0

It is known that most Linux systems have some sort of file permissions. But what is responsible for defining them? The operating system, the filesystem, other thing?

Firstly, I thought that it is the filesystem (ext3, NTFS etc.). This is suggested by this Wikipedia's article, as there are used phrases like "file system permissions". But surprisingly, in the article it is also mentioned that:

Unix-like and otherwise POSIX-compliant systems, including Linux-based systems and all macOS versions, have a simple system for managing individual file permissions, which in this article are called "traditional Unix permissions".

And that suggests that permissions are a thing managed by the operating system (at least POSIX-compliant systems, whatever that might exactly mean). This is also suggested by this linfo article on file permissions.

What is more, this Red Hat documentation on ACLs tells that:

The Red Hat Enterprise Linux kernel provides ACL support for the ext3 file system and NFS-exported file systems. ACLs are also recognized on ext3 file systems accessed via Samba.

what would suggest that ACLs – that is, a kind of file permissions – are somehow defined in the Linux kernel.

And I am confused about that.

Improve this question
10
  • 2
    You are combining two different things. "Traditional Unix permissions" are only a simple bitmask field, stored in the file's metadata along with modification timestamps, etc. ACLs are newer and allow much finer control, including layered permissions, e.g. this group can write but not that one guy in the group.
    – Aaron D. Marasco
    Oct 16, 2018 at 0:32
  • 2
    (Then on top of all that there's also SELinux permissions as well...)
    – Aaron D. Marasco
    Oct 16, 2018 at 0:33
  • @AaronD.Marasco, thanks. That is possible that I am combining these things… I am trying to understand file permissions as broadly as it can be; maybe it is not the best way. So, as these things are different, may it be that the "traditional Unix permissions" are defined by e.g. the filesystem, and the ACLs are defined e.g. by the OS?
    – Silv
    Oct 16, 2018 at 0:44
  • And I do not know, but SELinux (so, its permissions) seems to me to be a different, separate concept to file permissions, and at least for now I would rather not mix it with my question.
    – Silv
    Oct 16, 2018 at 0:48
  • 1
    All the Permissions are stored in the filesystem, OS developer or Admin user decide it. ACL controls who can read/write/execute the file, but it's stored in a weird way, two parts separately stored in filesystem structure. First part is called traditional Unix permission, second is called ACL (not "extended-part-of-ACL", just ACL, very strange). You should now notice what's weird about how we call things.
    – 炸鱼薯条德里克
    Oct 16, 2018 at 4:30

1 Answer 1

Reset to default
2

Briefly:

Let's cover the traditional permissions first. In a filesystem like ext2 and the successors, and also in the original Unix filesystem, there's a structure called an inode. It consists of a number of bytes that describe properties of a file, like where it is, how large it is, etc. The bytes that represent permissions have bits set that correspond to the permissions for the owner, the group, and the rest of the world. You can see this in ls -l, where the lowest bits directly correspond to the rwxr-xr-x etc. you see (so that would be the bit pattern 111101101). You can also see it in commands like chmod where you use this binary number in octal (so the groups of three bits each correspond to one digit).

The permission bytes are interpreted by the file system driver in the kernel (basically, the kernel uses some C data structure that matches the inode data structure).

So in that sense you can both say "the permissions are managed by the kernel" and "the permissions are stored in the file system".

ACLs work similarly, except they are more flexible, and they use a more difficult representation, and a more difficult kernel API.

Improve this answer
5
  • Thank you. The statements "the permissions are managed by the kernel" and "the permissions are stored in the file system" would half-answer my question – that is, in the sense of the "traditional permissions". If ACLs works similarly, then I understand that you mean that the above two statements are also true in the case of them? And: if I would like to say that "In Linux (in a system using the Linux kernel), the traditional file permissions depend on the filesystem that you use, e.g. ext4", would that statement be correct? (Btw: why stackexchange doesn't let me display you username here?)
    – Silv
    Oct 16, 2018 at 13:26
  • 1
    Yes, the two statements are also true for ACL. The traditional permissions are so deeply baked into Unix (Linux) that all filesystems have to implement them somehow (or fake them, like FAT), even if the file system itself has no permissions, or has a different way to storing permissions. This is different for ACLs, they are optional. The statement "traditional permissions depend on the filesystem" doesn't capture the situation adequately - depending on your PoV, they may not "depend" (because they get simulated) or they may "depend" (because they get simulated).
    – dirkt
    Oct 16, 2018 at 13:41
  • dirkt, thanks. I now more understand these dependencies. But – excuse my, emm, nit-picking – to clarify: since both Fedora and ext3 supports traditional Unix permissions, then if I would use ext3 on Fedora, what is more appropriate to say (speaking most generally): 1) "The chmod utility allows changing file permissions, which are an ext3 filesystem's feature implemented in Fedora", or 2) "The chmod utility allows changing file permissions, which are an ext3 filesystem's feature implemented in the Linux kernel used in Fedora"? (It need not be necessarily Fedora, but I currently use it.)
    – Silv
    Oct 16, 2018 at 17:39
  • 1
    All distros, including Fedora, uses the same Linux kernel (possibly configured a bit differently), so "implemented in Fedora" doesn't make sense. Distros mainly differ by their package manager, default configuration, and versions of applications they offer. As to whether traditional permissions are an "ext2/ext3/ext4 filesystem feature" or a "Linux kernel feature" or a "Unix feature", see above. I'd also recommend not to get hung up on phrasings describing the situation, that easily leads to hair splitting (as you can see). It's a bit pattern on disk interpreted by the kernel.
    – dirkt
    Oct 17, 2018 at 5:41
  • When it comes to Linux kernel itself, I have to learn a bit yet, especially what are the exact dependencies between the kernel and a distribution. According to what you have said, I think the statement nr 2) fits better (in the sense of Fedora-specific kernel configuration, as you have pointed out). Since for now it seems that I do not have any further specific questions, I think that I can accept your answer (although I still have some doubts). Many thanks to have patience for me!
    – Silv
    Oct 17, 2018 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .