Change permissions with symbols (`chmod u+x`)

An instruction to chmod is built from three parts stuck together.

chmod  u   +   x   run.sh       ^   ^   ^     to whom  what  to what

The order is always "to whom, what to do, to what". Rather than learning them piecemeal, look at the three tables once.

chmod is short for change mode. The word mode means "the bundle of permissions", and it will come up again and again.

There are three things to do.

+ and - are plain enough. The one to watch is =.

chmod u=r memo.txt

That means "the owner can only read", and any write permission disappears. Where + and - move you from where you are, = ignores where you are and states the answer.

When in doubt use + and -. They leave the current state alone, which is safer.

Separate them with commas and you can give several at once.

chmod u=rw,go= secret.txt

Read it: "the owner gets read and write, the group and everyone else get nothing". Writing nothing after go= is what means "take it all away".

The result is -rw-------, the shape of a secret file, the same as the /etc/shadow you saw last lesson.

Do not put a space around the comma. A space makes the shell split there and take the rest for another file name. Chapter 10 covers that under expansion.

You can list as many files as you like.

chmod a-w memo.txt secret.txt

Both end up with nobody able to write.

Wildcards work too.

chmod u+x *.sh

That means "set the execute mark on every file ending in .sh", a shape you use a lot after making a batch of scripts.

The Unix way of "do it to everything you listed" turns up here as well. Remember that rm, cp and grep were all the same.

Take a permission away and the things you cannot do multiply visibly. Failing on purpose is the clearest way to see it.

Look at the wording of the errors too. Who is speaking changes the sentence.

cat: can not open secret.txt: Permission denied-sh: can not create memo.txt: Permission denied

The first is cat speaking. The -sh of the second is the shell. >> was the shell's job, so the shell is what got refused. The "> is done by the shell, not the command" from chapter 4 pays off here.

Your home has three files and one box.

• run.sh — the one you want to run (it says echo it works)
• memo.txt — an ordinary note
• secret.txt — one you want kept secret
• docs/ — a box (untouched in this lesson)

In every question, do not forget to check with ls -l or stat -c %A after you change something. Permissions work out of sight, and the habit of checking protects you.

One promise. Do not type chmod 777. By the end of this chapter you will be able to explain for yourself why it is too strong.