Each file has a set of permissions that control the kinds of access that users have to that file. The permissions for a file are also called its access mode. They can be represented either in symbolic form or as an octal number.
There are three kinds of permissions that a user can have for a file:
There are three categories of users who may have different permissions to perform any of the above operations on a file:
Files are given an owner and group when they are created. Usually the
owner is the current user and the group is the group of the directory
the file is in, but this varies with the operating system, the
filesystem the file is created on, and the way the file is created. You
can change the owner and group of a file by using the chown and
chgrp commands.
In addition to the three sets of three permissions listed above, a file's permissions have three special components, which affect only executable files (programs) and, on some systems, directories:
Symbolic modes represent changes to files' permissions as
operations on single-character symbols. They allow you to modify either
all or selected parts of files' permissions, optionally based on
their previous values, and perhaps on the current umask as well
(see section The Umask and Protection).
The format of symbolic modes is:
[ugoa...][[+-=][rwxXstugo...]...][,...]
The following sections describe the operators and other details of symbolic modes.
The basic symbolic operations on a file's permissions are adding, removing, and setting the permission that certain users have to read, write, and execute the file. These operations have the following format:
users operation permissions
The spaces between the three parts above are shown for readability only; symbolic modes can not contain spaces.
The users part tells which users' access to the file is changed. It consists of one or more of the following letters (or it can be empty; see section The Umask and Protection, for a description of what happens then). When more than one of these letters is given, the order that they are in does not matter.
u
g
o
a
The operation part tells how to change the affected users' access to the file, and is one of the following symbols:
+
-
=
The permissions part tells what kind of access to the file should be changed; it is zero or more of the following letters. As with the users part, the order does not matter when more than one letter is given. Omitting the permissions part is useful only with the `=' operation, where it gives the specified users no access at all to the file.
r
w
x
For example, to give everyone permission to read and write a file, but not to execute it, use:
a=rw
To remove write permission for from all users other than the file's owner, use:
go-w
The above command does not affect the access that the owner of the file has to it, nor does it affect whether other users can read or execute the file.
To give everyone except a file's owner no permission to do anything with that file, use the mode below. Other users could still remove the file, if they have write permission on the directory it is in.
go=
Another way to specify the same thing is:
og-rxw
You can base part of a file's permissions on part of its existing permissions. To do this, instead of using `r', `w', or `x' after the operator, you use the letter `u', `g', or `o'. For example, the mode
o+g
adds the permissions for users who are in a file's group to the permissions that other users have for the file. Thus, if the file started out as mode 664 (`rw-rw-r--'), the above mode would change it to mode 666 (`rw-rw-rw-'). If the file had started out as mode 741 (`rwxr----x'), the above mode would change it to mode 745 (`rwxr--r-x'). The `-' and `=' operations work analogously.
In addition to changing a file's read, write, and execute permissions, you can change its special permissions. See section Structure of File Permissions, for a summary of these permissions.
To change a file's permission to set the user ID on execution, use `u' in the users part of the symbolic mode and `s' in the permissions part.
To change a file's permission to set the group ID on execution, use `g' in the users part of the symbolic mode and `s' in the permissions part.
To change a file's permission to stay permanently on the swap device, use `o' in the users part of the symbolic mode and `t' in the permissions part.
For example, to add set user ID permission to a program, you can use the mode:
u+s
To remove both set user ID and set group ID permission from it, you can use the mode:
ug-s
To cause a program to be saved on the swap device, you can use the mode:
o+t
Remember that the special permissions only affect files that are executable, plus, on some systems, directories (on which they have different meanings; see section Structure of File Permissions). Using `a' in the users part of a symbolic mode does not cause the special permissions to be affected; thus,
a+s
has no effect. You must use `u', `g', and `o' explicitly to affect the special permissions. Also, the combinations `u+t', `g+t', and `o+s' have no effect.
The `=' operator is not very useful with special permissions; for example, the mode:
o=t
does cause the file to be saved on the swap device, but it also removes all read, write, and execute permissions that users not in the file's group might have had for it.
There is one more special type of symbolic permission: if you use `X' instead of `x', execute permission is affected only if the file already had execute permission or is a directory. It affects directories' execute permission even if they did not initially have any execute permissions set.
For example, this mode:
a+X
gives all users permission to execute files (or search directories) if anyone could before.
The format of symbolic modes is actually more complex than described above (see section Setting Permissions). It provides two ways to make multiple changes to files' permissions.
The first way is to specify multiple operation and permissions parts after a users part in the symbolic mode.
For example, the mode:
og+rX-w
gives users other than the owner of the file read permission and, if it is a directory or if someone already had execute permission to it, gives them execute permission; and it also denies them write permission to it file. It does not affect the permission that the owner of the file has for it. The above mode is equivalent to the two modes:
og+rX og-w
The second way to make multiple changes is to specify more than one simple symbolic mode, separated by commas. For example, the mode:
a+r,go-w
gives everyone permission to read the file and removes write permission on it for all users except its owner. Another example:
u=rwx,g=rx,o=
sets all of the non-special permissions for the file explicitly. (It gives users who are not in the file's group no permission at all for it.)
The two methods can be combined. The mode:
a+r,g+x-w
gives all users permission to read the file, and gives users who are in the file's group permission to execute it, as well, but not permission to write to it. The above mode could be written in several different ways; another is:
u+r,g+rx,o+r,g-w
If the users part of a symbolic mode is omitted, it defaults to
`a' (affect all users), except that any permissions that are
set in the system variable umask are not affected.
The value of umask can be set using the
umask command. Its default value varies from system to system.
Omitting the users part of a symbolic mode is generally not useful
with operations other than `+'. It is useful with `+' because
it allows you to use umask as an easily customizable protection
against giving away more permission to files than you intended to.
As an example, if umask has the value 2, which removes write
permission for users who are not in the file's group, then the mode:
+w
adds permission to write to the file to its owner and to other users who are in the file's group, but not to other users. In contrast, the mode:
a+w
ignores umask, and does give write permission for
the file to all users.
File permissions are stored internally as 16 bit integers. As an alternative to giving a symbolic mode, you can give an octal (base 8) number that corresponds to the internal representation of the new mode. This number is always interpreted in octal; you do not have to add a leading 0, as you do in C. Mode 0055 is the same as mode 55.
A numeric mode is usually shorter than the corresponding symbolic mode, but it is limited in that it can not take into account a file's previous permissions; it can only set them absolutely.
The permissions granted to the user, to other users in the file's group, and to other users not in the file's group are each stored as three bits, which are represented as one octal digit. The three special permissions are also each stored as one bit, and they are as a group represented as another octal digit. Here is how the bits are arranged in the 16 bit integer, starting with the lowest valued bit:
Value in Corresponding
Mode Permission
Other users not in the file's group:
1 Execute
2 Write
4 Read
Other users in the file's group:
10 Execute
20 Write
40 Read
The file's owner:
100 Execute
200 Write
400 Read
Special permissions:
1000 Save text image on swap device
2000 Set group ID on execution
4000 Set user ID on execution
For example, numeric mode 4755 corresponds to symbolic mode `u=rwxs,go=rx', and numeric mode 664 corresponds to symbolic mode `ug=rw,o=r'. Numeric mode 0 corresponds to symbolic mode `ugo='.