Permissions

INPUT · Slides

Read the nine characters of `ls -l`

01 / 07

What `Permission denied` really is

This is the line that first breaks people at the terminal.

~ $ ./run.sh-sh: ./run.sh: Permission denied

"Permission denied." But it never says who is not allowing whom. With no way to fix it, you end up typing the chmod 777 you found in a search.

This chapter puts an end to that. Today is only about being able to read. You change nothing.

Once you can read them, Permission denied stops being a mystery error and becomes a specific report: this particular thing is missing.

02 / 07

`ls -l` has seven columns

Add -l (long) and you get more than the name.

~ $ ls -l memo.txt-rw-r--r--  1 learner  learner  52 Aug 21 08:47 memo.txt

From the left it goes like this.

Position	What it is
`-rw-r--r--`	the kind and the permissions (today's subject)
`1`	the number of links
`learner`	the owner
`learner`	the group
`52`	the size in bytes
`Aug 21 08:47`	when it last changed
`memo.txt`	the name

The only one you need to learn is the first. The rest you can just look at.

03 / 07

The first character is the kind

The first column is ten characters, but the first one is the odd one out. It is not a permission; it is the kind.

Character	Kind
`-`	an ordinary file
`d`	a directory
`l`	a symbolic link
`c`	a device handled a character at a time
`b`	a device handled in blocks

The first two are enough. Starting with d means a box, starting with - means a file.

Use ls -ld instead of ls -l to look at a directory as itself rather than its contents. ls -l docs lists what is inside, so you need the -d when you want the permissions of the box.

~ $ ls -ld docsdrwxr-xr-x    2 learner  learner        60 Aug 21 08:47 docs

04 / 07

Split the other nine into threes

Here is today's high point, and the mechanism is very simple.

-  rw-  r--  r--^   ^    ^    ^kind owner group other

Split the nine characters into three sets of three. Each set says whose permissions they are.

Set	Who
characters 1 to 3	the owner (user)
characters 4 to 6	the group
characters 7 to 9	everyone else (other)

So -rw-r--r-- reads as "the owner has rw-, the group has r--, everyone else has r--".

Once you can see the divisions, the string stops being frightening.

05 / 07

What r, w and x mean

Inside each set of three, the order and the meanings never change.

Character	Meaning
`r`	can read
`w`	can write
`x`	can execute
`-`	that permission is absent

The order is always rwx, so a - in the second position means "cannot write" and a - in the third means "cannot execute". The position alone tells you.

Back to that ./run.sh.

-rw-r--r--  run.sh

The owner has rw-, with a - in the third position. The execute mark is not set. Which is why asking it to run got you a refusal.

Not a mystery error at all. There was a proper reason.

06 / 07

Read some real ones

Reading the files that came with this Linux shows you how permissions get used differently.

File	Permissions	How to read it
`/etc/passwd`	`-rw-r--r--`	anyone can read, only the owner can write
`/etc/shadow`	`-rw-------`	nobody but the owner can do anything (it holds passwords)
`/root`	`drwx------`	the administrator's room. Nobody else can look in
`/bin/sh`	`lrwxrwxrwx`	an `l`, so it is a link (a shortcut)

Look at /etc/shadow. The last six of the nine are all -. That is the shape of a secret file. It holds the passwords, so nobody is shown a single character.

The more important a thing is, the narrower its permissions. Put the other way, reading the permissions tells you whether a file matters.

07 / 07

Now have a go

There are four things in your home.

memo.txt — an ordinary note
run.sh — the file you want to run and cannot
secret.txt — a file you want kept secret
docs/ — a directory

Today you change nothing. You only read. chmod starts in the next lesson.

There are two tools for reading: ls -l (see it in a listing) and stat -c %A (put out just the nine characters). The second is handy when you want to write it into a file later.