Learning the Command Line – File Permissions

Ever have a file you can’t do anything with? Can’t change it, can’t delete it, can’t even look at it? We’re going to find out why.

FreeBSD, and by extension, OS X (which is loosely based on FreeBSD), uses file permissions. This lets the system control access to files and directories by different users. Would you want another user looking at your files? Of course not. Permissions determine who can access any file or directory and whether it can be edited or deleted.

There are three types of access for a file:

Read: You can view the file, and only that.

Write: You can edit or change the file. You can also delete the file.

Execute: You can ‘run’ the file if it’s a binary or application. Shell scripts must have this bit set to run.

These are used to determine access for owners, groups, and everyone else. A group is a collection of users on the system. For example, the Wheel group would be users which are administrators on the system. A user can belong to several groups or only one, depending on what the admin sets it to.

If you do a long-list (ls -l) on your user directory you will see something like this:

craig@zinger:~$ ls -l
total 5656
drwxr-xr-x   28 craig  staff      952 Oct 14 15:52 Applications
drwx------@   5 craig  staff      170 Nov  2 21:34 Desktop
drwxr--r--@ 257 craig  staff     8738 Nov  2 22:25 Documents
drwx------@  32 craig  staff     1088 Nov  4 13:24 Downloads
drwx------@  13 craig  staff      442 Nov  2 21:34 Dropbox
-rw-r--r--@   1 craig  staff     1167 Oct 26 15:43 Folder Action Script.rtf
drwx------@  82 craig  staff     2788 Oct 23 17:44 Library
drwxr-xr-x  118 craig  staff     4012 Oct 27 17:37 Manuals
drwxr-xr-x@   8 craig  staff      272 Jul 23  2007 Maps

Lets break the permissions down by looking at the first column. The first character, d, means it’s a directory. The – means it’s a file. Next you have nine characters following this, each of which can be one of four characters: -r, w, x. These are arranged into triplets (groups of three). The first set are for the owner, the second are for the group, and the third are everyone else. The @ on the end is the ACL (Access Control List) which I won’t go into because I don’t think I really understand it that well myself (but I’m working on it!). You’ll notice not all the letters are set with a letter (r/w/x). If, for example, the r/w/x is not there (there is a - instead), that means the attribute is denied, or you can’t write/read the file.

Let’s look at an example to clarify this. In the list above, let’s explore the Desktop directory (d). I can read, write, and execute (rwx) it, and no one else can since the first triplet after the d has rwx and everything else is a dash. In Finder, they can’t even look in it. Ever come across a folder with a red and white circle with a line in it? Try looking in it. You can’t. If you have more than one user on your computer, you can’t look into others folders unless they change the permissions.

The execute bit is slightly different for directories than regular files. In order to list a directory, the read bit must be set. In order to delete a file in it, the execute bit must be set. On files, the execute bit means the file can be run, as in the case of shell scripts, or applications.

If you are the owner of the file you can change the attributes with the chmod command. chmod stands for change mode, or change the access. There are two ways to change permissions using the chmod tool: using switches, or using octal numbers.

The chmod command has several switches. It’s syntax looks like this:

$ chmod [who] [operator] [permission] file

The [who] is used to specify which users the permissions apply to.

u user the owner of the file
g group users who are members of the file's group
o others everyone else
a all everyone - same as ugo

The [operator] specifies how the modes should be changed.

+   adds the mode to the specified class
-   removes the mode from the specified class
=   the modes specified are to be made exact for the class

There are three basic permissions. These are:

r   Read
w   Write
x   Execute

For example, if I wanted to give access to my Desktop folder to others in my group I would change the access:

 craig@zinger:~$ chmod g+rwx Desktop

This would give everyone in my group, in my case ‘staff’, read, write and execute permission to my Desktop folder.

There are other types of permissions which are more advanced. If you are interested check the man pages (man chmod).

For some, it may be easier to use numbers (letter combinations can sometimes be cryptic). Each set of attributes can be expressed as a number, depending on which bits are set. Using the table below you can change the permissions for each user/group.

Value	Permission                        Directory Listing
  0    No read, no write, no execute          ---
  1    No read, no write, execute             --x
  2    No read, write, no execute             -w-
  3    No read, write, execute                -wx
  4    Read, no write, no execute             r--
  5    Read, no write, execute                r-x
  6    Read, write, no execute                rw-
  7    Read, write, execute                   rwx

The normal permissions on commands available to most users in Terminal , 755, would be:

rwxr-xr-x
or
rwx r-x r-x

Which would give the owner, the system, all permissions, and everyone else read/execute permission. This is so that the commands are available to users but cannot be changed or deleted so that other users can use them.

Lets say you have a folder you don’t want anyone to look into. You can change the permissions so no one can view or move the folder. In this case the command would be:

craig@zinger:~$ chmod 700 foldername

 7    0    0
rwx  ---  ---

The 7 means you can read, write, execute the file but the two zeros mean no one else can do anything with it.

Note: if you set permissions on a file, remember the file is in a directory. If no one can enter the directory, they can’t read the file. You need to make sure it is in a place where others have access.

You can’t go around changing permissions on whatever you feel like. Some files or directories are not meant to be messed with (system files especially). The system expects certain files to have certain permissions and sometimes complains when they are different. You might need to occasionally open Disk Utilities and do a Repair Permissions. What this does is reset the system installed files to their original access states. This sometimes fixes small problems with the smooth running of the system but it certainly isn’t a fix all.