- In order to manage permissions,
there are two things that you need to do.
First, you need to take care of ownership.
And after taking care of ownership,
you can set the permissions for these owners.
In order to manage ownership, you need to understand
that the user who creates a file becomes user-owner,
and the primary group of that user becomes group-owner,
and everybody else is the others owner.
We also call that ugo, and standard Linux permissions allow
for one user-owner and one group-owner for each file.
If you don't like the default owner assignments,
you can use chown for change owner to change user ownership,
as in chown anna myfile, or chown anna:sales /data/sales.
Now the second line is an interesting one,
because here we are making user anna as well as group sales
owner of the directory sales.
There's also chgrp, which you can use
to change group ownership individually.
Now after setting ownership, you are going to work
with file permissions.
Chmod is the command that you are going to work with.
Chmod can be used in absolute mode, and in absolute mode
it sets permissions to ugo, which is user group and others,
as in chmod 750.
What is chmod 750?
Well, a 7 for u, a 5 for g, and a 0 for o.
7 is 4 plus 2 plus 1, that equals read, write, and execute.
5 is read and execute.
And 0 obviously is nothing.
Alternatively, you can use relative mode.
I like using relative mode to make script files executable,
as in chmod +x myscript.
Don't make it any more complex than that.
And here is the best practice for both of these.
Use absolute mode if you want full control.
Use relative mode for quick permission changes.
So let me show you how to work with these permissions.
And in order to do so, I am starting by creating a directory
with the name /data/sales.
So let's check out the permissions, sudo ls -l on /data.
And there we can see that the sales directory is owned
by root root.
So first thing to do is sudo chgrp sales on /data/sales.
And now we can see that the sales group is owner
of this directory.
Now we need to fix the permissions.
Now what makes sense?
It makes sense to set the permission mode to 770.
Linux has this other thing, and this other thing
makes it too many users have read permissions
in specific directories, and I don't like that.
So sudo chmod 770 on /data/sales.
And now if I use my sudo ls -l again,
we can see that the /data/sales directory is set correctly.
Now we need to test, of course.
So grep sales in /etc/group.
Why do I do that?
Because I need to find out members of this specific group.
And there we can see bill, laura, and linda.
So let me open a shell, sudo su -, as user linda.
And as user linda, I am going to the /data/sales directory,
and I'm creating a file with the name lindafile.
Ls -l, well, we can see
that lindafile has been created successfully.
And that is how you do it.
Now one more thing
to make sure you understand how all of this works.
One additional demo.
With root permissions, I am going to create a file
with the name /home/linda/rootfile.
There we go, the rootfile has been created.
I'm going back to my linda shell, and in the linda shell,
I'm using ls -l.
And what do we see?
We see that linda has this rootfile.
Now I need you to think about the following.
I am user linda,
and I'm going to use rm -f on rootfile.
What do you think?
Is that going to work?
Yes or no?
Well, let's try it.
And there you can see it works.
Is that surprising?
No, it's not.
If we use ls -ld on dot,
then we can see this is the linda home directory.
Linda is owner of her home directory.
She has read, write, and execute in the home directory.
So of course she's allowed to delete files
from her own home directory.
And that is what we are seeing here.