Lesson 7: Users & Permissions

Goal: Understand the Linux permission system and learn to control who can read, write, and execute files.

Table of Contents

1. Understanding sudo
2. Reading Permissions
3. chmod — Symbolic Mode
4. chmod — Octal (Numeric) Mode
5. chmod on Directories
6. chown — Change Ownership
7. Special Permissions
8. Exercises

Understanding sudo

sudo (Super User Do) lets you run commands as the root (admin) user.

# Normal user — permission denied
cat /etc/shadow
# Output: cat: /etc/shadow: Permission denied

# With sudo — works
sudo cat /etc/shadow

Important sudo commands

# Run a command as root
sudo command

# Open a root shell
sudo -i

# Run as a different user
sudo -u www-data command

# Edit a protected file
sudo nano /etc/hosts

# Check if you have sudo access
sudo -v

# List your sudo privileges
sudo -l

sudo vs su

# sudo: run ONE command as root
sudo apt update

# su: switch to another user entirely
su -              # switch to root
su - benjamin     # switch to user benjamin

Best practice: Use sudo for individual commands rather than staying in a root shell. This is safer and leaves an audit trail.

Reading Permissions

Every file and directory has permissions for three groups:

-rwxr-xr-x 1 benjamin developers 4096 Mar 22 10:00 script.sh
│└┬┘└┬┘└┬┘   └──┬───┘ └───┬────┘
│ │   │  │      │         │
│ │   │  │      Owner     Group
│ │   │  └── Others (everyone else)
│ │   └── Group permissions
│ └── Owner permissions
└── File type (- = file, d = directory, l = link)

Permission types

Example breakdown

-rwxr-xr-- 1 benjamin developers script.sh

chmod — Symbolic Mode

Change permissions using letters and symbols.

Syntax

chmod [who][operator][permission] file

Who: u (user/owner), g (group), o (others), a (all) Operator: + (add), - (remove), = (set exactly) Permission: r (read), w (write), x (execute)

Examples

# Make a script executable for the owner
chmod u+x script.sh

# Remove write permission for others
chmod o-w document.txt

# Add read permission for the group
chmod g+r config.yaml

# Set exact permissions for all
chmod a=rx script.sh

# Multiple changes at once
chmod u+rwx,g+rx,o-rwx project/

# Make a file readable and writable for owner only
chmod u=rw,go= secret.txt

Practical: Make a script executable

# Create a script
echo '#!/bin/bash' > hello.sh
echo 'echo "Hello from script!"' >> hello.sh

# Try to run it — permission denied
./hello.sh
# Output: bash: ./hello.sh: Permission denied

# Make it executable
chmod u+x hello.sh

# Now it works
./hello.sh
# Output: Hello from script!

chmod — Octal (Numeric) Mode

Each permission has a numeric value. Add them up for each group.

Values

Calculate permissions

rwx = 4 + 2 + 1 = 7
rw- = 4 + 2 + 0 = 6
r-x = 4 + 0 + 1 = 5
r-- = 4 + 0 + 0 = 4
--- = 0 + 0 + 0 = 0

Common permission sets

Examples

# Standard file permissions
chmod 644 document.txt

# Executable script
chmod 755 deploy.sh

# Private SSH key (SSH requires this)
chmod 600 ~/.ssh/id_ed25519

# Private directory
chmod 700 ~/secrets/

# Shared project directory
chmod 750 /var/www/project/

Recursive permissions

# Set all files in a directory to 644
chmod -R 644 project/

# Set directories to 755 and files to 644
find project/ -type d -exec chmod 755 {} \;
find project/ -type f -exec chmod 644 {} \;

chmod on Directories

Directory permissions work differently from file permissions.

Example

# Create a test directory
mkdir testdir
echo "secret" > testdir/file.txt

# Remove execute permission — can't enter
chmod u-x testdir
cd testdir
# Output: bash: cd: testdir: Permission denied

# Remove read permission — can't list
chmod u+x,u-r testdir
cd testdir    # works
ls            # Permission denied

# Restore
chmod u+rx testdir

chown — Change Ownership

chown changes the owner and/or group of a file.

# Change owner
sudo chown alice file.txt

# Change owner and group
sudo chown alice:developers file.txt

# Change only the group
sudo chown :developers file.txt
# or
sudo chgrp developers file.txt

# Recursive
sudo chown -R alice:developers project/

Practical example: Web server files

# Set web files to be owned by www-data (web server user)
sudo chown -R www-data:www-data /var/www/html/
sudo chmod -R 755 /var/www/html/

Special Permissions

Sticky Bit

Prevents users from deleting files they don't own in shared directories.

# Set sticky bit
chmod +t /shared/

# Or with octal (prepend 1)
chmod 1777 /shared/

# The /tmp directory uses this
ls -ld /tmp
# drwxrwxrwt 10 root root 4096 Mar 22 10:00 /tmp
#          ^ the 't' = sticky bit

SetUID

A program runs with the permissions of its owner, not the user who runs it.

# Example: passwd always runs as root
ls -l /usr/bin/passwd
# -rwsr-xr-x 1 root root ... /usr/bin/passwd
#    ^ the 's' = SetUID

SetGID

On directories, new files inherit the group of the directory.

# Set SetGID on a shared directory
chmod g+s /shared/project/

# New files created here will belong to the directory's group

Exercises

Exercise 1: Read permissions

# 1. Check permissions on common files
ls -la /etc/passwd
ls -la /etc/shadow
ls -la /usr/bin/ls

# 2. What permissions does your home directory have?
ls -ld ~

# 3. What permissions do SSH keys need?
ls -la ~/.ssh/ 2>/dev/null || echo "No .ssh directory"

Exercise 2: chmod practice

# 1. Create a test file
touch testfile.txt
ls -l testfile.txt

# 2. Remove all permissions for group and others
chmod go= testfile.txt
ls -l testfile.txt

# 3. Make it readable by everyone
chmod a+r testfile.txt
ls -l testfile.txt

# 4. Set it to 755 using octal
chmod 755 testfile.txt
ls -l testfile.txt

# 5. Clean up
rm testfile.txt

Exercise 3: Script permissions

# 1. Create a script
cat > status.sh << 'EOF'
#!/bin/bash
echo "User: $USER"
echo "Date: $(date)"
echo "Dir:  $(pwd)"
EOF

# 2. Try to run it
./status.sh
# Permission denied!

# 3. Make it executable
chmod u+x status.sh

# 4. Run it
./status.sh

# 5. Clean up
rm status.sh

Key Takeaways

• sudo — run commands as root (use sparingly)
• Three permission groups: owner, group, others
• Three permission types: read (4), write (2), execute (1)
• chmod 755 — octal mode (most common: 644 for files, 755 for dirs/scripts)
• chmod u+x — symbolic mode (more readable)
• chown user:group — change ownership
• 600 for private files, 755 for executables, 644 for regular files

Next Lesson: Lesson 8: User & Group Management →