1 00:00:00,240 --> 00:00:01,260 In this lesson, 2 00:00:01,260 --> 00:00:02,610 you're going to learn how to ensure 3 00:00:02,610 --> 00:00:04,710 that the right people have the right access 4 00:00:04,710 --> 00:00:07,320 to the right resources within Linux. 5 00:00:07,320 --> 00:00:09,420 This will ensure that no one has more access 6 00:00:09,420 --> 00:00:11,760 than is necessary for them to do their job. 7 00:00:11,760 --> 00:00:14,100 Now this is the process of configuring file 8 00:00:14,100 --> 00:00:15,390 and directory permissions, 9 00:00:15,390 --> 00:00:17,490 and that's what we're going to focus on here. 10 00:00:17,490 --> 00:00:20,130 Ideally, you'll begin restricting access to files 11 00:00:20,130 --> 00:00:22,320 and directories by applying proper permissions 12 00:00:22,320 --> 00:00:23,910 to those resources. 13 00:00:23,910 --> 00:00:25,260 Permissions or access rights, 14 00:00:25,260 --> 00:00:26,880 they're going to be assigned to users, 15 00:00:26,880 --> 00:00:28,350 which enables them to access 16 00:00:28,350 --> 00:00:31,410 or modify certain files and directories. 17 00:00:31,410 --> 00:00:32,910 It can be set at different levels 18 00:00:32,910 --> 00:00:35,640 and for different access contexts as well. 19 00:00:35,640 --> 00:00:38,130 These access rights are going to enable you to configure 20 00:00:38,130 --> 00:00:40,050 who is allowed to access an object 21 00:00:40,050 --> 00:00:42,810 and who is restricted from accessing that object. 22 00:00:42,810 --> 00:00:44,820 Controlling access through permissions mitigates 23 00:00:44,820 --> 00:00:46,890 a lot of the risk you're going to have in a system. 24 00:00:46,890 --> 00:00:48,150 And it does this by ensuring 25 00:00:48,150 --> 00:00:50,070 that users are only able to access 26 00:00:50,070 --> 00:00:51,870 what they need to get their job done 27 00:00:51,870 --> 00:00:53,490 and nothing additional. 28 00:00:53,490 --> 00:00:56,340 This is a security principle known as least privilege, 29 00:00:56,340 --> 00:00:59,160 and it is considered a best security practice. 30 00:00:59,160 --> 00:01:01,650 To see what permissions are set on a file or directory, 31 00:01:01,650 --> 00:01:03,870 you can use the ls command. 32 00:01:03,870 --> 00:01:06,690 Remember, the ls command is the list command. 33 00:01:06,690 --> 00:01:09,270 So if you type ls -l, 34 00:01:09,270 --> 00:01:11,610 this is going to give you a long list of all the files 35 00:01:11,610 --> 00:01:14,340 and directories in your current working directory. 36 00:01:14,340 --> 00:01:17,130 Each item in that list contains seven columns, 37 00:01:17,130 --> 00:01:19,800 three of which display permission information. 38 00:01:19,800 --> 00:01:21,600 Column number one is going to identify 39 00:01:21,600 --> 00:01:23,640 if the item is a file or directory, 40 00:01:23,640 --> 00:01:26,250 the user, group, and other permission assigned, 41 00:01:26,250 --> 00:01:27,870 and the access method. 42 00:01:27,870 --> 00:01:30,870 Column number two refers to the number of links there are. 43 00:01:30,870 --> 00:01:33,390 Files generally only have a link count of one. 44 00:01:33,390 --> 00:01:35,550 For directories, though, the link count is the number 45 00:01:35,550 --> 00:01:38,100 of directories underneath it plus two, 46 00:01:38,100 --> 00:01:39,510 one for the directory itself, 47 00:01:39,510 --> 00:01:40,890 which is called the dot, 48 00:01:40,890 --> 00:01:42,330 and one for the parent directory, 49 00:01:42,330 --> 00:01:44,340 which is known as the dot-dot. 50 00:01:44,340 --> 00:01:46,320 Links are similar to Windows shortcuts, 51 00:01:46,320 --> 00:01:48,600 and they point to the location where files exist 52 00:01:48,600 --> 00:01:51,270 and enable you to access and view the files. 53 00:01:51,270 --> 00:01:53,130 Column number three displays the owner 54 00:01:53,130 --> 00:01:54,600 of the file or directory. 55 00:01:54,600 --> 00:01:56,400 Column number four displays the group 56 00:01:56,400 --> 00:01:58,890 that has been granted access by the administrator. 57 00:01:58,890 --> 00:02:01,860 Column number five lists the size in bites 58 00:02:01,860 --> 00:02:03,690 of the file or directory. 59 00:02:03,690 --> 00:02:06,000 Column number six displays the date and time 60 00:02:06,000 --> 00:02:08,610 that the file was created or last modified. 61 00:02:08,610 --> 00:02:12,330 And column number seven displays the file or directory name. 62 00:02:12,330 --> 00:02:13,890 Permission attributes will define 63 00:02:13,890 --> 00:02:15,870 exactly what a user is allowed to do 64 00:02:15,870 --> 00:02:18,000 with a particular file or directory. 65 00:02:18,000 --> 00:02:20,010 These attributes behave differently based 66 00:02:20,010 --> 00:02:22,680 on whether they apply to a file or a directory. 67 00:02:22,680 --> 00:02:26,340 For files, the read permission known as r is going to enable 68 00:02:26,340 --> 00:02:29,400 the user to access and view the contents of the file. 69 00:02:29,400 --> 00:02:32,520 The write permission or w is going to enable the user 70 00:02:32,520 --> 00:02:34,380 to save changes to a file. 71 00:02:34,380 --> 00:02:37,440 And the execute permission known as x is going to enable 72 00:02:37,440 --> 00:02:41,160 the user to run a script, a program, or other software file. 73 00:02:41,160 --> 00:02:43,440 Now if we're dealing with directories on the other hand, 74 00:02:43,440 --> 00:02:45,180 the read permission, r, 75 00:02:45,180 --> 00:02:47,400 is going to enable the user to list the contents 76 00:02:47,400 --> 00:02:48,600 of that directory. 77 00:02:48,600 --> 00:02:50,550 The write permission, w, 78 00:02:50,550 --> 00:02:52,440 is going to enable the user to create, 79 00:02:52,440 --> 00:02:55,470 rename, or delete files within that directory. 80 00:02:55,470 --> 00:02:58,800 And the execute or x permission is going to enable the user 81 00:02:58,800 --> 00:03:02,100 to access a directory and execute a file from that directory 82 00:03:02,100 --> 00:03:05,400 or perform a task on that directory itself. 83 00:03:05,400 --> 00:03:07,740 Permission attributes on files and folders are applied 84 00:03:07,740 --> 00:03:09,690 to one of several contexts 85 00:03:09,690 --> 00:03:12,090 or the different types of users and entities 86 00:03:12,090 --> 00:03:13,950 that you're going to give permission to. 87 00:03:13,950 --> 00:03:17,010 These contexts are the owner, known as u, 88 00:03:17,010 --> 00:03:18,660 the group, known as g, 89 00:03:18,660 --> 00:03:20,700 and other, known as o. 90 00:03:20,700 --> 00:03:24,360 The owner or u refers to the owner of the file or directory. 91 00:03:24,360 --> 00:03:26,250 This is also referred to as the user, 92 00:03:26,250 --> 00:03:28,230 which is why it's known as u. 93 00:03:28,230 --> 00:03:30,540 Now, these people are not going to impact the actions 94 00:03:30,540 --> 00:03:31,770 of any other users, 95 00:03:31,770 --> 00:03:34,410 they can only do things that affect themself. 96 00:03:34,410 --> 00:03:36,390 When we move into g or the group, 97 00:03:36,390 --> 00:03:38,670 this refers to the file or directories group, 98 00:03:38,670 --> 00:03:40,050 and all the users who belong 99 00:03:40,050 --> 00:03:42,540 to that group can have those permissions. 100 00:03:42,540 --> 00:03:44,460 When we talk about o or other, 101 00:03:44,460 --> 00:03:46,860 this refers to other users on the system, 102 00:03:46,860 --> 00:03:48,990 and these are users who are not the owner, 103 00:03:48,990 --> 00:03:50,910 and they're not a group member. 104 00:03:50,910 --> 00:03:52,410 This is essentially the permission group 105 00:03:52,410 --> 00:03:53,970 that you need to watch the most 106 00:03:53,970 --> 00:03:55,050 when you're giving permissions 107 00:03:55,050 --> 00:03:57,210 and controlling least privilege. 108 00:03:57,210 --> 00:03:59,970 Now the output of the ls -l command will show 109 00:03:59,970 --> 00:04:02,310 the permission string for a file or directory 110 00:04:02,310 --> 00:04:04,290 as you see the list of files. 111 00:04:04,290 --> 00:04:05,340 Now the permission string 112 00:04:05,340 --> 00:04:07,710 here is going to contain 11 characters. 113 00:04:07,710 --> 00:04:10,620 The first character indicates the type of file. 114 00:04:10,620 --> 00:04:14,790 It has d for directory or a hyphen or dash for file. 115 00:04:14,790 --> 00:04:16,170 Characters at the second, third, 116 00:04:16,170 --> 00:04:18,029 and fourth positions are going to denote 117 00:04:18,029 --> 00:04:19,589 the owner's permissions. 118 00:04:19,589 --> 00:04:22,200 The characters at the fifth, sixth, and seventh positions, 119 00:04:22,200 --> 00:04:24,450 they're going to denote your group permissions. 120 00:04:24,450 --> 00:04:25,980 The characters at the eighth, ninth, 121 00:04:25,980 --> 00:04:28,050 and 10th positions are going to denote 122 00:04:28,050 --> 00:04:29,700 the other permissions. 123 00:04:29,700 --> 00:04:32,010 The final character, that 11th position, 124 00:04:32,010 --> 00:04:34,980 is going to indicate the access method for the file. 125 00:04:34,980 --> 00:04:36,390 If you see a period, 126 00:04:36,390 --> 00:04:38,580 that's going to say there's a security context 127 00:04:38,580 --> 00:04:40,530 and a plus for any other combination 128 00:04:40,530 --> 00:04:42,810 of alternative access methods. 129 00:04:42,810 --> 00:04:46,110 The chmod command also can be used to enable you to modify 130 00:04:46,110 --> 00:04:48,570 the permissions of a file or directory. 131 00:04:48,570 --> 00:04:50,520 Only the owner of the file or directory 132 00:04:50,520 --> 00:04:53,190 or the system administrator, who is the root user, 133 00:04:53,190 --> 00:04:55,620 can change the permissions of that object. 134 00:04:55,620 --> 00:04:56,550 The proper way to enter 135 00:04:56,550 --> 00:04:59,220 the chmod command is by typing chmod, 136 00:04:59,220 --> 00:05:01,110 your options, and then your mode, 137 00:05:01,110 --> 00:05:03,690 and then your file and directory name. 138 00:05:03,690 --> 00:05:05,970 The chmod command supports different options 139 00:05:05,970 --> 00:05:09,090 to modify permissions, which can be used at any time. 140 00:05:09,090 --> 00:05:10,980 If you use the -c option, 141 00:05:10,980 --> 00:05:12,540 you're going to be able to report changes 142 00:05:12,540 --> 00:05:14,130 that are made in permissions. 143 00:05:14,130 --> 00:05:15,990 If you use the -f option, 144 00:05:15,990 --> 00:05:17,850 you can hide most of the error messages 145 00:05:17,850 --> 00:05:21,210 that may be generated when you're using the chmod command. 146 00:05:21,210 --> 00:05:23,100 If you use the -v option, 147 00:05:23,100 --> 00:05:25,440 this is going to display diagnostic information 148 00:05:25,440 --> 00:05:27,630 for every file process. 149 00:05:27,630 --> 00:05:30,510 If you use the -r option, the permission of files 150 00:05:30,510 --> 00:05:32,760 and directories will be modified recursively, 151 00:05:32,760 --> 00:05:34,380 which means it's going to go downward 152 00:05:34,380 --> 00:05:37,530 in the directory structure all the way to the bottom. 153 00:05:37,530 --> 00:05:40,440 The chmod command does support two different modes. 154 00:05:40,440 --> 00:05:43,290 We have a symbolic mode and an absolute mode. 155 00:05:43,290 --> 00:05:44,670 Symbolic mode enables you 156 00:05:44,670 --> 00:05:46,740 to set permissions using three components, 157 00:05:46,740 --> 00:05:48,780 which includes permission context. 158 00:05:48,780 --> 00:05:52,680 This can be you u, g, o, or a. 159 00:05:52,680 --> 00:05:55,740 Now u is user, g is group, o is other, 160 00:05:55,740 --> 00:05:58,650 and a applies to permissions to all three context, 161 00:05:58,650 --> 00:06:00,990 the user, the group, and the others. 162 00:06:00,990 --> 00:06:02,910 You can also have the permission operators, 163 00:06:02,910 --> 00:06:04,830 plus, minus, and equal, 164 00:06:04,830 --> 00:06:08,610 and you can have the permission attributes of r, w, and, x 165 00:06:08,610 --> 00:06:11,160 or read, write, and execute. 166 00:06:11,160 --> 00:06:13,170 Permission operators are going to be used to determine 167 00:06:13,170 --> 00:06:15,600 whether permission is granted or removed. 168 00:06:15,600 --> 00:06:18,450 If you're using a plus sign, this grants permissions. 169 00:06:18,450 --> 00:06:19,980 If you're using a minus sign, 170 00:06:19,980 --> 00:06:21,690 this is going to deny permissions. 171 00:06:21,690 --> 00:06:23,190 And if you use the equal sign, 172 00:06:23,190 --> 00:06:26,070 it's going to assign the permissions exactly as provided 173 00:06:26,070 --> 00:06:27,390 instead of doing an addition 174 00:06:27,390 --> 00:06:29,790 or a subtraction of permission levels. 175 00:06:29,790 --> 00:06:32,580 In symbolic mode, you can use the chmod command 176 00:06:32,580 --> 00:06:35,430 by entering chmod, the access context, 177 00:06:35,430 --> 00:06:37,710 the operators, the permission attributes, 178 00:06:37,710 --> 00:06:39,930 and the file or directory name. 179 00:06:39,930 --> 00:06:43,080 The other way to use chmod is using absolute mode. 180 00:06:43,080 --> 00:06:45,750 And this is going to use octal or base-8 numbers 181 00:06:45,750 --> 00:06:47,640 to specify your permissions. 182 00:06:47,640 --> 00:06:49,920 Each permission, read, write, and execute, 183 00:06:49,920 --> 00:06:51,630 has been associated a number, 184 00:06:51,630 --> 00:06:54,540 and we add those up to tell us what the permission is. 185 00:06:54,540 --> 00:06:56,580 So if you have an octal number that has four, 186 00:06:56,580 --> 00:06:57,660 that means read, 187 00:06:57,660 --> 00:06:59,520 if you have two, that means write, 188 00:06:59,520 --> 00:07:01,920 if you have one, that means execute. 189 00:07:01,920 --> 00:07:04,290 But if we add those octal numbers together, 190 00:07:04,290 --> 00:07:05,670 we can get different permissions 191 00:07:05,670 --> 00:07:07,440 and set them with a single number. 192 00:07:07,440 --> 00:07:09,330 This will give you the overall permission number 193 00:07:09,330 --> 00:07:11,460 to assign to a directory or file. 194 00:07:11,460 --> 00:07:13,890 For example, if I want to have full permissions 195 00:07:13,890 --> 00:07:16,380 so I can read, write, and execute, 196 00:07:16,380 --> 00:07:18,000 that's going to be in number seven 197 00:07:18,000 --> 00:07:21,810 because four plus two plus one equals seven. 198 00:07:21,810 --> 00:07:24,630 When I have the read and write permissions but not execute, 199 00:07:24,630 --> 00:07:28,680 this will be six because four plus two equals six. 200 00:07:28,680 --> 00:07:31,800 Complete permissions are expressed as a three-digit number 201 00:07:31,800 --> 00:07:34,710 where each digit is going to correspond to either the owner, 202 00:07:34,710 --> 00:07:36,840 the group, or the others. 203 00:07:36,840 --> 00:07:37,920 In absolute mode, 204 00:07:37,920 --> 00:07:41,100 the proper way to enter your command is by entering chmod, 205 00:07:41,100 --> 00:07:43,950 the number, and the file or directory name. 206 00:07:43,950 --> 00:07:45,240 Now it's really important to know 207 00:07:45,240 --> 00:07:47,310 how to use octal numbers for permissions 208 00:07:47,310 --> 00:07:49,770 because this is commonly tested on the exam 209 00:07:49,770 --> 00:07:51,690 and one that you're going to find yourself using a lot 210 00:07:51,690 --> 00:07:53,280 in the real world too. 211 00:07:53,280 --> 00:07:54,360 So for example, 212 00:07:54,360 --> 00:07:56,940 if I asked you what permissions were assigned to a file 213 00:07:56,940 --> 00:07:59,760 that has 752 as its permissions, 214 00:07:59,760 --> 00:08:01,890 you need to be able to tell me what the seven 215 00:08:01,890 --> 00:08:03,210 in the user position means, 216 00:08:03,210 --> 00:08:04,980 the five in the group permission, 217 00:08:04,980 --> 00:08:07,350 and the two in the other position means. 218 00:08:07,350 --> 00:08:08,820 So if we're going to look at that, 219 00:08:08,820 --> 00:08:10,860 we will say the first position is the users. 220 00:08:10,860 --> 00:08:13,590 And that had a 7 because it was 752. 221 00:08:13,590 --> 00:08:16,230 That seven breaks down to being read, 222 00:08:16,230 --> 00:08:18,090 write, and execute permissions. 223 00:08:18,090 --> 00:08:20,610 So the user who's assigned to this file has read, 224 00:08:20,610 --> 00:08:22,317 write, and execute permissions. 225 00:08:22,317 --> 00:08:24,000 Now if we move to the second position, 226 00:08:24,000 --> 00:08:25,140 we look at the group. 227 00:08:25,140 --> 00:08:27,930 This was a 5 'cause we had 752. 228 00:08:27,930 --> 00:08:29,070 So when we look at the five, 229 00:08:29,070 --> 00:08:31,590 that means it has read and execute permissions, 230 00:08:31,590 --> 00:08:33,690 four for read, one for execute, 231 00:08:33,690 --> 00:08:35,700 and you add those together to get five. 232 00:08:35,700 --> 00:08:37,320 Now when we get to the third position, 233 00:08:37,320 --> 00:08:39,900 we have a 2 from 752. 234 00:08:39,900 --> 00:08:41,100 What does the two mean? 235 00:08:41,100 --> 00:08:43,049 Well, we know read is four, 236 00:08:43,049 --> 00:08:45,030 write is two, and one is execute. 237 00:08:45,030 --> 00:08:46,500 So if we only see a two there, 238 00:08:46,500 --> 00:08:49,380 that means the other group has the write permissions, 239 00:08:49,380 --> 00:08:50,670 but they can't read the file, 240 00:08:50,670 --> 00:08:52,740 and they can't execute the file. 241 00:08:52,740 --> 00:08:54,810 So it would be completely fair 242 00:08:54,810 --> 00:08:56,587 for them to give you a question that says, 243 00:08:56,587 --> 00:08:59,280 "You have an octal assignment of 541, 244 00:08:59,280 --> 00:09:01,470 what level of permission does the group assigned 245 00:09:01,470 --> 00:09:02,610 to this file have?" 246 00:09:02,610 --> 00:09:04,470 And then you need to figure that out. 247 00:09:04,470 --> 00:09:07,560 So we would say, "Okay, five means we have a four plus a one 248 00:09:07,560 --> 00:09:08,550 to give us five." 249 00:09:08,550 --> 00:09:11,220 That is read and execute permissions. 250 00:09:11,220 --> 00:09:13,410 Four is going to be for read only, 251 00:09:13,410 --> 00:09:15,180 so the group has read only. 252 00:09:15,180 --> 00:09:17,010 And one, that's going to be execute only, 253 00:09:17,010 --> 00:09:18,960 so others can execute only. 254 00:09:18,960 --> 00:09:21,150 If you can work out problems like this on the exam, 255 00:09:21,150 --> 00:09:23,850 you're going to do fine on permission-related questions. 256 00:09:23,850 --> 00:09:25,800 The last thing I need to mention in terms of file 257 00:09:25,800 --> 00:09:28,650 and directory permissions is the umask command. 258 00:09:28,650 --> 00:09:31,080 The umask command is used to set the default permissions 259 00:09:31,080 --> 00:09:33,420 for newly created files and folders. 260 00:09:33,420 --> 00:09:34,980 This is called the umask command 261 00:09:34,980 --> 00:09:37,050 because it's setting up the user defined permissions 262 00:09:37,050 --> 00:09:39,330 for those new files and directories. 263 00:09:39,330 --> 00:09:41,610 If you enter umask -S, 264 00:09:41,610 --> 00:09:44,640 this will display the current mask as a symbolic value. 265 00:09:44,640 --> 00:09:46,590 If you enter umask -p, 266 00:09:46,590 --> 00:09:49,650 this will display the current mask in numerical format. 267 00:09:49,650 --> 00:09:51,900 Now to set the umask for a file or directory, 268 00:09:51,900 --> 00:09:54,870 simply enter umask and the mask you want to assign, 269 00:09:54,870 --> 00:09:57,930 which is the numeric value of the mask you want to apply. 270 00:09:57,930 --> 00:10:00,397 Keep in mind, though, the difference between umask 271 00:10:00,397 --> 00:10:02,340 and chmod is that umask is used 272 00:10:02,340 --> 00:10:03,780 to change the default permissions 273 00:10:03,780 --> 00:10:06,180 for all newly created files and folders, 274 00:10:06,180 --> 00:10:08,880 whereas chmod is used to set permissions on files 275 00:10:08,880 --> 00:10:10,683 and folders that already exist.