The staff rota anyone could change
A shop keeps its staff rota in one file on the shared computer behind the till.
One Saturday a new starter swapped their shifts with somebody else's. Nobody could say who did it, or stop it happening again.
The file let every account change it. One small setting would have fixed that.
By the end of this lesson
Note
I can set who may use a file.
Key words
| Word | What it means | Example |
|---|---|---|
| User | an account on a machine, with its own name and files | |
| Group | a named list of users who share some files | |
| Owner | the user a file belongs to | |
| Permission | the right to read, change or run a file | |
| Mode | the letters that show the permissions of a file | rw-r--r-- |
| sudo | run one command as the administrator, root |
The cells students fill in are left blank in this preview.
Before you start
Note
Press Start the lab on the bar at the top and wait for the machine. You are the administrator of this server, so sudo works for you. Press the Runs in order.
Every file has an owner and a group
Every file belongs to one user, its owner, and to one group.
Its mode gives three sets of rights. The first set is for the owner. The second is for members of the group. The third is for everybody else.
Each set is three letters: r to read, w to write and x to run. A dash means no.
Who am I, and which groups?
idShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the passwords file
ls -l /etc/shadowShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Try to read it
cat /etc/shadowShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading -rw-r-----
| Part | Letters | Who | May |
|---|---|---|---|
| First character | - | The type | A dash is a file, a d is a folder |
| Owner | rw- | root | Read and write |
| Group | r-- | Members of shadow | Read only |
| Everybody else | --- | student, and all others | Nothing at all |
The cells students fill in are left blank in this preview.
chmod sets the mode with three digits
chmod changes the mode. Each set of three letters becomes one digit. Add 4 for r, 2 for w and 1 for x.
So 600 means the owner may read and write, and nobody else may do anything.
To test it, the Runs use sudo -u nobody. It runs one command as nobody, a built-in account that stands for any other user.
Worked example: modes as digits
| Digits | Owner | Group | Everybody else | Good for |
|---|---|---|---|---|
| 600 | rw- (4+2) | --- (0) | --- (0) | A private file |
| 640 | rw- (4+2) | r-- (4) | --- (0) | A file the team may read |
| 644 | rw- (4+2) | r-- (4) | r-- (4) | A file anybody may read |
| 755 | rwx (4+2+1) | r-x (4+1) | r-x (4+1) | A program anybody may run |
The cells students fill in are left blank in this preview.
Write a rota into the shared folder
echo "Sat 9-5 Sam" > /tmp/rota.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Make it private
chmod 600 /tmp/rota.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Can another user read it?
sudo -u nobody cat /tmp/rota.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Let everybody read it
chmod 644 /tmp/rota.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Try again as the other user
sudo -u nobody cat /tmp/rota.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people fix "Permission denied" with chmod 777. It works, because it lets every user read, change and run the file. That is exactly what went wrong with the rota. Give the fewest rights that do the job, such as 640.
A team shares through a group
To share a folder with a team, an administrator makes a group with sudo groupadd. They add each member with sudo usermod -aG, then give the folder to the group with sudo chgrp.
The group's digit then decides what the team may do. Everybody else gets the last digit, often 0. The lab asks you to do this for a real team.
Going further
Make a file /tmp/menu.txt. You may read and write it, your group may read it, and everybody else may do nothing.
Work out the three digits on paper first. Then set them with chmod. Check with stat -c "%a %A" /tmp/menu.txt, which prints the digits and the letters.