Experiments

4 min read

File Permissions

Checking permissions and ownership

ls -al test.html
 
# output
-rw-r--r-- 1 eva statsusers 3325 Aug  2 09:15 test.html
  • -rw-r--r--: permission flags
  • 1: hard link count
  • 3325: size in bytes
  • Aug 2 09:15: date of last modification
  • test.html: name of file
  • ownership
    • eva: user
    • statsusers: group

Ownership

  • There are three categories of users
    • User/Owner
    • Group: collection of multiple user accounts
    • Others/Public
  • Checking permissions of a file
    • Are you a owner? If yes, apply user permissions
    • Are you member of the group? If yes, apply group permissions
    • If not matching above, apply others permissions

Permission Flags

[-] [rwx] [rwx] [rwx]

[type] [owner] [group] [others]
  • -: File Type
  • rwx: User/Owner Permissions
  • rwx: Group Permissions
  • rwx: Others Permissions
  • Standard Permissions for each group
    • r or -: readable or not
    • w or -: writable or not
    • x or -: executable or not
  • Special Permissions for each group (position for x)
    • s: executable and set-user-ID (if user permissions) or set-group-ID (if group permissions) mode is set
    • S: not executable and set-user-ID (if user permissions) or set-group-ID (if group permissions) mode is set
    • T: not executable (if other permissions) and sticky bit is set
    • t: executable (if other permissions) and sticky bit set

Octal Representation

  • For each user, group and others, we calculate octal digit
  • To convert to octal representation for whole permission list we just write them together
  • Example: -rw-rw-r-- = 664
[-] [rw-] [rw-] [r--]
      6     6     4
BinaryPermission flagsOctal digit
000---0
001--x1
010-w-2
011-wx3
100r--4
101r-x5
110rw-6
111rwx7

File Types

  • -: Ordinary File
    • r: read file
    • w: write file
    • x: run file as program
  • d: Directory
    • r: list files
    • w: create/delete files
    • x: can change to directory
  • l: Symbolic link
  • c: Character device file
  • b: Block file (HDD/SSD)
  • p: Named pipe
  • s: Domain socket
# ordinary file
> touch test.txt
> ls -al test.txt
-rw-r--r--  1 KartikeyKumar  staff  0 28 Jun 19:53 test.txt
 
# soft link
> ln -s test.txt link.txt
> ls -al link.txt
lrwxr-xr-x  1 KartikeyKumar  staff  8 28 Jun 19:54 link.txt -> test.txt
 
# directory
> mkdir p
> ls -al
drwxr-xr-x   2 KartikeyKumar  staff     64 28 Jun 19:38 p
 
# device file
> ls -al /dev/null
crw-rw-rw-  1 root  wheel  0x3000002 28 Jun 19:40 /dev/null
 
# block file
> ls -al /dev
brw-r-----   1 root           operator     0x1000000  9 Jun 13:11 disk0
 
# named pipe
> mkfifo my_pipe
> ls -al my_pipe
prw-r--r--  1 KartikeyKumar  staff  0 28 Jun 17:13 my_pipe
 
# domain socket
> ls -al ~/.rd/docker.sock
srw-------@ 1 KartikeyKumar  staff  0 28 Jun 19:49 /Users/KartikeyKumar/.rd/docker.sock

umask

  • User mask defines the default access permissions for files and directories
  • Files Baseline: 666 (Full read/write only)
  • Directories Baseline: 777 (Full read/write/execute)
> umask
022
 
> umask -S
u=rwx,g=rx,o=rx
  • Default permissions = baseline - umask
  • File: 666 - 022 = 644
    • -rw-r--r--
  • Directory: 777 - 022 = 755
    • drwxr-xr-x

chmod

  • Can use symbolic or absolute values to modify permissions
# Using symbolic values
chmod [classes][operator][modes] <file>
 
# Using octal/absolute values
chmod <permissions-in-octal> <file>
  • classes
    • u: User
    • g: Group
    • o: Others
    • a: All of the above (default if omitted)
  • operators
    • +: adds permission
    • -: removes permission
    • =: exact permission
  • modes
    • r: read
    • w: write
    • x: execute
    • X: special execute
    • s: setgid or sgid
# make file executable to all users
chmod +x test.txt
 
# make file executable for user only
chmod u+x script.sh
 
# deny write permission to group/others
chmod go-w test.txt
 
# make file readable/executable by everyone but writable by owner only
# -rwxr-xr-x
chmod 755 script.sh
chmod u=rwx,go=rx script.sh
 
# make file readable by everyone but writable by owner
# -rw-r--r--
chmod 644 file.txt
 
# only owner can read/write, zero access to everyone else
# -rw-------
chmod 600 ~/.ssh/id_rsa
 
# everyone can read/write/execute
# -rwxrwxrwx
chmod 777 public_file.txt

Extended Attributes (MacOS)

  • @ is present at the end of file permission flags
> touch notes.txt
# add red label via Finder app on this file
# list permissions
> ls -al notes.txt
-rw-r--r--@ 1 KartikeyKumar  staff  0 28 Jun 19:58 notes.txt
 
# view extended attributes
> xattr -l notes.txt
com.apple.FinderInfo:
com.apple.metadata:_kMDItemUserTags: bplist00?URed
6

Backlinks