5.1 Structure of File Permissions
There are three kinds of permissions that a user can have for a file:
- permission to read the file. For directories, this means permission to
list the contents of the directory.
- permission to write to (change) the file. For directories, this means
permission to create and remove files in the directory.
- permission to execute the file (run it as a program). For directories,
this means permission to access files in the directory.
There are three categories of users who may have different permissions
to perform any of the above operations on a file:
- the file's owner;
- other users who are in the file's group;
- everyone else.
Files are given an owner and group when they are created. Usually the
owner is the current user and the group is the group of the directory
the file is in, but this varies with the operating system, the
file system the file is created on, and the way the file is created. You
can change the owner and group of a file by using the chown and
chgrp commands.
In addition to the three sets of three permissions listed above, a
file's permissions have three special components, which affect only
executable files (programs) and, on some systems, directories:
- Set the process's effective user ID to that of the file upon execution
(called the setuid bit). No effect on directories.
- Set the process's effective group ID to that of the file upon execution
(called the setgid bit). For directories on some systems, put
files created in the directory into the same group as the directory, no
matter what group the user who creates them is in.
- prevent users from removing or renaming a file in a directory
unless they own the file or the directory; this is called the
restricted deletion flag for the directory.
For regular files on some systems, save the program's text image on the
swap device so it will load more quickly when run; this is called the
sticky bit.
In addition to the permissions listed above, there may be file attributes
specific to the file system, e.g: access control lists (ACLs), whether a
file is compressed, whether a file can be modified (immutability), whether
a file can be dumped. These are usually set using programs
specific to the file system. For example:
- ext2
- On GNU and GNU/Linux the file permissions
(“attributes”) specific to
the ext2 file system are set using chattr.
- FFS
- On FreeBSD the file permissions (“flags”) specific to the FFS
file system are set using chrflags.
Although a file's permission “bits” allow an operation on that file,
that operation may still fail, because:
- the file-system-specific permissions do not permit it;
- the file system is mounted as read-only.
For example, if the immutable attribute is set on a file,
it cannot be modified, regardless of the fact that you
may have just run chmod a+w FILE
.