Users and rights

Introduction

Files and directories on the Linux system belong to an owner and a group. You can set read, write and execute permissions on a file or directory for owner, group and others. Users can belong to one or more groups. The command chmod is used to set the permissions, the command chown to change the owner and the command chgrp to change the group.

• https://wiki.archlinux.org/index.php/Users_and_Groups
• https://help.ubuntu.com/lts/serverguide/user-management
• http://www.cyberciti.biz/tips/unix-or-linux-commands-for-changing-user-rights.html
• http://www.cyberciti.biz/faq/how-to-use-chmod-and-chown-command/
• http://www.thinkplexx.com/learn/article/unix/command/chmod-permissions-flags-explained-600-0600-700-777-100-etc

Show ownership and permissions

ls -l /path/to/files/*

Example output:

Directory	User	Group	Other	Number of links	Owner	Group	Size	Modified date/time	Object name
-	rwx	rw-	r--	1	wilbert	users	464843	Apr 6 16:09	file1.txt
-	rwx	rwx	r--	1	wilbert	users	1398792	Apr 6 16:09	file2.sh
d	rwx	rw-	r--	2	wilbert	users	4096	Apr 17 23:16	directory
-	rwx	rw-	r--	2	wilbert	users	93	Apr 17 23:16	link_to_file1.txt

Show, add, remove and modify users and groups

List groups and its users

getent group groupname1

Format:

groupname1:x:group_id:username1,username2,etc

Disable (lock) the root account:

sudo passwd -l root

Enable the root account by specifying a password for it:

sudo passwd

Add a user account and home folder, delete user:

sudo adduser username1

Delete user:

sudo deluser username1

Lock (l) or unlock (u) a user account:

sudo passwd -l username1
sudo passwd -u username1

Add or delete a group:

sudo addgroup groupname1
sudo delgroup groupname1

Add an existing user to a group:

sudo adduser username1 groupname1

Remove user from a group:

sudo deluser username1 groupname1

Change permissions on files and directories

Flag method

User/group:

• u user/owner
• g group
• o other

Permissions:

• r read
• w write
• x execute

Options:

• -R full recursive
• + add permission
• - remove permission

Examples:

sudo chmod -R u+rwx /path/to/files
sudo chmod -R go-x /path/to/files

Octal method

There are four OCTAL (0..7) digits, which control permissions. Mostly only three are used, more info on the first digit can be found in paragraph #Create a shared folder and use of the sgid bit.

Permissions:

1 = execute (x)
2 = write (w)
4 = read (r)

The octal number is the sum of those free permissions, i.e.

1+2+4 = 7 : can execute, write and read
  2+4 = 6 : can write and read

Permissions are set for owner, group and others, depending on the position of the digit:

who:	owner			group			others
may:	x	w	r	x	w	r	x	w	r
add:	1	2	4	1	2	4	1	2	4

Examples:

chmod 600 file – owner r,w
chmod 700 file – owner r,w,x
chmod 777 file – all can r,w,x

Change ownership of files and directories

Note: option -R (recursive) applies the change all files and (sub)directories.

Owner:

sudo chown username1 /path/to/file_or_dir
sudo chown -R username1 /path/to/dir

Group:

sudo chgrp -R groupname1 /path/to/file_or_dir
sudo chgrp -R groupname1 /path/to/dir

Owner+group:

sudo chown username1:groupname1 /path/to/file_or_dir
sudo chown -R username1:groupname1 /path/to/dir

Create a shared folder and use of the sgid bit

Share files among users using a group, protect from others and keep new items in the group using the sgid bit.

Create a group 'group1' and add user 'user1' and 'user2'

sudo usermod -a -G group1 user1
sudo usermod -a -G group1 user2

Set group for all folders, subfolders and files in /home/group1 to 'group1':

sudo mkdir /home/group1
sudo chgrp -R group1 /home/group1

Set sgid-bit for the directories. The sgid-bit makes sure that new items in the directory will belong to the same group as the directory and not some default group.

sudo find /home/group1 -type d -exec chmod 2770 {} \;

Here 2770 means:

• 2 : sgid-bit
• 7 : owner rwx
• 7 : group rwx
• 0 : others have no access

Finally add read and write access for user and group for all files:

sudo find /home/group1 -type f -exec chmod ug+rw {} \;

There is also the suid-bit (4) that allows a program to have more privileges than the user that is executing the program.

More info on sgid (2) and suid (4):

• https://en.wikipedia.org/wiki/Setuid

Immutable

Set the immutable-attribute to prevent any changes to the item or it's attributes. It will, for example, prevent writing to a folder that is meant as a mountpoint. Note that you have to umount first:

Make immutable:

sudo umount /media/data
sudo chattr +i /media/data
sudo mount /media/data

Remove immutable:

sudo umount /media/data
sudo chattr +i /media/data
sudo mount /media/data

See also

• Allow a user to sudo execute a script without password