File Permissions

 

Permissions apply to the owner of a file, people in the same group as the group of the file, and everyone else. The typical permissions that apply are those of read (4), write (2) and execute (1). File permissions may either be referred to symbolically (rwx), or numerically. A file with permissions of 754 is broken down as follows:

7

read (4) + write (2) + execute (1) for the owner,

5

read (4) + execute (1) for members of the group,

4

read (4) access for everyone else.

Groups are defined in the file /etc/group and every users main group is given in 4'th field (delimited by ``:'') in /etc/passwd. Users can be attached to other groups by having their ID's added to the appropriate group in /etc/group. To delete a file, a user must have write permission on it, since you are changing its contents (to nothing).

Directories are kinds of files, how do permissions apply here? Read access is pretty obvious, you can see a directory listing if you can read a directory. Write permission? Well, you are altering a directory if you create or delete files. Execute permission? That is the permission to list anything below this directory.

We are left with 3 special permissions: Set User ID (SUID (4)), Set Group ID (SGID (2)) and ``sticky'' (1). If the execute permission for the owner is indicated with an ``s'' instead of the usual ``x'', the program is SUID. When the program runs, the permissions are set as if the file's owner was in fact running the program. If the execute permission for the group is indicated with an ``s'' instead of an ``x'', the program is SGID. If the execute permission of a directory is indicated with a ``t'' instead of an ``x'', that directory has the ``sticky'' bit set. The numeric modes involving suid, sgid and sticky are placed before the 3 octal digits for normal files.

Okay, we have a file with permissions 4755, broken down as follows:

4

SUID is in effect

7

read/write/execute for the owner

5

read/execute for the group

5

read/execute for everyone else

Anyone can run the program, and it when it runs, all file accesses are done as if the person running the program was the owner of the file. SGID behaves in a similar fashion.

The sticky bit is used with globally read/writable directories, such as /tmp. Everyone needs to be able to create files there, so the permissions on /tmp must be 777 (actually 1777). But we don't want people who aren't the owners of files from deleting them. The sticky bit is the way we inform the filesystem of this.