The payroll file everyone could open
A small company keeps its payroll file on a shared server. A new starter opens the folder and finds it. Anyone with a login can read every salary.
Nobody hacked anything. The file simply had the wrong permissions. This lesson is about getting them right.
By the end of this lesson
Note
I can say who may read, write or run a file, and change it.
Key words
| Word | What it means | Example |
|---|---|---|
| Owner | the one user a file belongs to | |
| Group | a named list of users who share files | |
| Others | everybody who is not the owner or in the group | |
| Root | the administrator account, which may do anything | |
| sudo | runs one command as root | sudo whoami |
| Setgid | a folder setting: new files join the folder's group | 2750 |
The cells students fill in are left blank in this preview.
Three kinds of person, three rights
Every file has an owner and a group. Everybody else is others.
For each of the three, the file says who may read (r), write (w) and run (x) it.
On a folder, r means list it, w means add or remove files, and x means go into it.
Who am I?
idShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read a folder's mode, owner and group
stat -c "%a %A %U %G" /srv/projectsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading a mode
| Mode | Owner may | Group may | Others may |
|---|---|---|---|
| rwxr-x--- | read, write, run | read, run | nothing |
| rw-rw-r-- | read, write | read, write | read |
| rw------- | read, write | nothing | nothing |
| rwxr-xr-x | read, write, run | read, run | read, run |
The cells students fill in are left blank in this preview.
chmod changes a mode
chmod changes the mode. You can give it three digits, such as chmod 640 payroll.txt.
Or you can say what to add or take away. g+w adds write for the group. o-r takes read away from others.
Run these in order. Each ls -l shows the new mode.
Make an empty file
touch payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Owner read and write, group read
chmod 640 payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the mode
ls -l payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Let the group write too
chmod g+w payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look again
ls -l payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think chmod 777 is a quick fix when something says permission denied. It lets every user on the machine change the file. Find out who needs the right, and give it to that owner or group only.
Users, root and sudo
Every person and every service has a user account. An ordinary user can open another user's file only when its mode allows it, and cannot change the system's files.
Root can do anything. Nobody should work as root all day. sudo runs just one command as root, and then you are an ordinary user again.
An ordinary user is refused
ls /rootShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The same user, with sudo
sudo whoamiShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Give the file to root
sudo chown root payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the owner
ls -l payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Give it back
sudo chown student payroll.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A shared folder needs a group and setgid
A team shares a folder. Make a group, for example sales, and put each member in it with usermod -aG sales name.
Set the folder's group with chgrp. Then choose what the group may do.
Add the setgid right, the 2 in 2750. Now a file made in the folder joins the folder's group, whoever made it.
Make a practice folder
mkdir -p teamdemoShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Setgid, group may read and run, others nothing
chmod 2750 teamdemoShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look for the s
ls -ld teamdemoShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.