Red Hat System Administration I · RH124

Chapter 11

Controlling Access to Files

rwx permissions · chmod & chown · umask · Special bits · ACLs

CIS126RH — Mesa Community College

Chapter Objective

Interpret and modify standard Linux file permissions and ownership, control default permissions with umask, and use special permissions and ACLs for more advanced access control.

Key Commands

ls -l
chmod
chown
chgrp
umask
setfacl
getfacl

The Permission Model

Every file and directory on Linux has an owner (a user) and a group, along with three sets of permissions: for the owner, for the group, and for everyone else.

Class	Applies To
Owner (u)	The user who owns the file
Group (g)	Members of the file's group
Other (o)	Everyone else on the system

Permission	Letter	On a File	On a Directory
Read	`r`	View file contents	List directory contents
Write	`w`	Modify file contents	Create, rename, or delete entries inside
Execute	`x`	Run the file as a program/script	Enter (cd into) the directory

Exam Note — Execute permission on a directory is what actually lets you traverse into it — read permission alone lets you list names but not access anything inside.

Reading Permissions with ls -l

$ ls -l notes.txt
-rw-r--r--. 1 sarah developers 482 Aug  5 09:14 notes.txt

Field	Meaning
`-`	File type (`-` file, `d` directory, `l` symlink)
`rw-`	Owner's permissions: read + write, no execute
`r--`	Group's permissions: read only
`r--`	Other's permissions: read only
`sarah`	Owning user
`developers`	Owning group

Tip — The Trailing Dot — A trailing . after the permission string (as in -rw-r--r--.) indicates the file has an SELinux context associated with it — normal on RHEL, and covered in more depth in a later chapter.

Changing Permissions — Symbolic Mode

chmod supports two styles of specifying permissions: symbolic and numeric (octal).

# Add execute permission for the owner
chmod u+x script.sh

# Remove write permission for group and other
chmod go-w notes.txt

# Set exact permissions for all three classes
chmod u=rw,g=r,o= notes.txt

# Add read permission for everyone
chmod a+r notes.txt

Changing Permissions — Numeric (Octal) Mode

Each permission has a numeric value: read = 4, write = 2, execute = 1. Add them together for each class.

Value	Permissions
7	rwx (4+2+1)
6	rw- (4+2)
5	r-x (4+1)
4	r-- (4)
0	--- (none)

# Owner: rwx, Group: r-x, Other: r-x — common for scripts/directories
chmod 755 deploy.sh

# Owner: rw-, Group: r--, Other: --- — common for private config files
chmod 640 secrets.conf

# Apply recursively to a directory and everything inside it
chmod -R 755 /var/www/html

Warning — -R Applies to Everything Underneath — A recursive chmod sets the same mode on files and directories alike, which is rarely what you actually want (directories typically need execute permission to be traversable, in a way individual files don't). Consider find with -type f / -type d for more precise recursive changes.

Changing Ownership

# Change the owning user
chown sarah notes.txt

# Change the owning group only
chgrp developers notes.txt

# Change both user and group at once
chown sarah:developers notes.txt

# Change ownership recursively
chown -R sarah:developers /home/sarah/project

Note — Only root can change a file's owning user. A regular user may change the group of their own files, but only to a group they already belong to.

Default Permissions and umask

New files and directories don't start with every permission granted — the umask subtracts permissions from a maximum starting point (666 for files, 777 for directories) as each one is created.

# Show the current umask
umask

# Common default: 022
# New file:   666 - 022 = 644 (rw-r--r--)
# New dir:    777 - 022 = 755 (rwxr-xr-x)

# Set a stricter umask for the current shell session
umask 027

Tip — Files Never Get Execute by Default — Even with a permissive umask, newly created plain files never automatically get execute permission — only directories and explicitly executable programs do. That's a safety feature, not a umask quirk.

Special Permissions

Bit	Symbol	On a File	On a Directory
SUID (4000)	`s` in owner's execute slot	Runs with the file owner's privileges, not the invoking user's	No effect
SGID (2000)	`s` in group's execute slot	Runs with the file's group privileges	New files inside inherit the directory's group
Sticky bit (1000)	`t` in other's execute slot	No standard effect	Only the file's owner (or root) can delete files inside, even with directory write access

Setting Special Permissions

# Set SUID (e.g. why /usr/bin/passwd works for regular users)
chmod u+s /usr/bin/passwd

# Set SGID on a shared project directory so new files inherit its group
chmod g+s /srv/shared-project

# Set the sticky bit — this is exactly how /tmp is configured
chmod +t /tmp

# Numeric form: leading 4th digit
chmod 4755 /usr/bin/passwd
chmod 2775 /srv/shared-project
chmod 1777 /tmp

Warning — SUID Is Powerful and Risky — A SUID root binary runs with full root privileges regardless of who invokes it. Setting SUID carelessly — especially on a script — is one of the most common ways a system gets a serious privilege-escalation vulnerability.

Access Control Lists (ACLs)

Standard permissions only support one owner and one group. When you need finer-grained control — like giving a second specific user access without changing group membership — use ACLs.

# Grant an additional user read+write access to a file
setfacl -m u:miguel:rw notes.txt

# Grant an additional group read access
setfacl -m g:auditors:r notes.txt

# View the ACL entries on a file
getfacl notes.txt

# Remove a specific ACL entry
setfacl -x u:miguel notes.txt

# Remove all ACL entries
setfacl -b notes.txt

Note — A file with ACL entries shows a + after its permission string in ls -l (for example, -rw-rw-r--+) — a visual cue that getfacl is worth checking for the full picture.

Key Terms for Chapter 11

owner: The user assigned to a file, with the associated owner permission set
umask: A mask subtracted from maximum permissions to determine defaults for new files and directories
SUID: Special permission causing an executable to run with its owner's privileges
SGID: Special permission causing an executable to run with its group's privileges, or new files in a directory to inherit its group
sticky bit: Special permission restricting file deletion in a directory to each file's own owner
ACL (Access Control List): Extended permissions allowing specific additional users or groups beyond the standard owner/group/other model
chmod: Command that changes a file's or directory's permissions
chown / chgrp: Commands that change a file's owning user and/or group

Review Questions

What does execute permission actually allow on a directory, as opposed to on a regular file?
Write a chmod command using numeric mode that sets a file to owner: read/write, group: read-only, other: no access.
What's the difference between chmod and chown?
With a umask of 022, what permissions will a newly created file have by default?
What does the SGID bit do when set on a shared directory?
What is the sticky bit, and where is it classically applied on a stock RHEL system?
You need to give one additional user access to a file without changing its group or adding them to a new group. What feature would you use, and what command sets it?

1 / 13