In this lesson,
you're going to learn how to ensure
that the right people have the right access
to the right resources within Linux.
This will ensure that no one has more access
than is necessary for them to do their job.
Now this is the process of configuring file
and directory permissions,
and that's what we're going to focus on here.
Ideally, you'll begin restricting access to files
and directories by applying proper permissions
to those resources.
Permissions or access rights,
they're going to be assigned to users,
which enables them to access
or modify certain files and directories.
It can be set at different levels
and for different access contexts as well.
These access rights are going to enable you to configure
who is allowed to access an object
and who is restricted from accessing that object.
Controlling access through permissions mitigates
a lot of the risk you're going to have in a system.
And it does this by ensuring
that users are only able to access
what they need to get their job done
and nothing additional.
This is a security principle known as least privilege,
and it is considered a best security practice.
To see what permissions are set on a file or directory,
you can use the ls command.
Remember, the ls command is the list command.
So if you type ls -l,
this is going to give you a long list of all the files
and directories in your current working directory.
Each item in that list contains seven columns,
three of which display permission information.
Column number one is going to identify
if the item is a file or directory,
the user, group, and other permission assigned,
and the access method.
Column number two refers to the number of links there are.
Files generally only have a link count of one.
For directories, though, the link count is the number
of directories underneath it plus two,
one for the directory itself,
which is called the dot,
and one for the parent directory,
which is known as the dot-dot.
Links are similar to Windows shortcuts,
and they point to the location where files exist
and enable you to access and view the files.
Column number three displays the owner
of the file or directory.
Column number four displays the group
that has been granted access by the administrator.
Column number five lists the size in bites
of the file or directory.
Column number six displays the date and time
that the file was created or last modified.
And column number seven displays the file or directory name.
Permission attributes will define
exactly what a user is allowed to do
with a particular file or directory.
These attributes behave differently based
on whether they apply to a file or a directory.
For files, the read permission known as r is going to enable
the user to access and view the contents of the file.
The write permission or w is going to enable the user
to save changes to a file.
And the execute permission known as x is going to enable
the user to run a script, a program, or other software file.
Now if we're dealing with directories on the other hand,
the read permission, r,
is going to enable the user to list the contents
of that directory.
The write permission, w,
is going to enable the user to create,
rename, or delete files within that directory.
And the execute or x permission is going to enable the user
to access a directory and execute a file from that directory
or perform a task on that directory itself.
Permission attributes on files and folders are applied
to one of several contexts
or the different types of users and entities
that you're going to give permission to.
These contexts are the owner, known as u,
the group, known as g,
and other, known as o.
The owner or u refers to the owner of the file or directory.
This is also referred to as the user,
which is why it's known as u.
Now, these people are not going to impact the actions
of any other users,
they can only do things that affect themself.
When we move into g or the group,
this refers to the file or directories group,
and all the users who belong
to that group can have those permissions.
When we talk about o or other,
this refers to other users on the system,
and these are users who are not the owner,
and they're not a group member.
This is essentially the permission group
that you need to watch the most
when you're giving permissions
and controlling least privilege.
Now the output of the ls -l command will show
the permission string for a file or directory
as you see the list of files.
Now the permission string
here is going to contain 11 characters.
The first character indicates the type of file.
It has d for directory or a hyphen or dash for file.
Characters at the second, third,
and fourth positions are going to denote
the owner's permissions.
The characters at the fifth, sixth, and seventh positions,
they're going to denote your group permissions.
The characters at the eighth, ninth,
and 10th positions are going to denote
the other permissions.
The final character, that 11th position,
is going to indicate the access method for the file.
If you see a period,
that's going to say there's a security context
and a plus for any other combination
of alternative access methods.
The chmod command also can be used to enable you to modify
the permissions of a file or directory.
Only the owner of the file or directory
or the system administrator, who is the root user,
can change the permissions of that object.
The proper way to enter
the chmod command is by typing chmod,
your options, and then your mode,
and then your file and directory name.
The chmod command supports different options
to modify permissions, which can be used at any time.
If you use the -c option,
you're going to be able to report changes
that are made in permissions.
If you use the -f option,
you can hide most of the error messages
that may be generated when you're using the chmod command.
If you use the -v option,
this is going to display diagnostic information
for every file process.
If you use the -r option, the permission of files
and directories will be modified recursively,
which means it's going to go downward
in the directory structure all the way to the bottom.
The chmod command does support two different modes.
We have a symbolic mode and an absolute mode.
Symbolic mode enables you
to set permissions using three components,
which includes permission context.
This can be you u, g, o, or a.
Now u is user, g is group, o is other,
and a applies to permissions to all three context,
the user, the group, and the others.
You can also have the permission operators,
plus, minus, and equal,
and you can have the permission attributes of r, w, and, x
or read, write, and execute.
Permission operators are going to be used to determine
whether permission is granted or removed.
If you're using a plus sign, this grants permissions.
If you're using a minus sign,
this is going to deny permissions.
And if you use the equal sign,
it's going to assign the permissions exactly as provided
instead of doing an addition
or a subtraction of permission levels.
In symbolic mode, you can use the chmod command
by entering chmod, the access context,
the operators, the permission attributes,
and the file or directory name.
The other way to use chmod is using absolute mode.
And this is going to use octal or base-8 numbers
to specify your permissions.
Each permission, read, write, and execute,
has been associated a number,
and we add those up to tell us what the permission is.
So if you have an octal number that has four,
that means read,
if you have two, that means write,
if you have one, that means execute.
But if we add those octal numbers together,
we can get different permissions
and set them with a single number.
This will give you the overall permission number
to assign to a directory or file.
For example, if I want to have full permissions
so I can read, write, and execute,
that's going to be in number seven
because four plus two plus one equals seven.
When I have the read and write permissions but not execute,
this will be six because four plus two equals six.
Complete permissions are expressed as a three-digit number
where each digit is going to correspond to either the owner,
the group, or the others.
In absolute mode,
the proper way to enter your command is by entering chmod,
the number, and the file or directory name.
Now it's really important to know
how to use octal numbers for permissions
because this is commonly tested on the exam
and one that you're going to find yourself using a lot
in the real world too.
So for example,
if I asked you what permissions were assigned to a file
that has 752 as its permissions,
you need to be able to tell me what the seven
in the user position means,
the five in the group permission,
and the two in the other position means.
So if we're going to look at that,
we will say the first position is the users.
And that had a 7 because it was 752.
That seven breaks down to being read,
write, and execute permissions.
So the user who's assigned to this file has read,
write, and execute permissions.
Now if we move to the second position,
we look at the group.
This was a 5 'cause we had 752.
So when we look at the five,
that means it has read and execute permissions,
four for read, one for execute,
and you add those together to get five.
Now when we get to the third position,
we have a 2 from 752.
What does the two mean?
Well, we know read is four,
write is two, and one is execute.
So if we only see a two there,
that means the other group has the write permissions,
but they can't read the file,
and they can't execute the file.
So it would be completely fair
for them to give you a question that says,
"You have an octal assignment of 541,
what level of permission does the group assigned
to this file have?"
And then you need to figure that out.
So we would say, "Okay, five means we have a four plus a one
to give us five."
That is read and execute permissions.
Four is going to be for read only,
so the group has read only.
And one, that's going to be execute only,
so others can execute only.
If you can work out problems like this on the exam,
you're going to do fine on permission-related questions.
The last thing I need to mention in terms of file
and directory permissions is the umask command.
The umask command is used to set the default permissions
for newly created files and folders.
This is called the umask command
because it's setting up the user defined permissions
for those new files and directories.
If you enter umask -S,
this will display the current mask as a symbolic value.
If you enter umask -p,
this will display the current mask in numerical format.
Now to set the umask for a file or directory,
simply enter umask and the mask you want to assign,
which is the numeric value of the mask you want to apply.
Keep in mind, though, the difference between umask
and chmod is that umask is used
to change the default permissions
for all newly created files and folders,
whereas chmod is used to set permissions on files
and folders that already exist.