Unix users, groups, and permissions

Question

I don't understand unix users, groups, permissions, etc. For example, things managed by the chmod, chgrp, usermod, groupadd, etc. commands. How do all these things work?

Answer 1

I'd start here: Filesystem Permissions

Answer 2

It's all a method of granting various access to a file.

User is an individual user. Use this when you want to give one person and only one person access. Group is more than one user. Use this when you want to give several people access. Put them all in a unique group and set that as the group owner. Other is for anybody who isn't the user or group owner.

A file always must have a user owner and a group owner. Often each user will have a group named after them with only them as a member. This way you can have a file that is truly owned by a single individual.

The permissions are as follows

• R -- Allows a user to read the contents of the file
• W -- Allows a user to write to the file
• X -- Allows a user to execute a file as a program

R and W are probably pretty self explanatory. X may be a little confusing. In some situations you only want certain users to execute certain programs. For example, perhaps you don't want regular users to execute fdisk or format. Removing the X permission from other will allow you to restrict it like that.

File permissions when listed are displayed as something like rwxr-xr-x. This is actually three groups of permissions. The first three are for the user owner. The second three are for the group owner and the last three are for all other users. A letter indicates the permission is granted, while a dash indicates that permission is denied. In the example I used the user owner can read the file, write new contents and execute the file as a program. Group and other however may only read and execute.

Some common "gotchas"

• Making a file write only (-w-) is probably not what you want
• In order to execute you must also have read. That is, --x is useless on a file, it must be r-x.
• There are other permissions than these which can be stored in ACLs. If your operating system and/or filesystem support POSIX, NFSv4 or extended ACLs you may need to also check permissions there
• Permissions as they apply to directories is slightly different, but close enough that you don't need to worry about that for now except that you should always enable r and x together on directories.

Answer 3

This post - Unix / Linux: Beginner's Guide to File and Directory Permissions is a good intro.