% Linux Installation and Getting Started    -*- TeX -*-
% perms.tex
% Copyright (c) 1992, 1993 by Matt Welsh, Larry Greenfield and Karl Fogel
%
% This file is freely redistributable, but you must preserve this copyright 
% notice on all copies, and it must be distributed only as part of "Linux 
% Installation and Getting Started". This file's use is covered by
% the copyright for the entire document, in the file "copyright.tex".

\section{File Permissions}
\label{sec-file-perms}\label{sec-perms}

\index{files!permissions of|(}
\index{permissions!of files|(}
\subsection{Concepts of file permissions}

\index{files!permissions!defined}
\index{permissions!defined}
\index{files!owership of by user}
Because there are multiple users on a UNIX system, in order to protect
individual user's files from tampering by other users, UNIX provides
a mechanism known as {\bf file permissions}. This mechanism allows 
files and directories to be ``owned'' by a particular user. As an example, 
because Larry created the files in his home directory, Larry owns those files, 
and has access to them.

UNIX also allows files to be shared between users and groups of users.
If Larry so desired, he could cut off access to his files, such that no
other user could access them. However, on most systems the default is to 
allow other users to read your files, but not modify or delete them in 
any way.

\index{files!owership of by group}
As explained above, every file is owned by a particular user.
However, files are also owned by a particular {\bf group}, which is a 
system-defined group of users. Every user is placed into at least 
one group when that user is created. However, the system administrator
may also grant the user access to more than one group. 

\index{users!in groups}
\index{groups}
Groups are usually defined by the type of users which access the machine.
For example, on a university UNIX system, users may be placed into the
groups {\tt student}, {\tt staff}, {\tt faculty} or {\tt guest}. There
are also a few system-defined groups (such as {\tt bin} and {\tt admin})
which are used by the system itself to control access to resources---very
rarely do actual users belong to these system groups.

Permissions fall into three main divisions: read, write, and execute.
These permissions may be granted to three classes of users: the owner
of the file, the group to which the file belongs, and to all users, 
regardless of group. 

\index{permissions!read}
\index{files!permisions!read}
\index{directory!permisions!read}
\index{permissions!write}
\index{files!permisions!write}
\index{directory!permisions!write}
\index{permissions!execute}
\index{files!permisions!execute}
\index{directory!permisions!execute}
Read permission allows a user to read the contents
of the file, or in the case of directories, to list the contents of
the directory (using {\tt ls}). Write permission allows the user to
write to and modify the file. For directories, write permission allows
the user to create new files or delete files within that directory. Finally,
execute permission allows the user to run the file as a program or
shell script (if the file happens to be a program or shell script, that is). 
For directories, having execute permission allows the user to {\tt cd}
into the directory in question.

\subsection{Interpreting file permissions}
\index{permissions!interpreting}
\index{files!permissions!interpreting}
\index{files!listing permissions of with ls@listing permissions of with {\tt ls}}
\index{ls@{\tt ls}!listing file permissions with}
Let's look at an example to demonstrate file permissions. Using the
{\tt ls} command with the {\tt -l} option will display a ``long''
listing of the file, including file permissions. 
\begin{tscreen}
/home/larry/foo\# {\em ls -l stuff}
\begin{verbatim}
-rw-r--r--   1 larry    users         505 Mar 13 19:05 stuff
\end{verbatim}
/home/larry/foo\#
\end{tscreen}

The first field printed in the listing represents the file permissions.
The third field is the owner of the file ({\tt larry}), and the fourth
field is the group to which the file belongs ({\tt users}). Obviously,
the last field is the name of the file ({\tt stuff}), and we'll cover the
other fields later.

This file is owned by {\tt larry}, and belongs to the group {\tt users}.
Let's look at the file permissions. The string {\tt -rw-r--r--} lists,
in order, the permissions granted to the file's owner, the file's group,
and everybody else. 

The first character of the permissions string (``{\tt -}'') represents the
type of file. A ``{\tt -}'' just means that this is a regular file (as
opposed to a directory or device driver). The next three letters 
(``{\tt rw-}'') represent the permissions granted to the file's owner,
{\tt larry}. The ``{\tt r}'' stands for ``read'' and the ``{\tt w}''
stands for ``write''. Thus, {\tt larry} has read and write permission
to the file {\tt stuff}. 

As we mentioned, besides read and write permission, there is also
``execute'' permission---represented by an ``{\tt x}''. However, there
is a ``{\tt -}'' here in place of the ``{\tt x}'', so Larry doesn't
have execute permission on this file. This is fine, the file {\tt stuff}
isn't a program of any kind. Of course, because Larry owns the file,
he may grant himself execute permission for the file if he so desires.
This will be covered shortly.

The next three characters, {\tt r--}, represent the group's permissions
on the file. The group which owns this file is {\tt users}. Because
only an ``{\tt r}'' appears here, any user which belongs to the group
{\tt users} may read this file. 

The last three characters, also {\tt r--}, represent the permissions
granted to every other user on the system (other than the owner of the
file and those in the group {\tt users}). Again, because only an
``{\tt r}'' is present, other users may read the file, but not write to
it or execute it.

Here are some other examples of group permissions.
\begin{dispitems}
\ditem{{\tt -rwxr-xr-x}}
The owner of the file may
read, write, and execute the file. Users in the file's group, and all other 
users, may read and execute the file. 

\ditem{{\tt -rw-------}}
The owner of the file may 
read and write the file. No other user can access the file.

\ditem{{\tt -rwxrwxrwx}}
All users may read, write, and execute the file.
\end{dispitems}

\subsection{Dependencies}
\index{permissions!dependencies of}
\index{files!permissions!dependencies of}
\index{directory!permissions!dependencies of}
It is important to note that the permissions granted to a file also
depend on the permissions of the directory in which the file is located.
For example, even if a file is set to {\tt -rwxrwxrwx}, other users cannot
access the file unless they have read and execute access to the directory 
in which the file is located. For example, if Larry wanted to 
restrict access to all of his files, he could simply set the permissions
on his home directory {\tt /home/larry} to {\tt -rwx------}. In this
way, no other user has access to his directory, and all
files and directories within it. Larry doesn't need to worry about the
individual permissions on each of his files.

In other words, to access a file at all, you must have execute
access to all directories along the file's pathname, and read 
(or execute) access to the file itself.

Usually, users on a UNIX system are very open with their files. 
The usual set of permissions given to files is {\tt -rw-r--r--}, which will
allow other users to read the file, but not change it in any way.
The usual set of permissions given to directories is {\tt -rwxr-xr-x}, which
will allow other users to look through your directories, but not 
create or delete files within them.

However, many users wish to keep other users out of their files. 
Setting the permissions of a file to {\tt -rw-------} will not allow
any other user to access the file. Likewise, setting the permissions of
a directory to {\tt -rwx------} will keep other users out of the 
directory in question.

\subsection{Changing permissions}
\index{permissions!changing}
\index{files!permissions!changing}
\index{directory!permissions!changing}
\index{chmod@{\tt chmod}}
The command {\tt chmod} is used to set the permissions on a file. Only
the owner of a file may change the permissions on that file.
The syntax of {\tt chmod} is:
\begin{tscreen}
chmod \{a,u,g,o\}\{+,-\}\{r,w,x\} \cparam{filenames}
\end{tscreen}

Briefly, you supply one or more of
{\bf a}ll, {\bf u}ser, {\bf g}roup, or {\bf o}ther. Then you specify 
whether you are adding rights ({\tt +}) or taking them away ({\tt -}).
Finally, you specify one or more of
{\bf r}ead, {\bf w}rite, and e{\bf x}ecute. Some examples of legal
commands are:

\begin{dispitems}
\ditem{{\tt chmod a+r stuff}}
Gives all users read access to the file.
\ditem{{\tt chmod +r stuff}}
Same as above---if none of {\tt a}, {\tt u}, {\tt g}, or {\tt o} is
specified, {\tt a} is assumed.
\ditem{{\tt chmod og-x stuff}}
Remove execute permission from users other than the owner.
\ditem{{\tt chmod u+rwx stuff}}
Allow the owner of the file to read, write, and execute the file.
\ditem{{\tt chmod o-rwx stuff}}
Remove read, write, and execute permission from users other than the
owner and users in the file's group.
\end{dispitems}

\index{files!permissions of|)}
\index{permissions!of files|)}
