissions are applied to the user, group and others.

rwx rwx rwx

users group others

Below chart will explain the read, write and execute permissions at file and Directory level.

Type of Permission	@File Level	@Directory Level
r-read	It means we can read the content of a file	We can view the content of it but we can't create any new file or sub-directory.
w-write	It means that we can edit it's content	We can view and create new files in that directory. If we grant write permissions, then by default read permissions are also assigned.
x-execute	For a script files we can run them and for a directory Eg: Having execution permission for command files or binary files.	If we have execute permissions at directory level, then we can also read and write content in directory.

Type of Permission @File Level @Directory Level

r-read it means we can read the content of a file we can view the content of it but we can't create any new file or sub-directory.

w-write it means that we can edit it's content we can view and create new files in that directory.

If we grant write permissions,

then by default read permissions are also assigned.

x-execute for script files we can run them and for a directory

Example:

Having execution permission for command files or binary files. If we have executed permissions at the directory level, then we can also read and write content in the directory.

Assigning permissions to file or directories:

chmod command:

This command is used for modifying the permissions to file and directories.

Syntax:

chmod permissions-user/group/others file-name

Example:

[root@sys2 ~]# chmod u+rw abclearn

[root@sys2 ~]# ls -l abclearn
-rwx-wxrw-. 2 steve dba 16 Jan 28 19:55 abclearn

Ways of granting the permissions:

We can assign permissions to a file in two ways they are

• Symbolic mode (rwx)

• Absolute mode (421)

Assigning permissions in symbolic mode:

In symbolic mode, we can assign permissions to the file or directory using lower case alphabets ‘rwx’

Let’s take a scenario for it, 

We have “abclearn” file on Linux server and we want to modify the permissions of the file.

[root@sys2 ~]# ls -l abclearn
-rwxrwxrwx. 2 root root 16 Jan 28 19:55 abclearn

Looking at above existing permission set, everyone can access this file.

Our target permissions are as follows,

For users, r-x read, no write and execute permissions

For group r-x, no read, write and execute

For others rw- read, write and no execute for others

[root@sys2 ~]# chmod u+rx,g+rx,o+rw abclearn

Note: 

For removing the permissions, we can use “-“ symbol.

Chmod u-rx abclearn

Checking the modified permissions,

[root@sys2 ~]# ls -l abclearn
-r-xr-xrw-. 2 root root 16 Jan 28 19:55 abclearn

Assigning permissions in absolute mode:

In absolute mode we can assign the permissions to the file using octal numbers.

Each octal number has its own set of permissions listed as follows:

• no permission(---) -----------> (000) ---> 0

• execute(--x) ------------------> (001) ---> 1

• write(-w-)---------------------->(010)---->2

• write and execute(-wx)------>(011)---->3

• read(r--)------------------------>(100)---->4

• read and execute(r-x)-------->(101)---->5

• read and write(rw-) ---------> (110)---->6

• read, write and execute(rwx)->(111)-->7

Now change the permissions of the file by using #chmod command

For example, Let’s grant permissions such that,

others should have Execute permissions alone

group members should have read permissions

user should be having all permissions.

Chmod Command syntax:

chmod 741 file-name

Below we have explained a couple of permissions scenarios in both methodologies for easier understanding.

File permission	Symbolic mode	Absolute mode
Removing write permission to the user without altering remaining permissions.	[root@sys2 ~]# chmod u-w abclearn [root@sys2 ~]# ls -l abclearn -r-xrwxrwx. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 577 abclearn [root@sys2 ~]# ls -l abclearn -r-xrwxrwx. 2 steve dba 16 Jan 28 19:55 abclearn
Removing read permission to the group without altering remaining permissions.	[root@sys2 ~]# chmod g-r abclearn [root@sys2 ~]# ls -l abclearn -r-x-wxrwx. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 537 abclearn [root@sys2 ~]# ls -l abclearn -r-x-wxrwx. 2 steve dba 16 Jan 28 19:55 abclearn
Removing executing permissions for others without altering remaining permissions.	[root@sys2 ~]# chmod o-x abclearn [root@sys2 ~]# ls -l abclearn -r-x-wxrw-. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 536 abclearn [root@sys2 ~]# ls -l abclearn -r-x-wxrw-. 2 steve dba 16 Jan 28 19:55 abclearn
Adding read and write permissions to the user.	[root@sys2 ~]# chmod u+rw abclearn [root@sys2 ~]# ls -l abclearn -rwx-wxrw-. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 736 abclearn [root@sys2 ~]# ls -l abclearn -rwx-wxrw-. 2 steve dba 16 Jan 28 19:55 abclearn
Removing execute permissions for user, group and others.	[root@sys2 ~]# chmod ugo-x abclearn [root@sys2 ~]# ls -l abclearn -rw--w-rw-. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 626 abclearn [root@sys2 ~]# ls -l abclearn -rw--w-rw-. 2 steve dba 16 Jan 28 19:55 abclearn
Removing all permissions to all	[root@sys2 ~]# chmod ugo-rwx abclearn [root@sys2 ~]# ls -l abclearn ----------. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 000 abclearn [root@sys2 ~]# ls -l abclearn ----------. 2 steve dba 16 Jan 28 19:55 abclearn
Adding all permissions to all	[root@sys2 ~]# chmod ugo+rwx abclearn [root@sys2 ~]# ls -l abclearn -rwxrwxrwx. 2 steve dba 16 Jan 28 19:55 abclearn	[root@sys2 ~]# chmod 777 abclearn [root@sys2 ~]# ls -l abclearn -rwxrwxrwx. 2 steve dba 16 Jan 28 19:55 abclearn

Assigning permissions using absolute mode:

Let abclearn2 is the file on which we are going to implement the permissions.

Now my target permissions are as follows

For user rwx: read writes and execute

For group rwx: read writes and execute

For others rwx: read write and execute

• check the permissions of the file using # ls –l < file name>
• [root@sys2 ~]# ls -l abclearn
  -rwxrwxrwx. 2 root root 16 Jan 28 19:55 abclearn

The highlighted portion in the above output is the access permissions for the file.

• Now using #chmod command I am going to change/alter the permissions to the file.

1. [root@sys2 ~]# chmod 777 abclearn2
   [root@sys2 ~]# ls -l abclearn2
   -rwxrwxrwx. 1 root root 22 Jan 29 16:15 abclearn2

The target permissions are successfully applied to the file.

Note: 

changing the permissions of the file using absolute mode is less complex than the symbolic mode.

Default file permissions in Linux flavors

When the file is created in Linux the default access permissions assigned to the file are “rw-r--r--“ or 644

It means that,

For user -------read, write and no execute

For group -----read, no write and no execute

For others-----read, no write and no execute

Default directory level permissions

When the directory is created in Linux the default access permissions assigned to the file are “rwxr-xr-x “or 755.

It means,

For user-------read, write and execute

For group-----read, no write and execute

For others----read, no write and execute