Unit 5: Who May Do What

A computer with people on it

Linux was built for machines that lots of people share, and it never stopped working that way — even when the only person is you.

So every file belongs to somebody, and every file has rules about who else may touch it.

Terminal

kid@alguni:~$ whoami
kid
kid@alguni:~$ cut -d: -f1 /etc/passwd
root
daemon
nobody
kid

The one who can do anything

One user is different. root is the administrator, and the rules do not apply to it — it can read, change or delete anything on the machine.

That is why nobody works as root all day. A typo as kid breaks your homework; the same typo as root breaks the computer.

Locked out

Some of this machine is not yours. /var/log/syslog is the computer's own diary, and it belongs to root.

Read it and you are told no. Not "file not found" — the file is right there. Permission denied is a different message and it means something different.

Terminal

kid@alguni:~$ ls -l /var/log/syslog
-rw-r----- 1 root root 25 Jan  1 09:00 /var/log/syslog
kid@alguni:~$ cat /var/log/syslog
cat: /var/log/syslog: Permission denied

Reading the column

The first thing on an ls -l line looks like nonsense. It is really a sentence in ten characters.

-rw-r--r--

The first one says what it is: - a file, d a directory, l a shortcut. The other nine are three groups of three.

Terminal

kid@alguni:~$ ls -l
total 8
-rw-r--r-- 1 kid kid    6 Jan  1 09:00 notes.txt
drwxr-xr-x 2 kid kid 4096 Jan  1 09:00 photos

Three groups of three

Each group is rwx — read, write, execute — and a dash means "not allowed".

The first group is you (the owner). The second is your group. The third is everybody else.

So -rw-r--r-- says: a file; I may read and change it; everybody else may only read it.

What x means for a folder

For a file, x means "this can be run as a program".

For a folder it means something else: "you may go into it". A folder with r but no x lets you see the names inside and nothing more. That is why folders are almost always rwxr-xr-x.

Terminal

kid@alguni:~$ ls -l
total 4
drwxr-xr-x 2 kid kid 4096 Jan  1 09:00 shed
kid@alguni:~$ ls -l shed
total 4
-rw-r--r-- 1 kid kid 6 Jan  1 09:00 tools.txt

chmod, in letters

chmod changes the mode — the ten letters.

Say who (u you, g group, o others, a all), then + to add or - to take away, then which of rwx.

chmod o-r diary.txt — others may no longer read it.

Terminal

kid@alguni:~$ ls -l diary.txt
-rw-r--r-- 1 kid kid 11 Jan  1 09:00 diary.txt
kid@alguni:~$ chmod o-r diary.txt
kid@alguni:~$ ls -l diary.txt
-rw-r----- 1 kid kid 11 Jan  1 09:00 diary.txt
kid@alguni:~$ chmod g-r diary.txt
kid@alguni:~$ ls -l diary.txt
-rw------- 1 kid kid 11 Jan  1 09:00 diary.txt

Locking yourself out

You can take permissions away from yourself, and Linux will let you.

Take away your own r and your own file becomes unreadable to you. It is still yours, so you can always give it back — but until you do, cat says no.

Terminal

kid@alguni:~$ chmod u-r plans.txt
kid@alguni:~$ cat plans.txt
cat: plans.txt: Permission denied
kid@alguni:~$ chmod u+r plans.txt
kid@alguni:~$ cat plans.txt
secret plans

Four, two, one

There is a shorter way to say the same thing, and everybody uses it.

read is 4, write is 2, execute is 1. Add up the ones you want and you get a single digit for that group.

rw- is 4 + 2 = 6. r-x is 4 + 1 = 5. r-- is 4. rwx is 7.

Three digits, three groups

One digit for you, one for the group, one for everybody else.

644 = rw-r--r--, which is the usual for a file.
755 = rwxr-xr-x, the usual for a folder or a program.
600 = rw-------, private.

Terminal

kid@alguni:~$ chmod 644 a.txt
kid@alguni:~$ ls -l a.txt
-rw-r--r-- 1 kid kid 6 Jan  1 09:00 a.txt
kid@alguni:~$ chmod 600 a.txt
kid@alguni:~$ ls -l a.txt
-rw------- 1 kid kid 6 Jan  1 09:00 a.txt
kid@alguni:~$ chmod 755 a.txt
kid@alguni:~$ ls -l a.txt
-rwxr-xr-x 1 kid kid 6 Jan  1 09:00 a.txt

The x that matters most

Remember from unit 1: a command is just a file in /usr/bin. So what makes ls a *program* and your homework not one?

One letter. ls has x on it and your homework does not.

(On a real computer the size would be a few hundred thousand. On this one the programs are hollow — their insides live in the app rather than on the disk — so it says 0. The x is the part that is real.)

Terminal

kid@alguni:~$ ls -l /usr/bin/ls
-rwxr-xr-x 1 root root 0 Jan  1 09:00 /usr/bin/ls

Your first command

Put some commands in a file and it is still just text. Try to run it and you are refused, because it has no x.

chmod +x adds it — and then the file *is* a command. That is the whole trick, and unit 8 is built on it.

Terminal

kid@alguni:~$ cat hello.sh
echo hello from my own command
kid@alguni:~$ ./hello.sh
bash: ./hello.sh: Permission denied
kid@alguni:~$ chmod +x hello.sh
kid@alguni:~$ ls -l hello.sh
-rwxr-xr-x 1 kid kid 31 Jan  1 09:00 hello.sh
kid@alguni:~$ ./hello.sh
hello from my own command

Why the dot slash

Why ./hello.sh and not just hello.sh?

Because when you type a bare name, the shell looks for it in /usr/bin and the other places on its list — not where you are standing. ./ means "the one right here". Unit 8 explains the list.

Asking to be root

Some jobs really do need root. sudo runs one command as root, and then you are yourself again.

On a real computer it asks for your password first. Ours does not — but the habit is the same, and the rule is the same: read the line twice before you put sudo in front of it.

Terminal

kid@alguni:~$ cat /var/log/syslog
cat: /var/log/syslog: Permission denied
kid@alguni:~$ sudo cat /var/log/syslog
boot: everything is fine