4.1.2. File Permissions, ACLs, and File Attributes

💡 First Principle: Standard Unix permissions encode three access categories (owner, group, others) × three permission types (read, write, execute) in a 9-bit mask. This model is simple and universal — but it only allows one owner and one group per file. ACLs (Access Control Lists) extend this to allow per-user and per-group permissions on the same file.

Permission Bits — Reading ls -l Output:

-rwxr-xr-- 1 alice devops 4096 Jan 1 12:00 script.sh
^---^---^--
|   |   └── Others: read only (r--)
|   └────── Group (devops): read + execute (r-x)
└────────── Owner (alice): read + write + execute (rwx)

File type: - (regular file), d (directory), l (symlink), b (block), c (character)

chmod — Change Permissions:

# Symbolic mode
chmod u+x script.sh             # Add execute for owner
chmod g-w file.txt              # Remove write from group
chmod o=r file.txt              # Set others to read-only
chmod a+r file.txt              # Add read for all (a = all)
chmod u+x,g-w,o= file.txt       # Multiple changes at once

# Octal mode (faster for setting absolute permissions)
chmod 755 script.sh             # rwxr-xr-x (owner: 7=rwx, group: 5=r-x, others: 5=r-x)
chmod 644 config.txt            # rw-r--r-- (standard file)
chmod 600 private.key           # rw------- (private key — owner only)
chmod 700 ~/.ssh                # rwx------ (ssh directory)
chmod -R 755 /var/www/html      # Recursive

# Octal cheat sheet
# 4=read  2=write  1=execute
# 7=rwx  6=rw-  5=r-x  4=r--  0=---

chown and chgrp:

chown alice file.txt            # Change owner
chown alice:devops file.txt     # Change owner and group
chown :devops file.txt          # Change group only
chown -R alice:devops /data/    # Recursive
chgrp devops file.txt           # Change group only

Special Permission Bits:

chmod u+s /usr/bin/passwd       # Set SUID (shows as 's' in owner execute position)
chmod g+s /var/shared/          # Set SGID on directory (shared folder pattern)
chmod +t /tmp                   # Set sticky bit (shows as 't' in others execute position)
chmod 4755 /usr/bin/myutil      # SUID + rwxr-xr-x
chmod 2775 /var/project/        # SGID + rwxrwsr-x
chmod 1777 /tmp                 # Sticky + rwxrwxrwx

umask — Default Permission Mask:

umask                           # Show current mask (e.g., 0022)
umask 027                       # Set new mask (session only)
# Permissions = base & ~umask (bitwise; for common masks like 022/027 this looks like subtraction)
# Files: 666 - 022 = 644 (rw-r--r--)
# Dirs:  777 - 022 = 755 (rwxr-xr-x)
# umask 027: Files=640, Dirs=750 (group can read, others nothing)

ACLs — Access Control Lists:

getfacl file.txt                # Show ACL entries
setfacl -m u:bob:rx file.txt    # Give bob read+execute
setfacl -m g:devops:rw file.txt # Give devops group read+write
setfacl -m o::- file.txt        # Remove all others permissions
setfacl -x u:bob file.txt       # Remove bob's ACL entry
setfacl -b file.txt             # Remove all ACL entries
setfacl -R -m u:bob:rx /data/   # Recursive ACL
setfacl -d -m g:devops:rw /project/  # Default ACL (applies to new files)

# Files with ACLs show '+' after permissions in ls -l:
# -rw-rw-r--+ 1 alice alice 100 file.txt

File Attributes (chattr/lsattr):

chattr +i file.txt              # Immutable — cannot be modified/deleted/renamed (even by root)
chattr +a log.txt               # Append-only — can only append, not overwrite
chattr -i file.txt              # Remove immutable flag
lsattr file.txt                 # Show attributes
lsattr -R /etc/                 # Recursive

Immutable files are a powerful integrity mechanism — even a root-level attacker who compromises the system cannot modify /etc/passwd if it has the immutable flag set (they'd need to remove the flag first, which creates an audit trail).

⚠️ Exam Trap: ACLs are only active if the filesystem is mounted with ACL support. On ext4 and xfs, ACL support is built-in. You can verify with tune2fs -l /dev/sda1 | grep "Default mount" for ext4. Files with ACLs show a + after the permission string in ls -l output — this is the indicator that a standard permission display is incomplete.

Reflection Question: A directory /var/project is owned by alice:devops. You need bob (not in the devops group) to have read and execute access to the directory but no write access, without changing the directory's owner or group. What is the correct approach?