{"id":82992,"date":"2020-10-06T18:00:00","date_gmt":"2020-10-06T15:00:00","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it\/"},"modified":"2020-10-06T18:00:00","modified_gmt":"2020-10-06T15:00:00","slug":"what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it\/","title":{"rendered":"#What Are File Permissions in Linux, and How Do I Make Sure Mine Are Secure? \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_87 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ab1d37bee370\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ab1d37bee370\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it\/#What_Are_File_Permissions\" >What Are File Permissions?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it\/#What_Are_File_Owners_and_Groups\" >What Are File Owners and Groups?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it\/#How_to_Check_File_Permissions_of_Directories\" >How to Check File Permissions of Directories<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure-cloudsavvy-it\/#How_to_Change_File_Permissions_and_Ownership\" >How to Change File Permissions and Ownership<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#What Are File Permissions in Linux, and How Do I Make Sure Mine Are Secure? \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<img loading=\"lazy\" decoding=\"async\" class=\"imgchk9 alignnone wp-image-716 size-full\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/79a8e030edfb5299d258823602cf2aa4\/p\/uploads\/2019\/06\/d0f34641-1.png\" alt=\"File permissions.\" width=\"700\" height=\"300\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>In Linux, file permissions determine the levels of privilege for file owners and everyone else. It\u2019s important to make sure any web-facing files have their permissions set correctly, so that a compromised process can\u2019t write to places it shouldn\u2019t.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_Are_File_Permissions\"><\/span>What Are File Permissions?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>File permissions track the permissions for three different groups. Each group is represented by three bits:<\/p>\n<ul>\n<li><strong>r:<\/strong> The\u00a0\u201cRead\u201d permission allows a process to read the contents of that file into memory.<\/li>\n<li><strong>w:<\/strong> The \u201cWrite\u201d permission gives a process access to overwrite the physical location on disk where that file is stored.<\/li>\n<li><strong>x:<\/strong> The \u201cExecute\u201d permission is for programs and allows that file to be executed.<\/li>\n<\/ul>\n<p>In the terminal, permissions are displayed like so:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"imgchk9 alignnone wp-image-701 size-full\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/0b4b62ecd69e0a2d4875478f13b85862\/p\/uploads\/2019\/06\/0577d77d-3.png\" alt=\"Displayed permissions.\" width=\"350\" height=\"150\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>The first \u201cd\u201d signifies whether the file is a directory. The first group of three is for the file owner. In this case, the file owner has full read, write, and execution access. The next group of three is \u201cgroup owners,\u201d which denotes the access rights for the group the file belongs to, in this case, read only. The next group is everyone else, which is read only.<\/p>\n<p><a href=\"https:\/\/buradabiliyorum.com\/en\/category\/general\/\" data-internallinksmanager029f6b8e52c=\"3\" title=\"General\" target=\"_blank\" rel=\"noopener\">General<\/a>ly, files with open \u201ceveryone\u201d permissions are not very secure. You will want to make sure the last group is set to read-only or no access for most files.<\/p>\n<p>Under the hood, these are stored in binary, with each permission representing a bit. For example, <code>rw-<\/code>\u00a0is <code>110<\/code>\u00a0in binary, which is 6 in decimal. So, the permission string:<\/p>\n<pre>rwxrw-r--<\/pre>\n<p>\u2026could be stored as \u201c764.\u201d File permissions will often be referred to this way; \u201c777\u201d denotes full access, \u201c700\u201d is private, \u201c644\u201d is read-only. Technically, this is known as <em>octal<\/em>, not decimal, because there are eight possible values for each digit.<\/p>\n<p>For directories, the permissions use the same characters, but are a bit different:<\/p>\n<ul>\n<li><strong>r:<\/strong> List permission. Allows the directory to be opened, and allows the use of\u00a0<code>ls<\/code>. Requires the x attribute to be set.<\/li>\n<li><strong>w:<\/strong> Write permission. Allows creation of new files, deletion of file, and renaming files. Does not prevent changing the contents of existing write-enabled files within the directory.<\/li>\n<li><strong>x:<\/strong> Enterability. Allows the use of <code>cd<\/code>. This is respected system wide, and will prevent the folder from being opened in a GUI file explorer.<\/li>\n<\/ul>\n<p>On some systems, particularly macOS, there may be a \u201c@\u201d after the file permission string. This means the file has extended attributes, which you can check with <code>ls -l@<\/code>. For example, the <code>com.<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>le.quarantine<\/code>\u00a0attribute is assigned to executables that have not been opened yet, so that Gatekeeper can block you from double-clicking it, force you to right-click &gt; open and then needlessly prompt you if you\u2019re\u00a0<em>really<\/em> sure you want to open it.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_Are_File_Owners_and_Groups\"><\/span>What Are File Owners and Groups?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The file owner is just a particular user, but users in Unix systems don\u2019t work the same way they do in Windows. Unix can have different users for individual processes like <code>mysql<\/code>\u00a0and <code>nginx<\/code>. This can make permissions very detailed; for example, an instance of MySQL running under the\u00a0<code>mysql<\/code>\u00a0user can access its own database, but the\u00a0<code>nginx<\/code>\u00a0user cannot.<\/p>\n<p>User groups work in a similar manner but support having multiple users with the same permissions. Users can be added and removed from the group, and they\u2019re optional for setting file permissions.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_Check_File_Permissions_of_Directories\"><\/span>How to Check File Permissions of Directories<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>You can view file and directory permissions by running <code>ls -l<\/code>\u00a0in your terminal. File permissions are displayed on the far right:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"imgchk9 alignnone wp-image-695 size-full\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/3694cd75e9be9019855514df411f8839\/p\/uploads\/2019\/06\/d0f34641.png\" alt=\"File permissions displayed on the far right.\" width=\"700\" height=\"150\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>If you want to display the file permissions for a specific file or directory, you\u2019ll need to pipe the <code>ls<\/code>\u00a0output to <code>grep<\/code>:<\/p>\n<pre>ls -la | grep filename<\/pre>\n<p>Note that the current folder and parent folder have their permissions displayed as <code>.<\/code>\u00a0and <code>..<\/code>\u00a0when using the <code>-a<\/code>\u00a0flag. However, even this only displays two levels of permissions. To display permissions for every parent folder, you\u2019ll need to use the <code>namei<\/code>\u00a0command:<\/p>\n<pre>namei -l `pwd`<\/pre>\n<p>This command may not be installed on every Linux distribution. On macOS, you\u2019ll have to install it from <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/apple.stackexchange.com\/a\/143754\">brew<\/a>.<\/p>\n<p>To search for individual files within those folders that may have errant permissions, you can use the <code>find<\/code>\u00a0command with the <code>-perm<\/code>\u00a0flag:<\/p>\n<pre>find ~ -type f -perm 777<\/pre>\n<p>This searches recursively, and may take some time if you\u2019re running it on the root directory.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_Change_File_Permissions_and_Ownership\"><\/span>How to Change File Permissions and Ownership<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Changing file permissions is simple with the <code>chmod<\/code>\u00a0command:<\/p>\n<pre>chmod 700 filename<\/pre>\n<p>You can also add permissions without specifying a full permission string. This is a shortcut, but can save some time. For example, if you can\u2019t open a script file, you can add permission for the owner to execute with:<\/p>\n<pre>chmod u+x filename<\/pre>\n<p>This adds the execute (x) permission for the current owner (u, for \u201cuser\u201d).<\/p>\n<p>Changing owners works similarly with the <code>chown<\/code>\u00a0command:<\/p>\n<pre>chown owner:group filename<\/pre>\n<p>The \u201c:group\u201d is optional. Both <code>chmod<\/code>\u00a0and <code>chown<\/code>\u00a0can be run recursively on directories, to change file permissions for everything within those directories. To do this, use the uppercase <code>-R<\/code>\u00a0flag:<\/p>\n<pre>chmod 700 -R directory<\/pre>\n<p>You can also use <code>chmod<\/code>\u00a0as the <code>-exec<\/code>\u00a0option for <code>find<\/code>, which lets you change file permissions throughout the system. For example, this command will find files that have open write permissions, and set them to read-only:<\/p>\n<pre>find \/ -type f -perm 777 -print -exec chmod 744 {} ;<\/pre>\n<\/div>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener noreferrer\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/692\/what-are-file-permissions-in-linux-and-how-do-i-make-sure-mine-are-secure\/\" target=\"_blank\" rel=\"noopener noreferrer\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#What Are File Permissions in Linux, and How Do I Make Sure Mine Are Secure? \u2013 CloudSavvy IT&#8221; In Linux, file permissions determine the levels of privilege for file owners and everyone else. It\u2019s important to make sure any web-facing files have their permissions set correctly, so that a compromised process can\u2019t write to places&#8230;<\/p>\n","protected":false},"author":1,"featured_media":82993,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2019\/06\/d0f34641-1.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-82992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/82992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=82992"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/82992\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/82993"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=82992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=82992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=82992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}