Instructor: File system permissions. 2 2
In this lesson, we're going to explore file system permissions 3 3
both in Windows and Linux. 4 4
Now, when you deal with file system permissions, 5 5
incorrect permissions that can be allocated 6 6
to a resource can be the cause 7 7
of many of your data breaches. 8 8
For example, if I have a web server 9 9
and a particular folder 10 10
is not supposed to be publicly visible, 11 11
but somebody incorrectly sets up permission 12 12
and makes it publicly visible, 13 13
everyone in the world can see that information. 14 14
And so incorrect permissions are a big source 15 15
of pain for us. 16 16
Now, as I said, 17 17
we are going to cover two different types of permission sets. 18 18
We're going to talk about Windows permissions 19 19
and Linux permissions 'cause they are different 20 20
on those different operating systems. 21 21
Now, inside of Windows, we're going to use the icacls tool. 22 22
Now this is a command-line tool 23 23
for showing and modifying file permissions. 24 24
When you look at this, 25 25
you're going to be able to see permissions 26 26
in different categories such as N for no access, 27 27
F for full access, R for read-only, RX for read and execute, 28 28
M for modify, W for write, and D for delete. 29 29
These are all the different permissions 30 30
that you can have inside of Windows 31 31
on a particular file or directory. 32 32
Now when you're using icacls, 33 33
you can use it by actually adding 34 34
individual permissions themself, 35 35
or you can use a comma separated list of permissions 36 36
that's used for more complex permission types. 37 37
Most of you should be familiar 38 38
with Windows file system permissions 39 39
because this was covered all the way back 40 40
in your A+ studies. 41 41
If you're not familiar with this concept, 42 42
grab a Windows machine, go into it, 43 43
right click on a file or folder 44 44
and play around with the permissions 45 45
just to get comfortable with it. 46 46
Next, we need to talk about Linux, 47 47
and Linux, we're going to cover in a little bit more depth 48 48
because if it's been a while since you've done your A+, 49 49
Linux wasn't covered that frequently. 50 50
If you were on the 801 or the 901 version of A+, 51 51
they didn't really go into Linux at all 52 52
and they left that for Linux+. 53 53
Now, in the newer versions of A+, 54 54
they do cover Linux permissions, 55 55
but because I have a lot of students 56 56
who didn't go through that version of the course, 57 57
I am going to cover Linux in a little bit more detail. 58 58
Now, everything inside of Linux is treated as a file. 59 59
It doesn't matter if it's a file, a directory, memory space, 60 60
or even the processor or an input/output device. 61 61
Everything in Linux is treated like a file. 62 62
So permissions are really important. 63 63
Now, in Linux, there are three permissions: 64 64
read, write, and execute. 65 65
And this is symbolized by r, w, and x. 66 66
Now, when we talk about read permissions, 67 67
this is the ability to access 68 68
and view the contents of a file 69 69
or list the contents of a directory. 70 70
Essentially, you want to be able to look at it, 71 71
you want to be able to read it. 72 72
Now, when you deal with writing, 73 73
you're going to be dealing with the ability 74 74
to save changes to a file. So you want to be able to write it, 75 75
or you want to be able to create a file or rename a file 76 76
or delete files within a different directory. 77 77
All of this can be done if you have the write permission. 78 78
Now, if you want to be able to delete something, 79 79
you need permissions of both write and execute. 80 80
Now, when we talk about execute, 81 81
this is the ability to run a script, a program, 82 82
or other software file, 83 83
or it's the ability to access a directory, 84 84
execute a file from that directory, 85 85
or perform a task on that directory. 86 86
Basically, you want to do something. 87 87
That's what execute is all about. 88 88
Now, this sounds like it's pretty easy, right? 89 89
There's only three permissions 90 90
where Windows had a whole bunch more. 91 91
Well, it gets a little bit more complicated though, 92 92
because when you look at the permissions for a file, 93 93
such as here, you're going to see that it looks like this. 94 94
You're going to have a dash at the beginning, 95 95
and this means it's a file. 96 96
If it was a directory, that dash would be a D for directory. 97 97
Then we have three sets of permissions. 98 98
Here you can see read, write, execute, 99 99
read, dash, execute, read, dash, execute. 100 100
Those are three sets. 101 101
Now, as you start understanding this, 102 102
why are there three sets? 103 103
Well, this is because the first set represents the owner. 104 104
The second set represents the group, 105 105
and the third represents others or world. 106 106
Let's talk about that for a second. 107 107
When we talk about an owner's permission, 108 108
these are the permissions 109 109
that determine what the file owner can do with that file. 110 110
So if I created a file and I own that file, 111 111
I can do these things. 112 112
Then I have group permissions, that's the second set. 113 113
These permissions determine what members 114 114
of the file's group who are not the owner 115 115
can actually do with that file. 116 116
And then we have the third one, 117 117
which is world or other, which is everybody else. 118 118
They're not the owner, they're not the group, 119 119
they're just somebody on the system. 120 120
And these are permissions 121 121
that determine what users who are not the file's owner 122 122
or members of the group can do with that file. 123 123
So we have these three basic sets. 124 124
So again, when I look at this and I look at it, 125 125
I can see that the user has the ability 126 126
to read, write, and execute. 127 127
They can pretty much do whatever they want to that file, 128 128
but group members can only read it and execute it, 129 129
but they can't write to it. 130 130
And if they're another user on the system 131 131
or that world group, they can again read and execute it, 132 132
but they can't write to it. 133 133
This might be a good set of permissions for something 134 134
like a file on your website or a script 135 135
because there's other people who need to be able to read it 136 136
and execute that script, 137 137
but they shouldn't be able to write it or delete it. 138 138
Only you, the original author, 139 139
should have those permissions. 140 140
Now I know we just covered the basics of Linux permissions 141 141
talking about the three groups in the read, write, execute, 142 142
but Linux permissions get even more confusing 143 143
because people also will abbreviate them 144 144
using numbers instead of the r, the w, and the x. 145 145
So when you look at it, an r is a four, 146 146
a w is a two, and an x is a one. 147 147
And this chart here will help you with that. 148 148
So for example, if I have read, write, execute, 149 149
like the user did in my previous example, 150 150
this is symbolized by seven 151 151
because read plus write plus execute equals seven. 152 152
Now if I wanted to see what the other two groups had, 153 153
they had read and execute only, right? 154 154
What would that equal? 155 155
That's right, it would equal five 156 156
because read is four, execute is one, 157 157
four plus one equals five, and that gives us the five. 158 158
So the easiest way to write this, 159 159
instead of writing read, write, execute, 160 160
read, dash, execute, read, dash, execute, 161 161
I could simply say this has the permissions of 755, 162 162
which tells me the exact same thing. 163 163
This is the way that we can understand 164 164
Linux permission systems 165 165
by breaking down those numbers 166 166
based on read, write, and execute. 167 167
So let's go through and do a couple of examples together. 168 168
Now if I have read, write, execute, read, write, execute, 169 169
read, write, execute, what would that be represented 170 170
using three digits? 171 171
That would be 777 because read, write, and execute 172 172
is four plus two plus one, which gives you seven. 173 173
And we had that three times, so 777. 174 174
This means we have read, write, execute 175 175
for the owner, the group, 176 176
and every other user on the system. 177 177
Now what if we had read, write, execute, 178 178
read, dash, execute, dash, dash, dash? 179 179
What would that be? 180 180
Well, read, write, execute would be a seven. 181 181
Read, dash, execute would be a five. 182 182
And then dash, dash, dash would be zero 183 183
because there are no permissions. 184 184
So this says we have read, write, and execute 185 185
for the owner of the file. 186 186
We have read and execute for the group 187 187
and no permissions for anybody 188 188
who's not the owner and not the group. 189 189
Let's take a look at the next one. 190 190
We have read, write, dash, read, dash, dash, 191 191
read, dash, dash. 192 192
What would this be? 193 193
Well, read, write, dash would be a six. 194 194
And then we have read, dash, dash would be a four. 195 195
And then read, dash, dash would be a four, 196 196
so it becomes 644. 197 197
This gives me read and write permissions for the owner 198 198
and then read permissions 199 199
for both the group and everybody else on the system. 200 200
And the final one we're going to look at: 201 201
read, dash, dash, dash, dash, dash, dash, dash, dash. 202 202
What would this one be? 203 203
This one should be pretty easy. 204 204
It only has the one read, which is worth four. 205 205
So it's 400. 206 206
This means the owner can read it and nobody else, 207 207
not the group and not the world can do anything with it. 208 208
This is a very well protected file. 209 209
So this is the way we can read these permissions. 210 210
Now if you want to be able to modify permissions using Linux, 211 211
you're going to use the command chmod, change mod. 212 212
Now this is a Linux command 213 213
that's used to modify permissions for files. 214 214
So if I want to modify them, 215 215
I can do this by using the letters 216 216
and I can do change mod g plus x, comma, o minus r, 217 217
and then the file or folder that I want to do it on, 218 218
in this case home. 219 219
What this says is that for the group, 220 220
I want to add the execute permission, 221 221
but for the other or world permission, 222 222
I want to remove the reading ability. 223 223
And so that would be adding some permissions 224 224
and taking some away all at the same time. 225 225
Now I can do this again. 226 226
Let's say I wanted to do change mod 227 227
and I wanted to say 228 228
user equals rwx, comma, g equals rw, 229 229
comma, o equals rx home. 230 230
What is this saying? 231 231
Well, this is being more explicit in what I want. 232 232
Instead of adding or removing things one at a time, 233 233
I'm saying just override all the permissions 234 234
with this set of conditions. 235 235
So the user is going to read, write, and execute. 236 236
That's a seven. 237 237
The group is going to read and write, that's a four. 238 238
And then the others or world is going to read and execute, 239 239
that's a five. 240 240
So what this is saying is that for the user, 241 241
the owner of this, we are going to read, write, and execute, 242 242
which is equivalent to a seven. 243 243
The group is going to have read and write, 244 244
which is the equivalent of a six, 245 245
and then we're going to have the other 246 246
or the world permissions reading and executing, 247 247
which would be the equivalent of a five. 248 248
And so by writing out all these letters, 249 249
essentially, I said I wanted to do 765. 250 250
Now wouldn't it be easier if I could just use those numbers? 251 251
Well, it would and the nice thing is change mod 252 252
will let you. 253 253
You can just type in something like change mod 755 home 254 254
and this is going to change the permissions 255 255
of the home directory into 755, 256 256
which is read, write, execute for the owner, 257 257
and read and execute for everybody else in the system, 258 258
including the group and the world. 259 259
So this is a nice easy way to do things 260 260
and this is why people use the numbers 261 261
inside of Linux so much. 262 262
Now the final thing we need to talk about 263 263
is ownership of the file. 264 264
Now I said that the owner has that first set of permissions. 265 265
Well, what if you want to change the owner? 266 266
That's where change own comes into play, C-H-O-W-N. 267 267
This is change owner, essentially. 268 268
This is a Linux command 269 269
that is used to modify the owner of a file. 270 270
And so you basically would type in change own, 271 271
the person you want to change, and then the file name. 272 272
And so if I wanted to change the owner of the home to Jason, 273 273
I would say change own Jason home. 274 274
It's the command, the user of the group, 275 275
and then the file you want to change it to.