Red Hat Training

A Red Hat training course is available for RHEL 8

Chapter 24. Managing file permissions

File permissions control the ability of user and group accounts to view, modify, access, and execute the contents of the files and directories.

Every file or directory has three levels of ownership:

  • User owner (u).
  • Group owner (g).
  • Others (o).

Each level of ownership can be assigned the following permissions:

  • Read (r).
  • Write (w).
  • Execute (x).

Note that the execute permission for a file allows you to execute that file. The execute permission for a directory allows you to access the contents of the directory, but not execute it.

When a new file or directory is created, the default set of permissions are automatically assigned to it. The default permissions for a file or directory are based on two factors:

  • Base permission.
  • The user file-creation mode mask (umask).

24.1. Base file permissions

Whenever a new file or directory is created, a base permission is automatically assigned to it. Base permissions for a file or directory can be expressed in symbolic or octal values.

Permission

Symbolic value

Octal value

No permission

---

0

Execute

--x

1

Write

-w-

2

Write and execute

-wx

3

Read

r--

4

Read and execute

r-x

5

Read and write

rw-

6

Read, write, execute

rwx

7

The base permission for a directory is 777 (drwxrwxrwx), which grants everyone the permissions to read, write, and execute. This means that the directory owner, the group, and others can list the contents of the directory, create, delete, and edit items within the directory, and descend into it.

Note that individual files within a directory can have their own permission that might prevent you from editing them, despite having unrestricted access to the directory.

The base permission for a file is 666 (-rw-rw-rw-), which grants everyone the permissions to read and write. This means that the file owner, the group, and others can read and edit the file.

Example 24.1. Permissions for a file

If a file has the following permissions: 

$ ls -l
-rwxrw----. 1 sysadmins sysadmins 2 Mar 2 08:43 file
  • - indicates it is a file.
  • rwx indicates that the file owner has permissions to read, write, and execute the file.
  • rw- indicates that the group has permissions to read and write, but not execute the file.
  • --- indicates that other users have no permission to read, write, or execute the file.
  • . indicates that the SELinux security context is set for the file.

Example 24.2. Permissions for a directory

If a directory has the following permissions: 

$ ls -dl directory
drwxr-----. 1 sysadmins sysadmins 2 Mar 2 08:43 directory
  • d indicates it is a directory.

  • rwx indicates that the directory owner has the permissions to read, write, and access the contents of the directory.

    As a directory owner, you can list the items (files, subdirectories) within the directory, access the content of those items, and modify them.

  • r-x indicates that the group has permissions to read the content of the directory, but not write - create new entries or delete files. The x permission means that you can also access the directory using the cd command.

  • --- indicates that other users have no permission to read, write, or access the contents of the directory.

    As someone who is not a user owner, or as group owner of the directory, you cannot list the items within the directory, access information about those items, or modify them.

  • . indicates that the SELinux security context is set for the directory.
Note

The base permission that is automatically assigned to a file or directory is not the default permission the file or directory ends up with. When you create a file or directory, the base permission is altered by the umask. The combination of the base permission and the umask creates the default permission for files and directories.

24.2. User file-creation mode mask

The user file-creation mode mask (umask) is variable that controls how file permissions are set for newly created files and directories. The umask automatically removes permissions from the base permission value to increase the overall security of a Linux system. The umask can be expressed in symbolic or octal values.

Permission

Symbolic value

Octal value

Read, write, and execute

rwx

0

Read and write

rw-

1

Read and execute

r-x

2

Read

r--

3

Write and execute

-wx

4

Write

-w-

5

Execute

--x

6

No permissions

---

7

The default umask for a standard user is 0002. The default umask for a root user is 0022.

The first digit of the umask represents special permissions (sticky bit, ). The last three digits of the umask represent the permissions that are removed from the user owner (u), group owner (g), and others (o) respectively.

Example 24.3. Applying the umask when creating a file

The following example illustrates how the umask with an octal value of 0137 is applied to the file with the base permission of 777, to create the file with the default permission of 640.

Users Groups Umask Example

24.3. Default file permissions

The default permissions are set automatically for all newly created files and directories. The value of the default permissions is determined by applying the umask to the base permission.

Example 24.4. Default permissions for a directory created by a standard user

When a standard user creates a new directory, the umask is set to 002 (rwxrwxr-x), and the base permissions for a directory are set to 777 (rwxrwxrwx). This brings the default permissions to 775 (drwxrwxr-x).

 

Symbolic value

Octal value

Base permission

rwxrwxrwx

777

Umask

rwxrwxr-x

002

Default permission

rwxrwxr-x

775

This means that the directory owner and the group can list the contents of the directory, create, delete, and edit items within the directory, and descend into it. Other users can only list the contents of the directory and descend into it.

Example 24.5. Default permissions for a file created by a standard user

When a standard user creates a new file, the umask is set to 002 (rwxrwxr-x), and the base permissions for a file are set to 666 (rw-rw-rw-). This brings the default permissions to 664 (-rw-rw-r--).

 

Symbolic value

Octal value

Base permission

rw-rw-rw-

666

Umask

rwxrwxr-x

002

Default permission

rw-rw-r--

664

This means that the file owner and the group can read and edit the file, while other users can only read the file.

Example 24.6. Default permissions for a directory created by the root user

When a root user creates a new directory, the umask is set to 022 (rwxr-xr-x), and the base permissions for a directory are set to 777 (rwxrwxrwx). This brings the default permissions to 755 (rwxr-xr-x).

 

Symbolic value

Octal value

Base permission

rwxrwxrwx

777

Umask

rwxr-xr-x

022

Default permission

rwxr-xr-x

755

This means that the directory owner can list the contents of the directory, create, delete, and edit items within the directory, and descend into it. The group and others can only list the contents of the directory and descend into it.

Example 24.7. Default permissions for a file created by the root user

When a root user creates a new file, the umask is set to 022 (rwxr-xr-x), and the base permissions for a file are set to 666 (rw-rw-rw-). This brings the default permissions to 644 (-rw-r—​r--).

 

Symbolic value

Octal value

Base permission

rw-rw-rw-

666

Umask

rwxr-xr-x

022

Default permission

rw-r—​r--

644

This means that the file owner can read and edit the file, while the group and others can only read the file.

Note

For security reasons, regular files cannot have execute permissions by default, even if the umask is set to 000 (rwxrwxrwx). However, directories can be created with execute permissions.

24.4. Changing file permissions using symbolic values

You can use the chmod utility with symbolic values (a combination letters and signs) to change file permissions for a file or directory.

You can assign the following permissions:

  • Read (r)
  • Write (w)
  • Execute (x)

Permissions can be assigned to the following levels of ownership:

  • User owner (u)
  • Group owner (g)
  • Other (o)
  • All (a)

To add or remove permissions you can use the following signs:

  • + to add the permissions on top of the existing permissions
  • - to remove the permissions from the existing permission
  • = to remove the existing permissions and explicitly define the new ones

Procedure

  • To change the permissions for a file or directory, use: 

    $ chmod <level><operation><permission> file-name

    Replace <level> with the level of ownership you want to set the permissions for. Replace <operation> with one of the signs. Replace <permission> with the permissions you want to assign. Replace file-name with the name of the file or directory. For example, to grant everyone the permissions to read, write, and execute (rwx) my-script.sh, use the chmod a=rwx my-script.sh command.

    See Base file permissions for more details.

Verification steps

  • To see the permissions for a particular file, use: 

    $ ls -l file-name

    Replace file-name with the name of the file.

  • To see the permissions for a particular directory, use: 

    $ ls -dl directory-name

    Replace directory-name with the name of the directory.

  • To see the permissions for all the files within a particular directory, use: 

    $ ls -l directory-name

    Replace directory-name with the name of the directory.

Example 24.8. Changing permissions for files and directories

  • To change file permissions for my-file.txt from -rw-rw-r-- to -rw------, use:

    1. Display the current permissions for my-file.txt: 

      $ ls -l my-file.txt
-rw-rw-r--. 1 username username 0 Feb 24 17:56 my-file.txt

    2. Remove the permissions to read, write, and execute (rwx) the file from group owner (g) and others (o): 

      $ chmod go= my-file.txt

      Note that any permission that is not specified after the equals sign (=) is automatically prohibited.

    3. Verify that the permissions for my-file.txt were set correctly: 

      $ ls -l my-file.txt
-rw-------. 1 username username 0 Feb 24 17:56 my-file.txt

  • To change file permissions for my-directory from drwxrwx--- to drwxrwxr-x, use:

    1. Display the current permissions for my-directory: 

      $ ls -dl my-directory
drwxrwx---. 2 username username 4096 Feb 24 18:12 my-directory

    2. Add the read and execute (r-x) access for all users (a): 

      $ chmod o+rx my-directory

    3. Verify that the permissions for my-directory and its content were set correctly: 

      $ ls -dl my-directory
drwxrwxr-x. 2 username username 4096 Feb 24 18:12 my-directory

24.5. Changing file permissions using octal values

You can use the chmod utility with octal values (numbers) to change file permissions for a file or directory.

Procedure

  • To change the file permissions for an existing file or directory, use: 

    $ chmod octal_value file-name

    Replace file-name with the name of the file or directory. Replace octal_value with an octal value. See Base file permissions for more details.