Managing File Permissions: chmod and umask

1. Modifying Permissions with chmod

The primary tool for changing permissions on existing files and directories is the chmod (change mode) command. You can use it in two ways: with the numeric (octal) notation you learned previously, or with a more descriptive symbolic notation.

Method 1: Numeric (Octal) Notation

Using octal numbers is a fast and common way to set the exact permissions you want for a file. As a quick reminder, the values are:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1

You combine these to form a three-digit number representing the permissions for the owner, group, and others, respectively.

The basic syntax is: chmod <numeric_code> file_or_directory_name

As the video highlights, certain numeric permissions are standard practice:

• 644 (rw-r--r--): A common default for data files. The owner can read/write, while everyone else can only read.
• 755 (rwxr-xr-x): A common default for directories and executable programs. The owner can do everything, while everyone else can read and execute (which for a directory, means they can enter it and list its contents).
• 700 (rwx------): A private setting. Only the owner has any permissions. This is often used for sensitive data or private SSH keys.

Now, let's see a more detailed, practical scenario of how changing permissions affects user access.

Method 2: Symbolic Notation

While numeric notation is great for setting all permissions at once, sometimes you only want to make a small change, like adding execute permission for the owner. Symbolic notation is perfect for this, as it lets you modify permissions relative to their current state.

The syntax follows a clear pattern: chmod <who><operator><permission> file_name

Let's break down the components.

Here is a summary of the key components from the article:

Example Scenarios:

• You've written a shell script named backup.sh and need to make it executable for yourself:
  chmod u+x backup.sh
• You want to prevent members of your group from modifying a shared report:
  chmod g-w report.docx
• You want to make a file completely private, removing all rights for the group and others:
  chmod go= private.dat

2. Setting Default Permissions with umask

When you create a new file with touch or a new directory with mkdir, Linux assigns it a set of default permissions. The umask (user file-creation mode mask) command allows you to control what these default permissions are.

This is a very important security concept. umask works by "masking" or removing permissions from a system-wide base value. It does not define the permissions that are set.

• The base permission for new directories is 777 (rwxrwxrwx).
• The base permission for new files is 666 (rw-rw-rw-). (Note: For security, Linux doesn't grant execute permission to new files by default).

The umask value is subtracted from the base value to determine the final permission.

Let's visualize this process.

The most common default umask is 022. Let's see how that works:

• For a new directory: 777 (base) - 022 (umask) = 755 (rwxr-xr-x)
• For a new file: 666 (base) - 022 (umask) = 644 (rw-r--r--)

This is why you so often see new files with 644 and new directories with 755 permissions.

Using the umask Command

Now let's put this into practice on the command line.

You can view the current umask setting in two ways:

• umask: Shows the octal value (e.g., 0022).
• umask -S: Shows the symbolic "allowed" permissions (e.g., u=rwx,g=rx,o=rx).

You can set a new umask for your current terminal session by simply providing the new octal value. For example, to make new files private by default:
umask 077

• New Directory: 777 - 077 = 700 (rwx------)
• New File: 666 - 077 = 600 (rw-------)

Practical Exercise:

Open your terminal and try these steps:

1. Check your current umask: umask
2. Create a test file and check its permissions: touch testfile1 && ls -l testfile1
3. Set a more restrictive umask: umask 077
4. Create a second test file and check its permissions: touch testfile2 && ls -l testfile2
5. Notice the difference in the permission strings between testfile1 and testfile2.
6. Remember to close your terminal or open a new one to revert to the default umask. The change is only for the current session.

Conclusion

You have now gained practical control over file permissions in Linux. You can not only interpret who has access but can now actively manage that access for existing files and set secure defaults for new ones.

Key Takeaways:

• The chmod command modifies permissions on existing files and directories.
• chmod can be used with numeric notation (e.g., chmod 755 file) to set absolute permissions or symbolic notation (e.g., chmod u+x file) to make relative changes.
• The umask command controls the default permissions for newly created files and directories.
• umask works by subtracting its value from the system's base permissions (666 for files, 777 for directories).
• A common default umask is 022, resulting in 644 permissions for files and 755 for directories.

In our next lesson, we will complete our foundation in standard access control by learning how to change which user and group a set of permissions applies to. We will explore how to change file ownership and group assignment using the chown and chgrp commands.