Understanding File Permissions
 

I'm reading a tutorial on file permissions and it gives;

-rwxr-xr-x- root root

# The superuser has the right to read, write, and execute this file
# Members of the group "root" can also read and execute this file
# Everybody else can read and execute this file


My interpretations is;

superuser can read, write, execute + bonus r
group root can execute and read/bonus r
everyone else can execute only


Could someone point out what I'm not getting? :confused:

No, you've got that right.

Why, what's wrong with that?

.............
A smaller sig would be nice.

I see you have two OLD PC's listed there.
The PII will run one of the newer distros, but you'll want a lighter version for that 486. Whatever - linux will run them much better than the old windows you have.

Suggest: DSL or Puppy for the 486. If you like DSL, it will install as Debian (one of the most powerful distros around) to the PII and you can get a graphical file manager.

See also: http://www.zegeniestudios.net/ldc/

What do you mean by bonus r ?

Think of rwx as blocks. First block is user, second is group and third is the world.

rwxrwx--x root root would indicate like you said, root owns the file and can read, write and execute it. root is part of the root group, so it can also read, write and execute the file. Everyone who has access but is not root or in the root group can only execute the file.

Say you have rwxr--x--x root root, that means root user can read, write and execute and everyone else, including those in the root group can only execute the file.

I see. The tutorial has the dashes in weird places. It should read;

rwx-rx-rx < now it matches what they're saying AND there are no "bonus rs" (rs that didn't represent anything in my interpretation of the file permissions).

Not quite.

The sequence of dashes and letters is fixed: it's always "rwx" standing for read, write, execute (also know as "searchable"). The full line reads -rwrwxrwx and the order never changes (it can't be rwx-rx-rx because those dashes are where Rs should be).

Trickykid accidentally added an extra - in his example which I've bolded rwxr--x--x.

By the way, the first - indicates whether or not the "file" is a directory (or other special file), which is why most files are of the format -rwxr-xr-x, a directory with the same permissions would be drwxr-xr-x.

There is also a way to represent this numerically, but I won't get into that here.

your example has 11 permission bits when in reality there are only 12
3+3+3
but ls -l only shown 10
when you do ls -l the first one is for if its a directory a block device or like that
so lets say 13 if you count that one
so as extras you got the extra one for what kind of file plus
suid sgid and sticky
with ls -l
for suid and sgid x for group or user becomes s
sticky bit changes the last x to a t
accept for root as owner read and write really can't be turned off
even if ls -l says
----------

Actually, for my example, I accidently put an extra R not dash. ;)

How about a real world example here?

This listing has three kinds of entities: files, directories, and a symlink. This status is indicated by the first character: 'd' for directories, 'l' for symlinks, '-' for regular files. The file httpd.conf is readable and writeable by root, and readable by everyone else. It's a config file so nobody needs to execute it. All the directories are readable and executable by everyone (which is needed to change or access a directory). This is on my desktop where I'm the only user, so it's not a security vulnerability :). Symlinks are always rwx for everyone, because the permissions exist on the file that's being pointed to, not the symlink.

Permissions are sometimes abbreviated by 3 octal characters representing the rwx flags for each group. rwx is 111, or octal character 7. r-x is 101, or 5 octal. r-- is 100, or 4 octal. Thus, 755 is shorthand for rwxr-xr-x, and 644 is short for rw-r--r--, both very common settings, and the octal groups can be used directly with chmod.

probably should be... and I think each one of us misread this slightly... we are used to seeing actual listing like those in puffinman's post.

According to these permissions ... only the root user can alter (write) the file. Everyone can read and execute the file.... So you are very nearly right.

You have grouped the permissions in the tutorial like this:

other: -x-
group: -xr
owner: wxr
bonus: -r

which is where the "bonus" comes from.
In actual fact - as pointed out - the permissions are always in the same order and the tutorial has added an extra "-" at the end (possibly as a misguided punctuation).

The first "-" indicated it is a regular file. Then, in tripplets after that, it goes:

owner: rwx
group: r-x
others: r-x

Now do you see?

It should always be in that order.
As far as the computer is concerned, these rwx thingies are not important. It reads the binary version.

read permission is binary 100
write permission is binary 010
execute permission is binary 001

just add them up for the total permission.

your example then reads:

permissions: 111101101

so you see the bits read off rwxr-xr-x if you stick a hyphen every time you get a zero.

Hopefully the overexplaination works.

I really get it now, thanks! I had thought those dashes were just spacers, not actually representing values but now it all makes sense. Would take me a while to convert each option from binary to decimal. Thanks everyone for all your effort!!

Simon Bridge, sorry, I missed most of your first post thinking it was _your_ signature. Coincidentally, I got fed up of scrolling past my own signature and removed the less relavent of the two! Since the server I'm using is with two 333 processors, is there anyway I can make use of both cores?

I understand linux has multi-processor support out of the box. I've never needed it and have no experience of this.

Probably your first stop would be to check out your computer (compaq proliant 3000) in the HCL.

You may find this man page helpful:
man chmod

chmod will accept either alpha modes eg rwx or octal eg 755
Personally I always find it easier to read alpha style.
In general, the 3 blocks represent user, group, other, so you can say
chmod ugo=rwx <filename>
which would set
-rwxrwxrwx
for a normal file ie you can't affect the first char, which as above, is the file type. Use the
file <filename>
cmd to check a type in detail eg binary executable vs script.

... you would ;)

In general, only do this to your personal files you don't mind everyone reading, altering, deleting... you know, linux malware exists: one of the ways to limit damage is to pay attention to the permissions.

And I prefer: chmod 777 fu.bar for the same effect :)