In this demonstration,
I'm going to walk you through how to modify
file and directory permissions.
Permissions are access rights assigned to users
which enable them to access or modify
certain files and directories.
They enable you to configure
who is allowed to access or modify an object
and who's restricted from accessing that object.
This helps mitigate risk by ensuring that users
are only able to access what they need
to get their jobs done and nothing else.
Now let's view some files
that I have currently in my directory.
Now we can see here a list
of files and directories I currently have.
Now, if you look at this output,
you can see a string of characters all the way to the left.
This is called the permission strings.
The first bit is set as d.
That means we're looking at a directory.
Now if we're looking at a file,
that would be stored as a dash.
So back to the other example,
you see in this flavor of Linux,
all of the directories are highlighted in blue,
and all the files are just plain white.
And you can also see the associated dash with all the files,
and the d associated with all the directories.
Now going from left to right again,
the first bit determines if it's a file or a directory
by dash or d.
The next set of three bits determines
the rights and permissions of the owner
or user of that file or directory.
So for example, on the desktop directory,
the owner has permissions to read, write, and execute.
The second three are associated with the group.
Now on the desktop, any group associated with this
can read or execute, but not write functions.
And the last three are associated with others.
So pretty much anyone who's not a user/owner
or a part of the group that's associated
with that directory or file.
Now we can see here that cmason
is the owner of this current file, I mean, directory,
and the GraphicsDepartment is the group
that's associated with this directory as well.
So anyone in the Graphics Department
will have any of the permissions
associated with the second set of bits.
So remember the first set,
the first three are for the owner/user,
the second set is for the group,
the last set is for all others.
Now we're going to view permissions
on another commonly used file just for practice.
Now we can see this particular file is owned by the root.
It's very few permissions on this.
A lot of files that are created by the root
are locked down because we don't want
any inadvertent reads or writes to those files
and we don't want anyone without administrative privileges
viewing these items.
One more just for practice,
I'm going to do the var log file.
Again you see another one of these files owned by the root
and you can see similar privileges.
Everything is like that on,
pretty tight on objects that were created by the root.
Now we're going to test out changing permissions on objects.
So first we're going to create a new directory.
Demo.
Okay, and go to this directory.
All right, see that's empty.
And now we're going to make another directory as well in here.
Directory, call it directory A.
And then we're going to make a file.
Call that file1.
All right, you see those are added
to the permissions demo directory.
I want to see the permissions
that are associated with these files.
Now by default, Linux implies a certain set of permissions
on files and folders.
For folders/directories,
it's typically going to give you a 775 modification.
The 775 represents an absolute permission character set.
What it means is four plus two plus one.
The four represents read, the two represents write,
and the one represents execute.
By default, most folders are going to have
read, write, execute privileges for the owner,
read, write, execute privileges for the group,
and read and execute privileges for all others.
And again the reason that last for others
is read and execute only because read is four,
execute is one, so that means five, 775.
For files, typically the absolute
character permission set is 666.
Now we see there's a little discrepancy here,
because we can see it's read, write, read, write,
and only read on the others portion.
But just a quick
command to look at something.
Let's call mask, this umask.
Pretty much it means subtract that number.
Remember the first zero that's for special privileges?
But if you go back to the absolute value set of 666,
you'll see that the default permissions for the others
is subtracted by two
when we're talking about the absolute value.
So again, 666 is the default,
but since any file created by the user
is going to subtract two in the other's permission set,
now we see that's why we only have read permissions,
because six minus two is four,
which means we're only going to have
three permissions for the others.
Now let's go back there.
Now we're going to edit the permissions on the first directory.
We'll do that by the change mode command.
We'll use the absolute character set, 755,
directory A.
Now let's see how these permissions have changed.
Now if you look at the group field
of the permission string,
you'll see that now you only have
read and execute privileges,
'cause that's what five is associated with.
Again, four plus one equals five,
'cause read equals four, and execute equals one.
Now let's do the same thing to the file,
but we're going to do it a little differently.
We're going to use 660.
Now let's see how this changes.
Now we can see in the others field
for the permission string
that the read feature is gone.
That attribute is no longer available for other users.
So if you're not the owner or part of the group,
you cannot read what's in that file.
What I'm going to do now is modify
the group privileges on directory A,
but this time I'm going to use the symbolic mode.
I'm going to change mode.
And the g stands for group,
the plus stands for add permissions,
the w stands for which permission that we're going to add,
which attribute, which is going to be the right feature?
So you actually put which objects you want to adjust.
All right.
Now we see that I've added the right attribute
to the group field in the permission string.
Now we're going to do that on file1.
We'll change mode.
This time we're going to change others.
O, we're going to give them read and write permissions.
So we changed that.
Okay, we see that went through.
In order to change the ownership permissions,
we're going to use the u character.
Again that stands for user/owner,
because they want to have two Os
'cause the one O stands for others.
It's a way that you use u to associate with the owner.
So we're going to add execute functions to the file.
We're going to do change mode again for the u.
We're going to add x.
And (indistinct).
All right.
Simple enough.
Now I stated earlier Linux give a default permission set.
We can modify this by changing some variables in the file
that allow us to change the default set
when a user creates an object.
So just like earlier, we're going to use the umask.
We're going to see that anytime I create a file,
it's going to subtract two from the others,
so pretty much the user won't have
any type of write permissions.
Next I'm going to edit the test user.
We're going to edit there .bashrc file
to allow us to change the default permission set
when that user creates a file.
So we're going to do sudo.
So it's going to allow us to go straight to the editor.
Test user.
I'm going to use there .bashrc.
And the password.
Okay, now see the .bashrc file for test user.
So here what we're going to do is insert and go down here.
And we're going to use mask,
change it to 022.
I'm going to quit here.
I'll escape.
All right, and quit.
Now we're going to switch to
test user.
We'll see
that the default for the test user
has changed to 022,
meaning that any group would no longer have
write functions as well.
So let's test this out when we create a file.
Let's check the directory parameter, okay.
Let's create a test file here.
I'm going to list out this directory
and we're going to see the permission set
associated with this file.
We can see now on the test file that we created
only has read write privileges for the owner,
but the group and all others only have read privileges,
because we're changing the umask variable
in the .bashrc file.
All right, that concludes our demonstration.
We went over how to modify permissions on objects in Linux.
And I'll see you in the next lesson.