Changing Permissions on files,Changing Owners,Groups

Chmod command is used to change file permissions. chmod -- Changing The File Permissions To change the file permissions , you must be the owner of the file or you must be the root user. The root user can change any permission bit. This may not be true of the owner. The one bit that the owner may not be able to switch on is the SGID bit. To turn on that bit, the owner must be a member of the group that the file is in. If this restriction was not in place, a user could simply create an SGID program to give himself access to files controlled by groups other than those to which he belongs. Remember that, as we mentioned above, the SGID bit has been often overloaded into also being used for file locking. A version of Unix may or may not allow a file owner to switch on the SGID bit of a file in a different group if no execute bit is set. Simply turning on an execute bit may result in the SUID and SGID bits being cleared (even for root). This is a security feature to ensure that the user intends for the SUID and SGID bits to be set. The user can switch them back on explicitly. Or the user can simply explicitly set all the bit at once. Also be aware that writing to a file may, on some versions of Unix, clear the SUID and SGID bits. See below for the effect of changing the owner or group of a file. In Unix access classes and access types specifies how to establish file permissions, different types of access to a file. Access classes are groups of users, and each may be assigned specific access types. The access classes are "user", "group", "other", and "all". These refer to the user who owns the file, a specific group of users, the other are users who are not in the group, and all are three sets of users. Access types (read, write, and execute) determines the access method of file by each access class. The general syntax is chmod -R/c/f/v [u / g / o / a] [+ / - / =] [rwxXstugo..] There are two basic ways of using chmod to change file permissions: Symbolic method: --------------- The first and probably easiest way is the relative (or symbolic) method, which lets you specify access classes and types with single letter abbreviations. A chmod command with this form of syntax consists of at least three parts from the following lists: Access Class Operator Access Type u (user) + (add access) r (read) g (group) - (remove access) w (write) o (other) = (set exact access) x (execute) a (all: u, g, and o) For example, to add permission for everyone to read a file in the current directory named myfile, at the Unix prompt, you would enter: chmod a+r filename Where 'a' stands for "all", the '+' for "add", and the 'r' for "read". Note: This assumes that everyone already has access to the directory where filename is located and its parent directories; that is, you must set the directory permissions separately. If you omit the access class, it is assumed to be all, so you could also enter the previous example as: chmod +r filename You can also specify multiple classes and types with a single command. For example, to remove read and write permission for group and other users (leaving only yourself with read and write permission) on a file named filename, you would enter: chmod go-rw filename You can also specify that different permissions be added and removed in the same command. For example, to remove write permission and add execute for all users on filename, you would enter: chmod a-w+x filename In each of these examples, the access types that aren't specified are unchanged. The previous command, for example, doesn't change any existing settings specifying whether users besides yourself may have read ( r ) access to filename. You could also use the exact form to explicitly state that group and other users' access is set only to read with the = operator: chmod go=r filename The chmod command also operates on directories. For example, to remove write permission for other users on a subdirectory named mydir, you would enter: chmod o-w mydir To do the same for the current directory, you would enter: chmod o-w Be careful when setting the permissions of directories, particularly your home directory; you don't want to lock yourself out by removing your own access. Also, you must have execute permission on a directory to switch ( cd ) to it. Absolute Form: -------------- The other way to use the chmod command is the absolute form. In this case, you specify a set of three numbers that together determine all the access classes and types. Rather than being able to change only particular attributes, you must specify the entire state of the file's permissions. The three numbers are specified in the order: user (or owner), group, other. Each number is the sum of values that specify read (4), write (2), and execute (1) access, with 0 (zero) meaning no access. For example, if you wanted to give yourself read, write, and execute permissions on filename; give users in your group read and execute permissions; and give others only execute permission, the appropriate number would be calculated as (4+2+1)(4+0+1)(0+0+1) for the three digits 751. You would then enter the command as: chmod 751 filename As another example, to give only yourself read, write, and execute permission on the current directory, you would calculate the digits as (4+2+1)(0+0+0)(0+0+0) for the sequence 700, and enter the command: chmod 700 If it seems clearer to you, you can also think of the three digit sequence as the sum of attributes you select from the following table: 400 read by owner 200 write by owner 100 execute by owner 040 read by group 020 write by group 010 execute by group 004 read by others 002 write by others 001 execute by others To create an access mode, sum all the accesses to permit. For example, to give read privileges to all, and write and execute privileges to the owner only for a file, you would sum: 400+200+100+040+004 = 744. Then, at the Unix prompt, you would enter: chmod 744 filename Some other frequently used examples are: 777 anyone can do anything (read, write, or execute) 755 you can do anything; others can only read and execute 711 you can do anything; others can only execute 644 you can read and write; others can only read chown -- Changing The File Owner -------------------------------- Originally, Unix allowed a file owner to give away a file. A file's owner could change the owner to someone else. There was no way for a non-root user to undo this operation. When Unix split into a Berkeley/AT&T versions, the USG (Unix Support Group, part of AT&T) versions of Unix tended to inherit this behavior. Meanwhile BSD (Berkeley Software Distribution, part of University of California, Berkeley) removed chown from non-root users. BSD had implemented disk quotas which could limit how much disk space a user could have in a filesystem. Naughty users could give away large files to sneek past the quotas. Today, it is not easy to say if a non-root can chown a file. Many versions of Unix allow both behaviors. HP-UX has a setprivgroup facility that can control whether or not members of a particular group can invoke chown. Solaris has a global paramter rstchown which can be set to allow global chown. Setting this parameter also disables a change-group limitation described below (without affecting the SGID limitations described above). Recent Linux version have a CAP_CHOWN capability to control this feature. You will need to consult your documentation for other versions of Unix. And you will need to consult your System Administrator to see how your particular system is configured. The default with most OS's is for chown to be restricted to root only. And there is a consensus that it should stay this way for security considerations. If a non-root user does change the owner of a file and any execute bit is on, the SUID and SGID bits must be cleared. This may or may not happen with root. The chown command The chown command is used to change the user and/or group which owns one or more files or directories. Its general format is : chown [-Rcfv] [username][:.][groupname] foo.txt The flags used above are same as those used in the chmod command . The following are the different ways in which this command can be used : The username followed by a dot or colon followed by a groupname changes both the user and group ownerships to those specified. The username followed by a dot or colon and no groupname changes the user ownership as specified and changes the group ownership to the specified user?s login group. If the colon or dot and groupname are specified without a username, then only the groupownership is changed. This is effectively the same as the chgrp command. If the username is not followed by a dot or a colon, then only the user ownership is changed. chown, chgrp -- Changing The File Group The chown command can (with any modern, Posix compliant version of Unix) also attempt a group change. And there is a chgrp command. Both of these invoke the chown() system call to change a group. The fact that a common system call is involved helps explain why some OS versions jointly enforce or relax restrictions on non-root users for both owner and group changes. A non-root user can change the group of file he owns to a group of which he is a member. Posix prohibits a non-root user from changing a files group to a group of which he is not a member. But some OS's lift this restriction if the restriction against changing a file's owner has been lifted. If the group is changed by a non-root user and one or execute bits are set, the SUID and SGID bits are cleared. The chgrp command The chgrp command is used to change the group ownership of one or more files or directories. Its general syntax is : chgrp [-Rcfv] groupname foo.txt The flags used here are also the same as those in the chmod command. The changes in ownership are applied to the groupname and the filename specified.