Owners and groups

First, three tools for checking who you are.

~ $ whoamilearner~ $ iduid=100(learner) gid=101(learner) groups=101(learner)~ $ groupslearner

Let us read what id says.

• uid=100 — your number (user id)
• gid=101 — the number of your main group (group id)
• groups=101 — the list of groups you are in

A person has both a name and a number. What Linux actually looks at is the number, and the name is decoration for humans. ls -l shows you a name by looking it up from the number.

Here is the most important thing today. Of the nine characters, only three apply to you.

They are chosen from the top, and only the first one that matches is used.

1. Are you the owner? → use the owner's three characters. Done
2. If not, are you in that group? → the group's three. Done
3. If neither → the three for everyone else

The part to notice is "done". Nothing gets added together.

So of -rw-r--r--, you as the owner use only rw-. The group's r-- and everyone else's r-- have nothing to do with you.

That may sound obvious, but it can produce unexpected results. The next slide shows one.

Let us make a strange set of permissions.

~ $ chmod 077 memo.txt~ $ stat -c %A memo.txt----rwxrwx~ $ cat memo.txtcat: can not open memo.txt: Permission denied

You cannot read it. The group and everyone else have all of rwx, and you, the owner, cannot.

Why? Because you are the owner, so you are judged on the owner's slot (---) and that is that. Nothing considers "but I could read it as one of the others".

That is what "only one is chosen" means. You can build the slightly odd situation where being the owner works against you.

You would not really make permissions like this, but knowing the mechanism stops you misreading. Thinking "everyone else has permission so it is fine" while you alone are turned away is exactly the accident it avoids.

The command for changing the owner is chown (change owner). But type it and you are refused.

~ $ chown daemon memo.txtchown: memo.txt: Operation not permitted

It is your file, and you cannot give it away. Notice this is different wording from Permission denied. It means "that operation is not allowed", and it appears when you run into something only root can do.

Why forbid it? To stop things being foisted on people.

If anyone could give a file away, these awkward things would be possible.

• push a huge file onto someone else to dodge a limit on space
• make an inconvenient file someone else's and shift the blame

So giving away is an administrator's operation. chgrp (change the group) is the same: you cannot hand it to a group you are not in.

Become root in the next chapter and you can do both.

One more thing to check. Only the owner can change permissions.

~ $ chmod 644 /etc/passwdchmod: /etc/passwd: Operation not permitted

/etc/passwd is 644 already, so the instruction should change nothing. Refused anyway, because you have no standing to change it at all.

Something important shows up here. Even with no w in ls -l, the owner can add the w.

chmod u-w memo.txt   # make it unwritablechmod u+w memo.txt   # make it writable again

So for your own files, permissions are a fence against slips, not a wall that shuts you in.

They become a real wall when you are not the owner. You cannot rewrite /etc/passwd not because there is no w, but because it belongs to root.

find has flags for narrowing by owner. Today's knowledge adds to the find of chapter 3.

find . -user learner       # minefind . -group learner      # my group'sfind /etc -user root        # root's

On a real server you use it like this.

find /home -user taro       # find the files of someone who leftfind / -user nobody         # find things with a suspicious owner

Searching by owner is what lets you tidy up and investigate.

You can also read the registers themselves. Who exists is in /etc/passwd and what groups exist is in /etc/group, both readable by anybody.

grep learner /etc/passwd

You should find your own line. Read what it says in the questions.

Your home holds memo.txt, diary.txt and docs/. All of them yours.

Several of today's questions fail on purpose. Being refused is the right answer for chown and chgrp, so an error is fine. The point is to read the words you are refused with.

Learn to tell two of them apart.

The first you can fix with chmod; the second you cannot. Only becoming the administrator will do, which is why there is a next chapter.