“UbuntuHelp:FilePermissions/zh”的版本间的差异
来自Ubuntu中文
(新页面: {{Translation}}<br>{{From|http://wiki.ubuntu.org.cn/UbuntuHelp:FilePermissions}}<br>{{Translator|李威}}<br>{{Languages|UbuntuHelp:FilePermissions}}<br>) |
小 |
||
(未显示同一用户的2个中间版本) | |||
第1行: | 第1行: | ||
{{Translation}}<br>{{From|http://wiki.ubuntu.org.cn/UbuntuHelp:FilePermissions}}<br>{{Translator|李威}}<br>{{Languages|UbuntuHelp:FilePermissions}}<br> | {{Translation}}<br>{{From|http://wiki.ubuntu.org.cn/UbuntuHelp:FilePermissions}}<br>{{Translator|李威}}<br>{{Languages|UbuntuHelp:FilePermissions}}<br> | ||
+ | |||
+ | === 理解并使用文件权限 === | ||
+ | |||
+ | 在 Linux 和 Unix 的世界中,一切东西都是一个文件。文件夹是文件,文档是文件以及设备也是文件。设备通常称其为结点; 不管怎么样,他们仍然是文件。系统中所有的这些文件都由权限来允许或禁止他人读 ,修改或执行。 If the file is of type Directory then it restricts different actions than files and device nodes. The super user "root" has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are referred to as bits. To change or edit files that are owned by root, '''sudo''' must be used - please see [[UbuntuHelp:RootSudo|RootSudo]] for details. If the owner read & execute bit are on, then the permissions are: | ||
+ | <pre>-r-x------ | ||
+ | </pre> | ||
+ | There are three types of access restrictions: | ||
+ | |||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''Permission''' | ||
+ | | '''Action''' | ||
+ | | '''chmod option''' | ||
+ | |- | ||
+ | | read | ||
+ | | (view) | ||
+ | | r or 4 | ||
+ | |- | ||
+ | | write | ||
+ | | (edit) | ||
+ | | w or 2 | ||
+ | |- | ||
+ | | execute | ||
+ | | (execute) | ||
+ | | x or 1 | ||
+ | |} | ||
+ | |||
+ | There are also three types of user restrictions: | ||
+ | |||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''User''' | ||
+ | | '''''ls'' output''' | ||
+ | |- | ||
+ | | owner | ||
+ | | <code><nowiki>-rwx------</nowiki></code> | ||
+ | |- | ||
+ | | group | ||
+ | | <code><nowiki>----rwx---</nowiki></code> | ||
+ | |- | ||
+ | | other | ||
+ | | <code><nowiki>-------rwx</nowiki></code> | ||
+ | |} | ||
+ | |||
+ | Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes. | ||
+ | |||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''Permission''' | ||
+ | | '''Action''' | ||
+ | | '''chmod option''' | ||
+ | |- | ||
+ | | read | ||
+ | | (view contents, i.e. ls command) | ||
+ | | r or 4 | ||
+ | |- | ||
+ | | write | ||
+ | | (create or remove files from dir) | ||
+ | | w or 2 | ||
+ | |- | ||
+ | | execute | ||
+ | | (cd into directory) | ||
+ | | x or 1 | ||
+ | |} | ||
+ | |||
+ | * read restricts or allows viewing the directories contents, i.e. ''ls'' command | ||
+ | * write restricts or allows creating new files or deleting files in the directory. (Caution: '''write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!''') | ||
+ | * execute restricts or allows changing into the directory, i.e. ''cd'' command | ||
+ | |||
+ | === Permissions in Action === | ||
+ | <pre>user@host:/home/user$ ls -l /etc/hosts | ||
+ | -rw-r--r-- 1 root root 288 2005-11-13 19:24 /etc/hosts | ||
+ | user@host:/home/user$ | ||
+ | </pre> | ||
+ | Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group. What are the permissions from the above /etc/hosts ls output? | ||
+ | <pre>-rw-r--r-- | ||
+ | |||
+ | owner = Read & Write (rw-) | ||
+ | group = Read (r--) | ||
+ | other = Read (r--) | ||
+ | </pre> | ||
+ | === Changing Permissions === | ||
+ | |||
+ | The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access. | ||
+ | <pre>user@host:/home/user# ls -l /etc/shadow | ||
+ | -rw-r----- 1 root shadow 869 2005-11-08 13:16 /etc/shadow | ||
+ | user@host:/home/user# | ||
+ | |||
+ | Permissions: | ||
+ | owner = Read & Write (rw-) | ||
+ | group = Read (r--) | ||
+ | other = None (---) | ||
+ | |||
+ | Ownership: | ||
+ | owner = root | ||
+ | group = shadow | ||
+ | </pre> | ||
+ | ==== chmod with Letters ==== | ||
+ | <pre>Usage: chmod {options} filename | ||
+ | </pre> | ||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''Options''' | ||
+ | | '''Definition''' | ||
+ | |- | ||
+ | | u | ||
+ | | owner | ||
+ | |- | ||
+ | | g | ||
+ | | group | ||
+ | |- | ||
+ | | o | ||
+ | | other | ||
+ | |- | ||
+ | | x | ||
+ | | execute | ||
+ | |- | ||
+ | | w | ||
+ | | write | ||
+ | |- | ||
+ | | r | ||
+ | | read | ||
+ | |- | ||
+ | | + | ||
+ | | add permission | ||
+ | |- | ||
+ | | - | ||
+ | | remove permission | ||
+ | |- | ||
+ | | = | ||
+ | | set permission | ||
+ | |} | ||
+ | |||
+ | Here are a few examples of chmod usage with letters (try these out on your system). First create some empty files: | ||
+ | <pre>user@host:/home/user$ touch file1 file2 file3 file4 | ||
+ | user@host:/home/user$ ls -l | ||
+ | total 0 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file4 | ||
+ | </pre> | ||
+ | Add owner execute bit: | ||
+ | <pre>user@host:/home/user$ chmod u+x file1 | ||
+ | user@host:/home/user$ ls -l file1 | ||
+ | -rwxr--r-- 1 user user 0 Nov 19 20:13 file1 | ||
+ | </pre> | ||
+ | Add other write & execute bit: | ||
+ | <pre>user@host:/home/user$ chmod o+wx file2 | ||
+ | user@host:/home/user$ ls -l file2 | ||
+ | -rw-r--rwx 1 user user 0 Nov 19 20:13 file2 | ||
+ | </pre> | ||
+ | Remove group read bit: | ||
+ | <pre>user@host:/home/user$ chmod g-r file3 | ||
+ | user@host:/home/user$ ls -l file3 | ||
+ | -rw----r-- 1 user user 0 Nov 19 20:13 file3 | ||
+ | </pre> | ||
+ | Add read, write and execute to everyone: | ||
+ | <pre>user@host:/home/user$ chmod ugo+rwx file4 | ||
+ | user@host:/home/user$ ls -l file4 | ||
+ | -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 | ||
+ | user@host:/home/user$ | ||
+ | </pre> | ||
+ | ==== chmod with Numbers ==== | ||
+ | <pre>Usage: chmod {options} filename | ||
+ | </pre> | ||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''Options''' | ||
+ | | '''Definition''' | ||
+ | |- | ||
+ | | <code><nowiki>#--</nowiki></code> | ||
+ | | owner | ||
+ | |- | ||
+ | | <code><nowiki>-#-</nowiki></code> | ||
+ | | group | ||
+ | |- | ||
+ | | <code><nowiki>--#</nowiki></code> | ||
+ | | other | ||
+ | |- | ||
+ | | 1 | ||
+ | | execute | ||
+ | |- | ||
+ | | 2 | ||
+ | | write | ||
+ | |- | ||
+ | | 4 | ||
+ | | read | ||
+ | |} | ||
+ | |||
+ | Owner, Group and Other is represented by three numbers. To get the value for the options determine the type of access needed for the file then add. For example if you want a file that has -rw-rw-rwx permissions you will use the following: | ||
+ | |||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''Owner''' | ||
+ | | '''Group''' | ||
+ | | '''Other''' | ||
+ | |- | ||
+ | | read & write | ||
+ | | read & write | ||
+ | | read, write & execute | ||
+ | |- | ||
+ | | 4+2=6 | ||
+ | | 4+2=6 | ||
+ | | 4+2+1=7 | ||
+ | |} | ||
+ | <pre>user@host:/home/user$ chmod 667 filename | ||
+ | </pre> | ||
+ | Another example if you want a file that has --w-r-x--x permissions you will use the following: | ||
+ | |||
+ | {| cellspacing="0" border="1" | ||
+ | |- | ||
+ | | '''Owner''' | ||
+ | | '''Group''' | ||
+ | | '''Other''' | ||
+ | |- | ||
+ | | write | ||
+ | | read & execute | ||
+ | | execute | ||
+ | |- | ||
+ | | 2 | ||
+ | | 4+1=5 | ||
+ | | 1 | ||
+ | |} | ||
+ | <pre>user@host:/home/user$ chmod 251 filename | ||
+ | </pre> | ||
+ | Here are a few examples of chmod usage with numbers (try these out on your system). First create some empty files: | ||
+ | <pre>user@host:/home/user$ touch file1 file2 file3 file4 | ||
+ | user@host:/home/user$ ls -l | ||
+ | total 0 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file4 | ||
+ | </pre> | ||
+ | Add owner execute bit: | ||
+ | <pre>user@host:/home/user$ chmod 744 file1 | ||
+ | user@host:/home/user$ ls -l file1 | ||
+ | -rwxr--r-- 1 user user 0 Nov 19 20:13 file1 | ||
+ | </pre> | ||
+ | Add other write & execute bit: | ||
+ | <pre>user@host:/home/user$ chmod 647 file2 | ||
+ | user@host:/home/user$ ls -l file2 | ||
+ | -rw-r--rwx 1 user user 0 Nov 19 20:13 file2 | ||
+ | </pre> | ||
+ | Remove group read bit: | ||
+ | <pre>user@host:/home/user$ chmod 604 file3 | ||
+ | user@host:/home/user$ ls -l file3 | ||
+ | -rw----r-- 1 user user 0 Nov 19 20:13 file3 | ||
+ | </pre> | ||
+ | Add read, write and execute to everyone: | ||
+ | <pre>user@host:/home/user$ chmod 777 file4 | ||
+ | user@host:/home/user$ ls -l file4 | ||
+ | -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 | ||
+ | user@host:/home/user$ | ||
+ | </pre> | ||
+ | ==== chmod with sudo ==== | ||
+ | |||
+ | Changing permissions on files that you do not have ownership of: ('''Note''' that changing permissions the wrong way on the wrong files can quickly mess up your system a great deal! Please be careful when using '''sudo'''!) | ||
+ | <pre>user@host:/home/user$ ls -l /usr/local/bin/somefile | ||
+ | -rw-r--r-- 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile | ||
+ | user@host:/home/user$ | ||
+ | |||
+ | user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile | ||
+ | |||
+ | user@host:/home/user$ ls -l /usr/local/bin/somefile | ||
+ | -rw-r--r-x 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile | ||
+ | user@host:/home/user$ | ||
+ | </pre> | ||
+ | === Recursive Permission Changes === | ||
+ | |||
+ | To change the permissions of multiple files and directories with one command. Please note the warning in the chmod with sudo section and the Warning with Recursive chmod section. | ||
+ | |||
+ | ==== Recursive chmod with -R and sudo ==== | ||
+ | |||
+ | To change all the permissions of each file and folder under a specified directory at once, use sudo chmod with -R | ||
+ | <pre>user@host:/home/user$ sudo chmod 777 -R /path/to/someDirectory | ||
+ | user@host:/home/user$ ls -l | ||
+ | total 3 | ||
+ | -rwxrwxrwx 1 user user 0 Nov 19 20:13 file1 | ||
+ | drwxrwxrwx 2 user user 4096 Nov 19 20:13 folder | ||
+ | -rwxrwxrwx 1 user user 0 Nov 19 20:13 file2 | ||
+ | </pre> | ||
+ | ==== Recursive chmod using find, pipemill, and sudo ==== | ||
+ | |||
+ | To assign reasonably secure permissions to files and folders/directories, it's common to give files a permission of 644, and directories a 755 permission, since chmod -R assigns to both. Use sudo, the find command, and a pipemill to chmod as in the following examples. To change permission of only files under a specified directory. | ||
+ | <pre>user@host:/home/user$ sudo find /path/to/someDirectory -type f | while read var1; do sudo chmod 644 "$var1"; done | ||
+ | user@host:/home/user$ ls -l | ||
+ | total 3 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 | ||
+ | drwxrwxrwx 2 user user 4096 Nov 19 20:13 folder | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 | ||
+ | </pre> | ||
+ | To change permission of only directories under a specified directory (including that directory): | ||
+ | <pre>user@host:/home/user$ sudo find /path/to/someDirectory -type d | while read var1; do sudo chmod 755 "$var1"; done | ||
+ | user@host:/home/user$ ls -l | ||
+ | total 3 | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 | ||
+ | drwxr--r-- 2 user user 4096 Nov 19 20:13 folder | ||
+ | -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 | ||
+ | </pre> | ||
+ | === Warning with Recursive chmod === | ||
+ | |||
+ | WARNING: Although it's been said, it's worth mentioning in context of a gotcha typo. Please note, Recursively deleting or chown-ing files are extremely dangerous. You will not be the first, nor the last, person to add one too many spaces into the command. This example will hose your system: | ||
+ | <pre>user@host:/home/user$ sudo chmod -R / home/john/Desktop/tempfiles | ||
+ | </pre> | ||
+ | Note the space between the first / and home. You have been warned. | ||
+ | |||
+ | === Changing the File Owner and Group === | ||
+ | |||
+ | A file's owner can be changed using the <code><nowiki>chown</nowiki></code> command. For example, to change the <code><nowiki>foobar</nowiki></code> file's owner to <code><nowiki>tux</nowiki></code>: | ||
+ | <pre>user@host:/home/user$ sudo chown tux foobar | ||
+ | </pre> | ||
+ | To change the <code><nowiki>foobar</nowiki></code> file's group to <code><nowiki>penguins</nowiki></code>, you could use '''either''' <code><nowiki>chgrp</nowiki></code> or <code><nowiki>chown</nowiki></code> with special syntax: | ||
+ | <pre>user@host:/home/user$ sudo chgrp penguins foobar | ||
+ | </pre> <pre>user@host:/home/user$ sudo chown :penguins foobar | ||
+ | </pre> | ||
+ | Finally, to change the <code><nowiki>foobar</nowiki></code> file's owner to <code><nowiki>tux</nowiki></code> and the group to <code><nowiki>penguins</nowiki></code> with a single command, the syntax would be: | ||
+ | <pre>user@host:/home/user$ sudo chown tux:penguins foobar | ||
+ | </pre> | ||
+ | <!> Note that, by default, you must use <code><nowiki>sudo</nowiki></code> to change a file's owner or group. | ||
+ | |||
+ | === For more information === | ||
+ | |||
+ | * ''man chmod'' | ||
+ | * ''man chown'' | ||
+ | * ''man chgrp'' | ||
+ | |||
+ | === Changing Permissions For Volumes With umask === | ||
+ | |||
+ | This section has been moved: [[UbuntuHelp:VolumePermissions|VolumePermissions]] | ||
+ | |||
+ | === ACLs === | ||
+ | |||
+ | Posix ACLs are a way of achieving a finer granularity of permissions than is possible with the standard Unix file permissions. To enable Posix ACLs, install the acl package | ||
+ | <pre>sudo apt-get install acl | ||
+ | </pre> | ||
+ | Documentation can then be found in the online man pages: | ||
+ | |||
+ | * man acl | ||
+ | * man setfacl | ||
+ | * man getfacl | ||
+ | |||
+ | The Eiciel package allows GUI access to ACLs through the Nautilus file manager. | ||
+ | |||
+ | === ToDo === | ||
+ | |||
+ | * sticky bit | ||
+ | * umask (add file and directory umask section, with specific focus on security) | ||
+ | * * ''Suggestion: I often use <code><nowiki>find</nowiki></code> instead of <code><nowiki>chmod -R</nowiki></code>, because it's easier to differentiate between files and directories that way. Yes, I know about the 'X' permission, but I don't trust it.'' | ||
+ | |||
+ | ---- | ||
+ | |||
+ | [[Category:CategoryDocumentation]] [[Category:UbuntuHelp]] |
2008年3月25日 (二) 16:00的最新版本
点击翻译: |
English • 中文 |
目录
理解并使用文件权限
在 Linux 和 Unix 的世界中,一切东西都是一个文件。文件夹是文件,文档是文件以及设备也是文件。设备通常称其为结点; 不管怎么样,他们仍然是文件。系统中所有的这些文件都由权限来允许或禁止他人读 ,修改或执行。 If the file is of type Directory then it restricts different actions than files and device nodes. The super user "root" has the ability to access any file on the system. Each file has access restrictions with permissions, user restrictions with owner/group association. Permissions are referred to as bits. To change or edit files that are owned by root, sudo must be used - please see RootSudo for details. If the owner read & execute bit are on, then the permissions are:
-r-x------
There are three types of access restrictions:
Permission | Action | chmod option |
read | (view) | r or 4 |
write | (edit) | w or 2 |
execute | (execute) | x or 1 |
There are also three types of user restrictions:
User | ls output |
owner | -rwx------
|
group | ----rwx---
|
other | -------rwx
|
Directories have directory permissions. The directory permissions restrict different actions than with files or device nodes.
Permission | Action | chmod option |
read | (view contents, i.e. ls command) | r or 4 |
write | (create or remove files from dir) | w or 2 |
execute | (cd into directory) | x or 1 |
- read restricts or allows viewing the directories contents, i.e. ls command
- write restricts or allows creating new files or deleting files in the directory. (Caution: write access for a directory allows deleting of files in the directory even if the user does not have write permissions for the file!)
- execute restricts or allows changing into the directory, i.e. cd command
Permissions in Action
user@host:/home/user$ ls -l /etc/hosts -rw-r--r-- 1 root root 288 2005-11-13 19:24 /etc/hosts user@host:/home/user$
Using the example above we have the file "/etc/hosts" which is owned by the user root and belongs to the root group. What are the permissions from the above /etc/hosts ls output?
-rw-r--r-- owner = Read & Write (rw-) group = Read (r--) other = Read (r--)
Changing Permissions
The command to use when modifying permissions is chmod. There are two ways to modify permissions, with numbers or with letters. Using letters is easier to understand for most people. When modifying permissions be careful not to create security problems. Some files are configured to have very restrictive permissions to prevent unauthorized access. For example, the /etc/shadow file (file that stores all local user passwords) does not have permissions for regular users to read or otherwise access.
user@host:/home/user# ls -l /etc/shadow -rw-r----- 1 root shadow 869 2005-11-08 13:16 /etc/shadow user@host:/home/user# Permissions: owner = Read & Write (rw-) group = Read (r--) other = None (---) Ownership: owner = root group = shadow
chmod with Letters
Usage: chmod {options} filename
Options | Definition |
u | owner |
g | group |
o | other |
x | execute |
w | write |
r | read |
+ | add permission |
- | remove permission |
= | set permission |
Here are a few examples of chmod usage with letters (try these out on your system). First create some empty files:
user@host:/home/user$ touch file1 file2 file3 file4 user@host:/home/user$ ls -l total 0 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file4
Add owner execute bit:
user@host:/home/user$ chmod u+x file1 user@host:/home/user$ ls -l file1 -rwxr--r-- 1 user user 0 Nov 19 20:13 file1
Add other write & execute bit:
user@host:/home/user$ chmod o+wx file2 user@host:/home/user$ ls -l file2 -rw-r--rwx 1 user user 0 Nov 19 20:13 file2
Remove group read bit:
user@host:/home/user$ chmod g-r file3 user@host:/home/user$ ls -l file3 -rw----r-- 1 user user 0 Nov 19 20:13 file3
Add read, write and execute to everyone:
user@host:/home/user$ chmod ugo+rwx file4 user@host:/home/user$ ls -l file4 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 user@host:/home/user$
chmod with Numbers
Usage: chmod {options} filename
Options | Definition |
#--
|
owner |
-#-
|
group |
--#
|
other |
1 | execute |
2 | write |
4 | read |
Owner, Group and Other is represented by three numbers. To get the value for the options determine the type of access needed for the file then add. For example if you want a file that has -rw-rw-rwx permissions you will use the following:
Owner | Group | Other |
read & write | read & write | read, write & execute |
4+2=6 | 4+2=6 | 4+2+1=7 |
user@host:/home/user$ chmod 667 filename
Another example if you want a file that has --w-r-x--x permissions you will use the following:
Owner | Group | Other |
write | read & execute | execute |
2 | 4+1=5 | 1 |
user@host:/home/user$ chmod 251 filename
Here are a few examples of chmod usage with numbers (try these out on your system). First create some empty files:
user@host:/home/user$ touch file1 file2 file3 file4 user@host:/home/user$ ls -l total 0 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 -rw-r--r-- 1 user user 0 Nov 19 20:13 file2 -rw-r--r-- 1 user user 0 Nov 19 20:13 file3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file4
Add owner execute bit:
user@host:/home/user$ chmod 744 file1 user@host:/home/user$ ls -l file1 -rwxr--r-- 1 user user 0 Nov 19 20:13 file1
Add other write & execute bit:
user@host:/home/user$ chmod 647 file2 user@host:/home/user$ ls -l file2 -rw-r--rwx 1 user user 0 Nov 19 20:13 file2
Remove group read bit:
user@host:/home/user$ chmod 604 file3 user@host:/home/user$ ls -l file3 -rw----r-- 1 user user 0 Nov 19 20:13 file3
Add read, write and execute to everyone:
user@host:/home/user$ chmod 777 file4 user@host:/home/user$ ls -l file4 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file4 user@host:/home/user$
chmod with sudo
Changing permissions on files that you do not have ownership of: (Note that changing permissions the wrong way on the wrong files can quickly mess up your system a great deal! Please be careful when using sudo!)
user@host:/home/user$ ls -l /usr/local/bin/somefile -rw-r--r-- 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile user@host:/home/user$ user@host:/home/user$ sudo chmod o+x /usr/local/bin/somefile user@host:/home/user$ ls -l /usr/local/bin/somefile -rw-r--r-x 1 root root 550 2005-11-13 19:45 /usr/local/bin/somefile user@host:/home/user$
Recursive Permission Changes
To change the permissions of multiple files and directories with one command. Please note the warning in the chmod with sudo section and the Warning with Recursive chmod section.
Recursive chmod with -R and sudo
To change all the permissions of each file and folder under a specified directory at once, use sudo chmod with -R
user@host:/home/user$ sudo chmod 777 -R /path/to/someDirectory user@host:/home/user$ ls -l total 3 -rwxrwxrwx 1 user user 0 Nov 19 20:13 file1 drwxrwxrwx 2 user user 4096 Nov 19 20:13 folder -rwxrwxrwx 1 user user 0 Nov 19 20:13 file2
Recursive chmod using find, pipemill, and sudo
To assign reasonably secure permissions to files and folders/directories, it's common to give files a permission of 644, and directories a 755 permission, since chmod -R assigns to both. Use sudo, the find command, and a pipemill to chmod as in the following examples. To change permission of only files under a specified directory.
user@host:/home/user$ sudo find /path/to/someDirectory -type f | while read var1; do sudo chmod 644 "$var1"; done user@host:/home/user$ ls -l total 3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 drwxrwxrwx 2 user user 4096 Nov 19 20:13 folder -rw-r--r-- 1 user user 0 Nov 19 20:13 file2
To change permission of only directories under a specified directory (including that directory):
user@host:/home/user$ sudo find /path/to/someDirectory -type d | while read var1; do sudo chmod 755 "$var1"; done user@host:/home/user$ ls -l total 3 -rw-r--r-- 1 user user 0 Nov 19 20:13 file1 drwxr--r-- 2 user user 4096 Nov 19 20:13 folder -rw-r--r-- 1 user user 0 Nov 19 20:13 file2
Warning with Recursive chmod
WARNING: Although it's been said, it's worth mentioning in context of a gotcha typo. Please note, Recursively deleting or chown-ing files are extremely dangerous. You will not be the first, nor the last, person to add one too many spaces into the command. This example will hose your system:
user@host:/home/user$ sudo chmod -R / home/john/Desktop/tempfiles
Note the space between the first / and home. You have been warned.
Changing the File Owner and Group
A file's owner can be changed using the chown
command. For example, to change the foobar
file's owner to tux
:
user@host:/home/user$ sudo chown tux foobar
To change the foobar
file's group to penguins
, you could use either chgrp
or chown
with special syntax:
user@host:/home/user$ sudo chgrp penguins foobar
user@host:/home/user$ sudo chown :penguins foobar
Finally, to change the foobar
file's owner to tux
and the group to penguins
with a single command, the syntax would be:
user@host:/home/user$ sudo chown tux:penguins foobar
<!> Note that, by default, you must use sudo
to change a file's owner or group.
For more information
- man chmod
- man chown
- man chgrp
Changing Permissions For Volumes With umask
This section has been moved: VolumePermissions
ACLs
Posix ACLs are a way of achieving a finer granularity of permissions than is possible with the standard Unix file permissions. To enable Posix ACLs, install the acl package
sudo apt-get install acl
Documentation can then be found in the online man pages:
- man acl
- man setfacl
- man getfacl
The Eiciel package allows GUI access to ACLs through the Nautilus file manager.
ToDo
- sticky bit
- umask (add file and directory umask section, with specific focus on security)
- * Suggestion: I often use
find
instead ofchmod -R
, because it's easier to differentiate between files and directories that way. Yes, I know about the 'X' permission, but I don't trust it.