Linux File Permissions & Ownership: Mastering chmod, chown, and Security

$ ls -l
-rwxr-xr-- 1 alice devops 1234 Jan 17 10:00 script.sh
drwxr-x--- 2 bob   devops 4096 Jan 17 10:00 secrets/
-rw-r----- 1 root  root   5678 Jan 17 10:00 config.conf

# Permission Key:
# r = read (view contents)
# w = write (modify)
# x = execute (run as program)
# - = no permission

# Common permission patterns:
-rw-------  # Owner: read/write, Group: none, Others: none (private)
-rw-r--r--  # Owner: read/write, Group: read, Others: read (config files)
-rwxr-xr-x  # Owner: all, Group: read/execute, Others: read/execute (binaries)
drwx------  # Private directory (only owner)
drwxr-xr-x  # Public directory (anyone can list/enter)

# Permission Values:
# r = 4
# w = 2  
# x = 1
# - = 0

# Calculate: r+w+x = 4+2+1 = 7
# r+w = 4+2 = 6
# r+x = 4+1 = 5
# r = 4
# etc.

# Common numeric permissions:
# 755 = rwxr-xr-x (Owner: all, Group/Others: read+execute)
# 644 = rw-r--r-- (Owner: read+write, Group/Others: read only)
# 600 = rw------- (Owner: read+write, others: none)
# 700 = rwx------ (Owner: all, others: none)
# 750 = rwxr-x--- (Owner: all, Group: read+execute, Others: none)

# Examples
chmod 755 script.sh   # rwxr-xr-x
chmod 644 config.txt  # rw-r--r--
chmod 600 secret.key  # rw-------
chmod 700 private_dir/ # drwx------

# Verify
ls -l script.sh config.txt secret.key private_dir/

# Syntax: chmod [who][operator][permission] file
# who: u (user/owner), g (group), o (others), a (all)
# operator: + (add), - (remove), = (set exactly)
# permission: r, w, x

chmod u+x script.sh      # Add execute for owner
chmod g-w config.txt     # Remove write for group
chmod o+r public.txt     # Add read for others
chmod a+x script.sh      # Add execute for everyone
chmod u=rw,g=r,o=r file  # Set exact permissions (644)
chmod -R g+w docs/       # Recursive: add group write to all files in docs/

# chown: change file owner and group
chown alice file.txt                    # Change owner to alice
chown :devops file.txt                  # Change group only
chown alice:devops file.txt             # Change both
chown -R alice:devops directory/        # Recursive

# chgrp: change group only
chgrp devops file.txt

# View current ownership
ls -l
# -rw-r--r-- 1 alice devops 1234 Jan 17 10:00 file.txt

# Verify user and group information
id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),1002(devops)

# View current umask
umask
# Output: 0022

# How umask works:
# Default file permission = 666 - umask
# Default directory permission = 777 - umask

# umask 022 (default):
# Files: 666 - 022 = 644 (rw-r--r--)
# Directories: 777 - 022 = 755 (rwxr-xr-x)

# umask 077 (secure):
# Files: 666 - 077 = 600 (rw-------)
# Directories: 777 - 077 = 700 (drwx------)

# Set umask temporarily
umask 077

# Set permanently (add to ~/.bashrc)
echo "umask 077" >> ~/.bashrc

# Check umask effect
touch newfile.txt
mkdir newdir
ls -ld newfile.txt newdir/

# SUID (Set User ID) - runs with owner's privileges
# Numeric: 4xxx (e.g., 4755)
# Symbolic: u+s
chmod u+s /usr/bin/passwd
# -rwsr-xr-x (s instead of x for owner)

# SGID (Set Group ID) - runs with group's privileges
# Numeric: 2xxx (e.g., 2755)
# Symbolic: g+s
chmod g+s shared_directory/
# drwxr-sr-x (s instead of x for group)

# Sticky Bit - only file owner can delete
# Numeric: 1xxx (e.g., 1777)
# Symbolic: o+t
chmod 1777 /tmp
# drwxrwxrwt (t instead of x for others)

# Setup practice environment
mkdir ~/permissions-lab
cd ~/permissions-lab

# Create test files
echo "Secret data" > secret.txt
echo "Public data" > public.txt
mkdir private_dir shared_dir

# Make secret.txt readable only by you (600)
chmod 600 secret.txt
ls -l secret.txt
# -rw-------

# Make public.txt readable by everyone (644)
chmod 644 public.txt
ls -l public.txt
# -rw-r--r--

# Make private_dir accessible only by you (700)
chmod 700 private_dir
ls -ld private_dir
# drwx------

# Test access
cat secret.txt           # Works (you own it)
sudo -u nobody cat secret.txt  # Fails (Permission denied)

# Create a shared directory for a team
sudo groupadd project-team
sudo usermod -aG project-team $USER

# Create shared directory with group permissions
mkdir team_project
chown :project-team team_project
chmod 770 team_project
ls -ld team_project
# drwxrwx--- 2 user project-team 4096 Jan 17 10:00 team_project/

# Allow members to edit each other's files
chmod g+s team_project
ls -ld team_project
# drwxrws--- (notice the s)

# Simulate web server structure
mkdir -p webapp/{public,private,logs}

# Public files (755 for directories, 644 for files)
echo "<h1>Welcome</h1>" > webapp/public/index.html
chmod 755 webapp/public
chmod 644 webapp/public/index.html

# Private config (600 - only owner)
echo "DB_PASSWORD=secret" > webapp/private/config.env
chmod 600 webapp/private/config.env

# Logs (app can write, others can't read)
touch webapp/logs/app.log
chmod 755 webapp/logs      # Directory: enter but not list
chmod 640 webapp/logs/app.log  # Owner read/write, group read only

# Verify security
ls -lR webapp/

#!/bin/bash
# secure_share_setup.sh - Set up a secure shared directory structure

echo "Setting up secure file sharing system..."

# Create directory structure
mkdir -p /var/share/{incoming,processing,completed,audit}

# Set ownership
chown -R root:staff /var/share

# Set permissions
# Incoming: Anyone can drop files, but only owners can read back
chmod 1733 /var/share/incoming   # Sticky bit + write for all

# Processing: Staff group can read/write
chmod 2770 /var/share/processing  # SGID + group read/write

# Completed: Staff can read, only admins can write
chmod 2750 /var/share/completed

# Audit: Only root can access
chmod 700 /var/share/audit

# Create test users
echo "Creating test users..."
sudo useradd -m -G staff alice
sudo useradd -m -G staff bob
sudo useradd -m external_user

echo "=== Permission Summary ==="
ls -ld /var/share/*

echo ""
echo "Testing access..."
sudo -u alice touch /var/share/incoming/alice_file.txt
echo "✓ alice can write to incoming"

sudo -u bob touch /var/share/processing/bob_file.txt
echo "✓ bob can write to processing"

sudo -u external_user touch /var/share/incoming/external_file.txt
echo "✓ external can write to incoming"

echo ""
echo "Security check:"
ls -la /var/share/incoming/
echo "Note: Users can't delete others' files (sticky bit)"