Users, groups, and permissions

Why it matters

Linux was built for many users sharing one machine, and that design is still what keeps servers safe. A web server process should be able to read its web files but not your SSH keys. A database's data folder should be writable by the database and nobody else. Most "permission denied" errors you will debug, and many security findings, come down to the ideas in this lesson.

Users and groups

Every process runs as a user, and every user belongs to one or more groups.

whoami          # your username
id              # your user id (uid), main group and all groups
getent passwd alex
getent group sudo

• root (uid 0) can do anything. Normal users get admin rights through sudo, which on Ubuntu is granted by membership of the sudo group (wheel on the Red Hat family).
• System users such as www-data, mysql or sshd have no login and exist so that each service runs with only its own rights.
• User accounts are listed in /etc/passwd; password hashes are in /etc/shadow, which only root can read.

Creating users and groups (on your practice system):

sudo adduser maria                 # interactive on Debian/Ubuntu (useradd -m on others)
sudo groupadd webteam
sudo usermod -aG webteam maria     # -a = append; without it you REPLACE her groups
groups maria

Reading permissions

ls -l shows the permissions of each file:

-rw-r----- 1 alex webteam 1204 Oct 23 09:12 report.txt
drwxr-x--- 2 alex webteam 4096 Oct 23 09:10 shared

Break the first column into four parts:

The letters mean different things for files and directories:

The directory x surprises many people: without it you cannot open a file inside, even if the file itself is readable.

chmod: changing permissions

Symbolic mode adds (+), removes (-) or sets (=) letters for u, g, o or a (all):

chmod u+x backup.sh        # owner may run it
chmod g+w report.txt       # group may edit it
chmod o-r report.txt       # others may no longer read it
chmod u=rwx,g=rx,o= shared # exact set

Octal mode sets everything at once. Each digit is a sum: read 4, write 2, execute 1.

chmod 640 report.txt
chmod 750 shared
chmod -R g+rX shared       # recursive; capital X adds x only to folders

chown: changing owner and group

Only root can give a file to another user, so chown usually needs sudo:

sudo chown maria report.txt            # new owner
sudo chown maria:webteam report.txt    # owner and group
sudo chgrp webteam shared              # group only
sudo chown -R www-data:www-data /var/www/site

Worked example: a shared team folder

Goal: alex and maria can both edit files in /srv/webteam; nobody else can see inside.

sudo mkdir -p /srv/webteam
sudo chown root:webteam /srv/webteam
sudo chmod 2770 /srv/webteam      # rwx for owner and group, nothing for others
sudo usermod -aG webteam alex

The leading 2 sets the setgid bit on the folder, so new files created inside inherit the webteam group instead of the creator's personal group. Group changes apply at your next login, so log out and back in (or run newgrp webteam) before testing.

Default permissions: umask

New files do not start at 777. The umask removes bits from the default. With the common umask 022, new files get 644 and new folders 755. Run umask to see yours.

Common mistakes

• chmod 777 to "fix" a permission error. It lets every user and every compromised service change the file. Find out which user needs access and grant exactly that.
• usermod -G without -a, which silently removes the user from every other group, sometimes including sudo.
• Forgetting the directory x bit, so a readable file inside an unreadable folder still cannot be opened.
• Recursive chmod -R 644 on a folder, which strips x from its subfolders so nobody can enter them. Use X or find -type f/-type d.
• Testing group changes without logging in again.

Recap

• Every process runs as a user; groups share access between users.
• ls -l shows type, then owner/group/others permissions as rwx.
• chmod changes permissions (symbolic or octal: r=4, w=2, x=1); chown changes owner and group.
• Grant the least access that works; never reach for 777.

Try it

Use the Do tab to build a shared team folder on your practice system and prove who can and cannot get in.