Users, groups, and permissions — Linux Administration

What you'll learn

Set permissions with chmod and chown
Read the type and owner, group and others permissions in ls -l output
Create users and groups and add a user to a group without removing others
Build a shared team folder with the least access that works

Read rwx permissions, create users and groups, and control access with chmod and chown.

Why it matters

Linux was built for many users sharing one machine, and that design is still what keeps servers safe. A web server process should be able to read its web files but not your SSH keys. A database's data folder should be writable by the database and nobody else. Most "permission denied" errors you will debug, and many security findings, come down to the ideas in this lesson.

Users and groups

Every process runs as a user, and every user belongs to one or more groups.

whoami          # your username
id              # your user id (uid), main group and all groups
getent passwd alex
getent group sudo

root (uid 0) can do anything. Normal users get admin rights through sudo, which on Ubuntu is granted by membership of the sudo group (wheel on the Red Hat family).
System users such as www-data, mysql or sshd have no login and exist so that each service runs with only its own rights.
User accounts are listed in /etc/passwd; password hashes are in /etc/shadow, which only root can read.

Creating users and groups (on your practice system):

sudo adduser maria                 # interactive on Debian/Ubuntu (useradd -m on others)
sudo groupadd webteam
sudo usermod -aG webteam maria     # -a = append; without it you REPLACE her groups
groups maria

Reading permissions

ls -l shows the permissions of each file:

-rw-r----- 1 alex webteam 1204 Oct 23 09:12 report.txt
drwxr-x--- 2 alex webteam 4096 Oct 23 09:10 shared

Break the first column into four parts:

Part	`report.txt`	Meaning
Type	`-`	`-` file, `d` directory, `l` symlink
Owner (u)	`rw-`	alex can read and write
Group (g)	`r--`	members of webteam can read
Others (o)	`---`	everyone else gets nothing

The letters mean different things for files and directories:

	File	Directory
`r`	read the contents	list the names inside
`w`	change the contents	create, rename or delete entries inside
`x`	run it as a program	enter it (`cd`) and reach files inside

The directory x surprises many people: without it you cannot open a file inside, even if the file itself is readable.

chmod: changing permissions

Symbolic mode adds (+), removes (-) or sets (=) letters for u, g, o or a (all):

chmod u+x backup.sh        # owner may run it
chmod g+w report.txt       # group may edit it
chmod o-r report.txt       # others may no longer read it
chmod u=rwx,g=rx,o= shared # exact set

Octal mode sets everything at once. Each digit is a sum: read 4, write 2, execute 1.

Octal	Letters	Typical use
`644`	`rw-r--r--`	normal files
`640`	`rw-r-----`	files only a group may read
`600`	`rw-------`	private files, SSH private keys
`755`	`rwxr-xr-x`	programs, scripts and normal folders
`750`	`rwxr-x---`	a team folder

chmod 640 report.txt
chmod 750 shared
chmod -R g+rX shared       # recursive; capital X adds x only to folders

chown: changing owner and group

Only root can give a file to another user, so chown usually needs sudo:

sudo chown maria report.txt            # new owner
sudo chown maria:webteam report.txt    # owner and group
sudo chgrp webteam shared              # group only
sudo chown -R www-data:www-data /var/www/site

Worked example: a shared team folder

Goal: alex and maria can both edit files in /srv/webteam; nobody else can see inside.

sudo mkdir -p /srv/webteam
sudo chown root:webteam /srv/webteam
sudo chmod 2770 /srv/webteam      # rwx for owner and group, nothing for others
sudo usermod -aG webteam alex

The leading 2 sets the setgid bit on the folder, so new files created inside inherit the webteam group instead of the creator's personal group. Group changes apply at your next login, so log out and back in (or run newgrp webteam) before testing.

Default permissions: umask

New files do not start at 777. The umask removes bits from the default. With the common umask 022, new files get 644 and new folders 755. Run umask to see yours.

Common mistakes

chmod 777 to "fix" a permission error. It lets every user and every compromised service change the file. Find out which user needs access and grant exactly that.
usermod -G without -a, which silently removes the user from every other group, sometimes including sudo.
Forgetting the directory x bit, so a readable file inside an unreadable folder still cannot be opened.
Recursive chmod -R 644 on a folder, which strips x from its subfolders so nobody can enter them. Use X or find -type f/-type d.
Testing group changes without logging in again.

Recap

Every process runs as a user; groups share access between users.
ls -l shows type, then owner/group/others permissions as rwx.
chmod changes permissions (symbolic or octal: r=4, w=2, x=1); chown changes owner and group.
Grant the least access that works; never reach for 777.

Try it

Use the Do tab to build a shared team folder on your practice system and prove who can and cannot get in.

Key terms (6)

root: The superuser account with uid 0, which can do anything on the system.
chmod: The command that changes file permissions, in symbolic form (u+x) or octal form (640).
chown: The command that changes a file's owner and optionally its group; giving files to another user needs root.
octal mode: Writing permissions as three digits for owner, group and others, each a sum of read 4, write 2 and execute 1.
setgid: A permission bit that, on a directory, makes new files inside inherit the directory's group.
umask: A setting that removes permission bits from the defaults for new files and folders; 022 gives 644 files and 755 folders.