• View
• Edit
• History
• Print

Permissions

Overview

Linux has per-file (and per-directory) permissions that determine who is allowed to see, edit, and that file. There is only one user (root or the super-user) that can see, modify, and edit all files. Everyone else has to abide by these rules. This page will help you manage and understand permissions without driving you crazy.

The Minimum You Need to Know to Do What you Want and Love Linux

There are three categories for a file's permissions : the owner (the user that created/installed/owns the file), the group (an arbitrary group of users, defined by the administrator), and everyone. Each category has three types of permissions : read (the ability to see what's in the file), write (the ability to edit or re-write the file), and execute (the ability to run the file, if it can be run). You can view the file's owner, group, permissions by using the @ ls -l @ command, like so :

 drwxr-xr-x 3  kevin gsc 4096 2009-02-18 11:24 Desktop/
 -rwxr-xr-x 1  kevin gsc  2057 2009-02-13 19:50 diff_resolver*
 -rw-r----- 1  kevin gsc  119808 2009-02-11 21:37 walden.doc

1. User and Group. the kevin gsc portion shows the owner and group-owner. If you're the only one on your linux machine, it might say kevin kevin because it gives you your own group. All that does it make it confusing, but it is how it is done.
2. Permissions. The stuff (-rwxr-xr-x) in the beginning tells you the permissions for everyone. Here we go, piece by piece:
   1. The first character, d or -, indicates the 'special tag'. The d stands for directory. Anything else that you may run across just means really special.
   2. The next three characters are the user permissions. You can see both the directory and the file are rwx, which indicates that the owner (kevin) is allowed to read, write, and execute both the Desktop directory and the diff_resolver program.
   3. For walden.doc, the rw- indicate that kevin can read or write it, but he can't execute it. This is because, quite honestly, you can't run a .doc file. It's not a program!!!
   4. The next three characters are the group permissions. You can see that, for Desktop and diff_resolver, they have r-x permission, which allows them to read and execute them, but they can't write them. This means they can run the program and see what's in the directory (execute permissions on a directory allows one to ls that directory), but they can't change them. The r-- group permissions for walden.doc allows the group to read the file. Once again, it's not a program, and so allowing execute permission would be weird and meaningless.
   5. The next three are the permissions for everyone that isn't in that group. That includes anonymous ftp clients, guest accounts, and probably your ex-(girl/boy)friend. You see that the Desktop and the diff_resolver items allow your ex- to see and execute these. walden.doc, which has the last three characters - doesn't give any permissions to your ex-, which is probably smart.