46
46
Files are given an owner and group when they are created. Usually the
47
47
owner is the current user and the group is the group of the directory
48
48
the file is in, but this varies with the operating system, the
49
filesystem the file is created on, and the way the file is created. You
50
can change the owner and group of a file by using the @code{chown} and
51
@code{chgrp} commands.
49
file system the file is created on, and the way the file is created. You
50
can change the owner and group of a file by using the @command{chown} and
51
@command{chgrp} commands.
53
53
In addition to the three sets of three permissions listed above, a
54
54
file's permissions have three special components, which affect only
60
set the process's effective user ID to that of the file upon execution
60
Set the process's effective user ID to that of the file upon execution
61
61
(called the @dfn{setuid bit}). No effect on directories.
64
set the process's effective group ID to that of the file upon execution
64
Set the process's effective group ID to that of the file upon execution
65
65
(called the @dfn{setgid bit}). For directories on some systems, put
66
66
files created in the directory into the same group as the directory, no
67
67
matter what group the user who creates them is in.
70
70
@cindex swap space, saving text image in
71
71
@cindex text image, saving in swap space
72
@cindex append-only directories
73
save the program's text image on the swap device so it will load more
74
quickly when run (called the @dfn{sticky bit}). For directories on some
75
systems, prevent users from removing files that they do not own in the
76
directory; this is called making the directory @dfn{append-only}.
72
@cindex restricted deletion flag
73
prevent users from removing or renaming a file in a directory
74
unless they own the file or the directory; this is called the
75
@dfn{restricted deletion flag} for the directory.
76
For regular files on some systems, save the program's text image on the
77
swap device so it will load more quickly when run; this is called the
81
In addition to the permissions listed above, there may be file attributes
82
specific to the file system, e.g: access control lists (ACLs), whether a
83
file is compressed, whether a file can be modified (immutability), whether
84
a file can be dumped. These are usually set using programs
85
specific to the file system. For example:
86
@c should probably say a lot more about ACLs... someday
90
On @acronym{GNU} and @acronym{GNU}/Linux the file permissions
91
(``attributes'') specific to
92
the ext2 file system are set using @command{chattr}.
95
On FreeBSD the file permissions (``flags'') specific to the FFS
96
file system are set using @command{chrflags}.
99
Although a file's permission ``bits'' allow an operation on that file,
100
that operation may still fail, because:
104
the file-system-specific permissions do not permit it;
107
the file system is mounted as read-only.
110
For example, if the immutable attribute is set on a file,
111
it cannot be modified, regardless of the fact that you
112
may have just run @code{chmod a+w FILE}.
79
114
@node Symbolic Modes
80
115
@section Symbolic Modes
89
124
The format of symbolic modes is:
92
@r{[}ugoa@dots{}@r{][[}+-=@r{][}rwxXstugo@dots{}@r{]}@dots{}@r{][},@dots{}@r{]}
127
@r{[}ugoa@dots{}@r{][}+-=@r{]}@var{perms}@dots{}@r{[},@dots{}@r{]}
131
where @var{perms} is either zero or more letters from the set
132
@samp{rwxXst}, or a single letter from the set @samp{ugo}.
95
134
The following sections describe the operators and other details of
120
159
The spaces between the three parts above are shown for readability only;
121
symbolic modes can not contain spaces.
160
symbolic modes cannot contain spaces.
123
162
The @var{users} part tells which users' access to the file is changed.
124
163
It consists of one or more of the following letters (or it can be empty;
162
201
The @var{permissions} part tells what kind of access to the file should
163
be changed; it is zero or more of the following letters. As with the
202
be changed; it is normally zero or more of the following letters. As with the
164
203
@var{users} part, the order does not matter when more than one letter is
165
204
given. Omitting the @var{permissions} part is useful only with the
166
205
@samp{=} operation, where it gives the specified @var{users} no access
218
257
@cindex copying existing permissions
219
258
@cindex permissions, copying existing
220
You can base part of a file's permissions on part of its existing
221
permissions. To do this, instead of using @samp{r}, @samp{w}, or
222
@samp{x} after the operator, you use the letter @samp{u}, @samp{g}, or
223
@samp{o}. For example, the mode
259
You can base a file's permissions on its existing permissions. To do
260
this, instead of using a series of @samp{r}, @samp{w}, or @samp{x}
262
operator, you use the letter @samp{u}, @samp{g}, or @samp{o}. For
230
@c FIXME describe the ls -l notation for showing permissions.
231
270
adds the permissions for users who are in a file's group to the
232
271
permissions that other users have for the file. Thus, if the file
233
272
started out as mode 664 (@samp{rw-rw-r--}), the above mode would change
252
291
@samp{g} in the @var{users} part of the symbolic mode and
253
292
@samp{s} in the @var{permissions} part.
255
To change a file's permission to stay permanently on the swap device,
256
use @samp{o} in the @var{users} part of the symbolic mode and
294
To change a file's permission to set the restricted deletion flag or sticky bit,
295
omit the @var{users} part of the symbolic mode (or use @samp{a}) and put
257
296
@samp{t} in the @var{permissions} part.
259
For example, to add set user ID permission to a program,
298
For example, to add set-user-ID permission to a program,
260
299
you can use the mode:
266
To remove both set user ID and set group ID permission from
305
To remove both set-user-ID and set-group-ID permission from
267
306
it, you can use the mode:
273
To cause a program to be saved on the swap device, you can use
312
To set the restricted deletion flag or sticky bit, you can use
280
Remember that the special permissions only affect files that are
281
executable, plus, on some systems, directories (on which they have
282
different meanings; @pxref{Mode Structure}). Using @samp{a}
283
in the @var{users} part of a symbolic mode does not cause the special
284
permissions to be affected; thus,
291
has @emph{no effect}. You must use @samp{u}, @samp{g}, and @samp{o}
292
explicitly to affect the special permissions. Also, the
293
combinations @samp{u+t}, @samp{g+t}, and @samp{o+s} have no effect.
319
The combination @samp{o+s} has no effect. On @acronym{GNU} systems
320
the combinations @samp{u+t} and @samp{g+t} have no effect, and
321
@samp{o+t} acts like plain @samp{+t}.
295
323
The @samp{=} operator is not very useful with special permissions; for
296
324
example, the mode:
303
does cause the file to be saved on the swap device, but it also
331
does set the restricted deletion flag or sticky bit, but it also
304
332
removes all read, write, and execute permissions that users not in the
305
333
file's group might have had for it.
310
338
@cindex conditional executability
311
339
There is one more special type of symbolic permission: if you use
312
340
@samp{X} instead of @samp{x}, execute permission is affected only if the
313
file already had execute permission or is a directory. It affects
314
directories' execute permission even if they did not initially have any
315
execute permissions set.
341
file is a directory or already had execute permission.
317
343
For example, this mode:
324
gives all users permission to execute files (or search directories) if
350
gives all users permission to search directories, or to execute files if
351
anyone could execute them before.
327
353
@node Multiple Changes
328
354
@subsection Making Multiple Changes
345
371
gives users other than the owner of the file read permission and, if
346
372
it is a directory or if someone already had execute permission
347
373
to it, gives them execute permission; and it also denies them write
348
permission to it file. It does not affect the permission that the
374
permission to the file. It does not affect the permission that the
349
375
owner of the file has for it. The above mode is equivalent to
433
459
@cindex numeric modes
434
460
@cindex file permissions, numeric
435
461
@cindex octal numbers for file modes
436
File permissions are stored internally as 16 bit integers. As an
437
463
alternative to giving a symbolic mode, you can give an octal (base 8)
438
number that corresponds to the internal representation of the new mode.
464
number that represents the new mode.
439
465
This number is always interpreted in octal; you do not have to add a
440
466
leading 0, as you do in C. Mode 0055 is the same as mode 55.
442
468
A numeric mode is usually shorter than the corresponding symbolic
443
mode, but it is limited in that it can not take into account a file's
469
mode, but it is limited in that it cannot take into account a file's
444
470
previous permissions; it can only set them absolutely.
446
The permissions granted to the user, to other users in the file's group,
447
and to other users not in the file's group are each stored as three
472
The permissions granted to the user,
473
to other users in the file's group,
474
and to other users not in the file's group each require three
448
475
bits, which are represented as one octal digit. The three special
449
permissions are also each stored as one bit, and they are as a group
450
represented as another octal digit. Here is how the bits are arranged
451
in the 16 bit integer, starting with the lowest valued bit:
476
permissions also require one bit each, and they are as a group
477
represented as another octal digit. Here is how the bits are arranged,
478
starting with the lowest valued bit:
454
481
Value in Corresponding
478
505
For example, numeric mode 4755 corresponds to symbolic mode
479
506
@samp{u=rwxs,go=rx}, and numeric mode 664 corresponds to symbolic mode
480
507
@samp{ug=rw,o=r}. Numeric mode 0 corresponds to symbolic mode
483
@comment texi related words used by Emacs' spell checker ispell.el
485
@comment LocalWords: texinfo setfilename settitle setchapternewpage
486
@comment LocalWords: iftex finalout ifinfo DIR titlepage vskip pt
487
@comment LocalWords: filll dir samp dfn noindent xref pxref
488
@comment LocalWords: var deffn texi deffnx itemx emph asis
489
@comment LocalWords: findex smallexample subsubsection cindex
491
@comment LocalWords: chgrp chown executability filesystem FIXME ls og rw
492
@comment LocalWords: rwx rwxr rwxs rwxXstugo rx rX rxw setgid setuid ug
493
@comment LocalWords: ugo ugoa umask
added
removed
doc/perm.texi
