File Permissions — Who May Read, Write and Run
Asha wants the whole garden club to read harvest.csv, only herself to change it, and her harvest-report script to be runnable. On Linux, every file carries a small set of switches that decide exactly this, and ls -l shows them to you.
The rule
Three people, three switches: read 4, write 2, execute 1.
$ ls -l ~/garden
-rw-r--r-- 1 asha garden 181 Jun 4 09:12 harvest.csv
-rwxr-x--- 1 asha garden 420 Jun 4 09:30 harvest-report
drwxr-x--- 2 asha garden 4096 Jun 4 09:00 plotsRead the first column in chunks: one character for the type, then three groups of three.
- rw- r-- r--
│ │ │ └── others (everyone else)
│ │ └──────── group (the file's group: garden)
│ └────────────── user (the owner: asha)
└────────────────── type: - file, d directory, l linkEach group has three switches: r (read), w (write) and x (execute), or a - if the switch is off.
For directories the letters mean something slightly different:
rlets you list the names inside.wlets you create, delete and rename entries inside.xlets you enter the directory and reach the files in it.
Changing permissions with chmod, the symbolic way (who, then +, - or =, then the letters):
$ chmod u+x harvest-report # owner may now run it
$ chmod go-w harvest.csv # group and others lose write
$ chmod o= plots # others get nothingThe number way uses one digit per group, adding read 4, write 2 and execute 1:
$ chmod 644 harvest.csv # rw- r-- r--
$ chmod 750 harvest-report # rwx r-x ---The two styles suit different jobs. Letters are best for a small change to what's already there ("also let the owner run it"). Numbers set all nine switches at once, so they're best when you know exactly what the final result should be. Note that chmod only works on files you own, unless you use sudo.
To change who owns a file, use chown, which normally needs root: sudo chown asha:garden harvest.csv.
The shortcut
To turn letters into a number, score each group of three separately: r is 4, w is 2, x is 1, and - is 0. Add them up and write the three totals side by side. To go the other way, split each digit back into 4, 2 and 1.
Split into threes
rwx,r-xand---.
The trap: removing x from a directory. The names may still be listable if r is on, but nobody without x can open any file inside. For directories, r and x almost always travel together.
Drills
Answer fast — trust the rule.
What does chmod 644 give a file?
In -rwxr-x---, what can members of the file's group do?
Which command makes harvest-report runnable by its owner, leaving everything else unchanged?
A directory is drw-r--r--. What can its owner NOT do?
What is rw-rw---- as a number?
Remember
- Three people, three switches: user, group and others each get read 4, write 2 and execute 1.
- Score each group of three on its own, then put the digits side by side (
rwxr-x---is 750). - On a directory,
xmeans "may go through". Without it, the files inside are out of reach.