1
00:00:00,000 --> 00:00:01,140
In this demonstration,

2
00:00:01,140 --> 00:00:02,820
I'm going to walk you through how to modify

3
00:00:02,820 --> 00:00:04,800
file and directory permissions.

4
00:00:04,800 --> 00:00:07,050
Permissions are access rights assigned to users

5
00:00:07,050 --> 00:00:08,790
which enable them to access or modify

6
00:00:08,790 --> 00:00:10,800
certain files and directories.

7
00:00:10,800 --> 00:00:11,880
They enable you to configure

8
00:00:11,880 --> 00:00:15,210
who is allowed to access or modify an object

9
00:00:15,210 --> 00:00:18,270
and who's restricted from accessing that object.

10
00:00:18,270 --> 00:00:20,460
This helps mitigate risk by ensuring that users

11
00:00:20,460 --> 00:00:22,140
are only able to access what they need

12
00:00:22,140 --> 00:00:24,483
to get their jobs done and nothing else.

13
00:00:25,380 --> 00:00:26,430
Now let's view some files

14
00:00:26,430 --> 00:00:28,637
that I have currently in my directory.

15
00:00:28,637 --> 00:00:30,240
Now we can see here a list

16
00:00:30,240 --> 00:00:33,060
of files and directories I currently have.

17
00:00:33,060 --> 00:00:34,860
Now, if you look at this output,

18
00:00:34,860 --> 00:00:37,810
you can see a string of characters all the way to the left.

19
00:00:38,760 --> 00:00:40,660
This is called the permission strings.

20
00:00:42,060 --> 00:00:44,910
The first bit is set as d.

21
00:00:44,910 --> 00:00:46,950
That means we're looking at a directory.

22
00:00:46,950 --> 00:00:48,120
Now if we're looking at a file,

23
00:00:48,120 --> 00:00:50,553
that would be stored as a dash.

24
00:00:51,630 --> 00:00:53,343
So back to the other example,

25
00:00:56,610 --> 00:00:58,800
you see in this flavor of Linux,

26
00:00:58,800 --> 00:01:01,410
all of the directories are highlighted in blue,

27
00:01:01,410 --> 00:01:03,360
and all the files are just plain white.

28
00:01:04,230 --> 00:01:08,550
And you can also see the associated dash with all the files,

29
00:01:08,550 --> 00:01:10,850
and the d associated with all the directories.

30
00:01:11,880 --> 00:01:14,160
Now going from left to right again,

31
00:01:14,160 --> 00:01:18,030
the first bit determines if it's a file or a directory

32
00:01:18,030 --> 00:01:20,070
by dash or d.

33
00:01:20,070 --> 00:01:23,310
The next set of three bits determines

34
00:01:23,310 --> 00:01:26,190
the rights and permissions of the owner

35
00:01:26,190 --> 00:01:28,383
or user of that file or directory.

36
00:01:29,340 --> 00:01:32,613
So for example, on the desktop directory,

37
00:01:33,930 --> 00:01:38,463
the owner has permissions to read, write, and execute.

38
00:01:39,570 --> 00:01:43,230
The second three are associated with the group.

39
00:01:43,230 --> 00:01:46,350
Now on the desktop, any group associated with this

40
00:01:46,350 --> 00:01:51,000
can read or execute, but not write functions.

41
00:01:51,000 --> 00:01:53,910
And the last three are associated with others.

42
00:01:53,910 --> 00:01:56,550
So pretty much anyone who's not a user/owner

43
00:01:56,550 --> 00:01:58,170
or a part of the group that's associated

44
00:01:58,170 --> 00:01:59,820
with that directory or file.

45
00:01:59,820 --> 00:02:02,640
Now we can see here that cmason

46
00:02:02,640 --> 00:02:06,540
is the owner of this current file, I mean, directory,

47
00:02:06,540 --> 00:02:08,697
and the GraphicsDepartment is the group

48
00:02:08,697 --> 00:02:11,186
that's associated with this directory as well.

49
00:02:11,186 --> 00:02:12,991
So anyone in the Graphics Department

50
00:02:12,991 --> 00:02:15,870
will have any of the permissions

51
00:02:15,870 --> 00:02:20,010
associated with the second set of bits.

52
00:02:20,010 --> 00:02:21,510
So remember the first set,

53
00:02:21,510 --> 00:02:25,020
the first three are for the owner/user,

54
00:02:25,020 --> 00:02:26,730
the second set is for the group,

55
00:02:26,730 --> 00:02:29,160
the last set is for all others.

56
00:02:29,160 --> 00:02:30,270
Now we're going to view permissions

57
00:02:30,270 --> 00:02:33,933
on another commonly used file just for practice.

58
00:02:36,030 --> 00:02:38,880
Now we can see this particular file is owned by the root.

59
00:02:39,810 --> 00:02:42,450
It's very few permissions on this.

60
00:02:42,450 --> 00:02:44,070
A lot of files that are created by the root

61
00:02:44,070 --> 00:02:45,810
are locked down because we don't want

62
00:02:45,810 --> 00:02:48,960
any inadvertent reads or writes to those files

63
00:02:48,960 --> 00:02:51,690
and we don't want anyone without administrative privileges

64
00:02:51,690 --> 00:02:52,893
viewing these items.

65
00:02:54,840 --> 00:02:56,223
One more just for practice,

66
00:02:57,300 --> 00:03:00,873
I'm going to do the var log file.

67
00:03:02,700 --> 00:03:06,210
Again you see another one of these files owned by the root

68
00:03:06,210 --> 00:03:08,400
and you can see similar privileges.

69
00:03:08,400 --> 00:03:09,480
Everything is like that on,

70
00:03:09,480 --> 00:03:12,180
pretty tight on objects that were created by the root.

71
00:03:14,310 --> 00:03:17,970
Now we're going to test out changing permissions on objects.

72
00:03:17,970 --> 00:03:20,193
So first we're going to create a new directory.

73
00:03:24,270 --> 00:03:25,103
Demo.

74
00:03:27,360 --> 00:03:29,343
Okay, and go to this directory.

75
00:03:34,770 --> 00:03:36,183
All right, see that's empty.

76
00:03:37,462 --> 00:03:40,860
And now we're going to make another directory as well in here.

77
00:03:40,860 --> 00:03:43,623
Directory, call it directory A.

78
00:03:47,250 --> 00:03:49,440
And then we're going to make a file.

79
00:03:49,440 --> 00:03:50,303
Call that file1.

80
00:03:52,230 --> 00:03:54,030
All right, you see those are added

81
00:03:54,030 --> 00:03:57,125
to the permissions demo directory.

82
00:03:57,125 --> 00:03:57,958
I want to see the permissions

83
00:03:57,958 --> 00:04:00,150
that are associated with these files.

84
00:04:00,150 --> 00:04:05,150
Now by default, Linux implies a certain set of permissions

85
00:04:05,160 --> 00:04:06,513
on files and folders.

86
00:04:07,350 --> 00:04:09,750
For folders/directories,

87
00:04:09,750 --> 00:04:14,013
it's typically going to give you a 775 modification.

88
00:04:15,180 --> 00:04:19,743
The 775 represents an absolute permission character set.

89
00:04:21,450 --> 00:04:24,693
What it means is four plus two plus one.

90
00:04:25,530 --> 00:04:28,740
The four represents read, the two represents write,

91
00:04:28,740 --> 00:04:31,285
and the one represents execute.

92
00:04:31,285 --> 00:04:34,830
By default, most folders are going to have

93
00:04:34,830 --> 00:04:38,430
read, write, execute privileges for the owner,

94
00:04:38,430 --> 00:04:42,240
read, write, execute privileges for the group,

95
00:04:42,240 --> 00:04:44,943
and read and execute privileges for all others.

96
00:04:46,140 --> 00:04:48,210
And again the reason that last for others

97
00:04:48,210 --> 00:04:52,710
is read and execute only because read is four,

98
00:04:52,710 --> 00:04:56,073
execute is one, so that means five, 775.

99
00:04:57,690 --> 00:05:00,870
For files, typically the absolute

100
00:05:00,870 --> 00:05:03,453
character permission set is 666.

101
00:05:04,440 --> 00:05:07,110
Now we see there's a little discrepancy here,

102
00:05:07,110 --> 00:05:09,390
because we can see it's read, write, read, write,

103
00:05:09,390 --> 00:05:12,360
and only read on the others portion.

104
00:05:12,360 --> 00:05:14,500
But just a quick

105
00:05:17,070 --> 00:05:18,810
command to look at something.

106
00:05:18,810 --> 00:05:21,393
Let's call mask, this umask.

107
00:05:22,440 --> 00:05:26,220
Pretty much it means subtract that number.

108
00:05:26,220 --> 00:05:29,670
Remember the first zero that's for special privileges?

109
00:05:29,670 --> 00:05:34,470
But if you go back to the absolute value set of 666,

110
00:05:34,470 --> 00:05:37,380
you'll see that the default permissions for the others

111
00:05:37,380 --> 00:05:39,180
is subtracted by two

112
00:05:39,180 --> 00:05:41,463
when we're talking about the absolute value.

113
00:05:42,930 --> 00:05:46,230
So again, 666 is the default,

114
00:05:46,230 --> 00:05:48,480
but since any file created by the user

115
00:05:48,480 --> 00:05:51,393
is going to subtract two in the other's permission set,

116
00:05:53,010 --> 00:05:55,500
now we see that's why we only have read permissions,

117
00:05:55,500 --> 00:05:57,930
because six minus two is four,

118
00:05:57,930 --> 00:05:58,900
which means we're only going to have

119
00:05:58,900 --> 00:06:01,620
three permissions for the others.

120
00:06:01,620 --> 00:06:02,820
Now let's go back there.

121
00:06:03,930 --> 00:06:08,280
Now we're going to edit the permissions on the first directory.

122
00:06:08,280 --> 00:06:11,070
We'll do that by the change mode command.

123
00:06:11,070 --> 00:06:14,673
We'll use the absolute character set, 755,

124
00:06:16,680 --> 00:06:19,053
directory A.

125
00:06:21,600 --> 00:06:23,813
Now let's see how these permissions have changed.

126
00:06:25,860 --> 00:06:27,480
Now if you look at the group field

127
00:06:27,480 --> 00:06:29,610
of the permission string,

128
00:06:29,610 --> 00:06:31,320
you'll see that now you only have

129
00:06:31,320 --> 00:06:33,240
read and execute privileges,

130
00:06:33,240 --> 00:06:35,280
'cause that's what five is associated with.

131
00:06:35,280 --> 00:06:38,970
Again, four plus one equals five,

132
00:06:38,970 --> 00:06:41,733
'cause read equals four, and execute equals one.

133
00:06:43,140 --> 00:06:45,150
Now let's do the same thing to the file,

134
00:06:45,150 --> 00:06:47,400
but we're going to do it a little differently.

135
00:06:47,400 --> 00:06:49,503
We're going to use 660.

136
00:06:58,380 --> 00:06:59,930
Now let's see how this changes.

137
00:07:02,010 --> 00:07:04,950
Now we can see in the others field

138
00:07:04,950 --> 00:07:06,200
for the permission string

139
00:07:07,350 --> 00:07:10,050
that the read feature is gone.

140
00:07:10,050 --> 00:07:13,113
That attribute is no longer available for other users.

141
00:07:13,980 --> 00:07:16,260
So if you're not the owner or part of the group,

142
00:07:16,260 --> 00:07:18,363
you cannot read what's in that file.

143
00:07:19,260 --> 00:07:20,820
What I'm going to do now is modify

144
00:07:20,820 --> 00:07:23,253
the group privileges on directory A,

145
00:07:24,870 --> 00:07:27,510
but this time I'm going to use the symbolic mode.

146
00:07:27,510 --> 00:07:28,610
I'm going to change mode.

147
00:07:29,832 --> 00:07:31,593
And the g stands for group,

148
00:07:32,550 --> 00:07:35,533
the plus stands for add permissions,

149
00:07:35,533 --> 00:07:38,130
the w stands for which permission that we're going to add,

150
00:07:38,130 --> 00:07:40,780
which attribute, which is going to be the right feature?

151
00:07:44,940 --> 00:07:48,993
So you actually put which objects you want to adjust.

152
00:07:49,915 --> 00:07:51,003
All right.

153
00:07:53,430 --> 00:07:55,260
Now we see that I've added the right attribute

154
00:07:55,260 --> 00:07:57,933
to the group field in the permission string.

155
00:08:00,690 --> 00:08:02,340
Now we're going to do that on file1.

156
00:08:04,170 --> 00:08:05,283
We'll change mode.

157
00:08:07,051 --> 00:08:10,413
This time we're going to change others.

158
00:08:11,526 --> 00:08:15,963
O, we're going to give them read and write permissions.

159
00:08:22,380 --> 00:08:23,433
So we changed that.

160
00:08:24,930 --> 00:08:27,180
Okay, we see that went through.

161
00:08:27,180 --> 00:08:29,190
In order to change the ownership permissions,

162
00:08:29,190 --> 00:08:31,023
we're going to use the u character.

163
00:08:32,280 --> 00:08:34,919
Again that stands for user/owner,

164
00:08:34,919 --> 00:08:36,570
because they want to have two Os

165
00:08:36,570 --> 00:08:40,140
'cause the one O stands for others.

166
00:08:40,140 --> 00:08:42,840
It's a way that you use u to associate with the owner.

167
00:08:43,870 --> 00:08:46,953
So we're going to add execute functions to the file.

168
00:08:49,489 --> 00:08:51,927
We're going to do change mode again for the u.

169
00:08:54,000 --> 00:08:54,933
We're going to add x.

170
00:08:56,040 --> 00:08:56,890
And (indistinct).

171
00:08:59,610 --> 00:09:00,443
All right.

172
00:09:04,290 --> 00:09:05,163
Simple enough.

173
00:09:07,723 --> 00:09:11,913
Now I stated earlier Linux give a default permission set.

174
00:09:13,080 --> 00:09:16,920
We can modify this by changing some variables in the file

175
00:09:16,920 --> 00:09:19,800
that allow us to change the default set

176
00:09:19,800 --> 00:09:21,723
when a user creates an object.

177
00:09:22,560 --> 00:09:24,510
So just like earlier, we're going to use the umask.

178
00:09:24,510 --> 00:09:28,230
We're going to see that anytime I create a file,

179
00:09:28,230 --> 00:09:30,720
it's going to subtract two from the others,

180
00:09:30,720 --> 00:09:32,250
so pretty much the user won't have

181
00:09:32,250 --> 00:09:34,773
any type of write permissions.

182
00:09:36,450 --> 00:09:38,970
Next I'm going to edit the test user.

183
00:09:38,970 --> 00:09:41,580
We're going to edit there .bashrc file

184
00:09:41,580 --> 00:09:44,670
to allow us to change the default permission set

185
00:09:44,670 --> 00:09:47,010
when that user creates a file.

186
00:09:47,010 --> 00:09:49,050
So we're going to do sudo.

187
00:09:53,310 --> 00:09:55,910
So it's going to allow us to go straight to the editor.

188
00:09:58,980 --> 00:10:02,421
Test user.

189
00:10:02,421 --> 00:10:06,633
I'm going to use there .bashrc.

190
00:10:09,960 --> 00:10:10,923
And the password.

191
00:10:15,720 --> 00:10:19,920
Okay, now see the .bashrc file for test user.

192
00:10:19,920 --> 00:10:24,920
So here what we're going to do is insert and go down here.

193
00:10:26,580 --> 00:10:29,850
And we're going to use mask,

194
00:10:29,850 --> 00:10:32,940
change it to 022.

195
00:10:32,940 --> 00:10:33,940
I'm going to quit here.

196
00:10:35,970 --> 00:10:37,443
I'll escape.

197
00:10:40,439 --> 00:10:41,733
All right, and quit.

198
00:10:44,548 --> 00:10:46,480
Now we're going to switch to

199
00:10:48,990 --> 00:10:49,823
test user.

200
00:10:56,912 --> 00:10:57,745
We'll see

201
00:11:00,150 --> 00:11:02,940
that the default for the test user

202
00:11:02,940 --> 00:11:04,770
has changed to 022,

203
00:11:04,770 --> 00:11:07,710
meaning that any group would no longer have

204
00:11:07,710 --> 00:11:09,600
write functions as well.

205
00:11:09,600 --> 00:11:12,480
So let's test this out when we create a file.

206
00:11:12,480 --> 00:11:14,883
Let's check the directory parameter, okay.

207
00:11:17,790 --> 00:11:19,413
Let's create a test file here.

208
00:11:22,230 --> 00:11:23,490
I'm going to list out this directory

209
00:11:23,490 --> 00:11:25,710
and we're going to see the permission set

210
00:11:25,710 --> 00:11:27,183
associated with this file.

211
00:11:31,410 --> 00:11:34,200
We can see now on the test file that we created

212
00:11:34,200 --> 00:11:36,960
only has read write privileges for the owner,

213
00:11:36,960 --> 00:11:39,660
but the group and all others only have read privileges,

214
00:11:39,660 --> 00:11:41,460
because we're changing the umask variable

215
00:11:41,460 --> 00:11:43,113
in the .bashrc file.

216
00:11:44,250 --> 00:11:46,500
All right, that concludes our demonstration.

217
00:11:46,500 --> 00:11:50,760
We went over how to modify permissions on objects in Linux.

218
00:11:50,760 --> 00:11:52,623
And I'll see you in the next lesson.