Module Release October 2002: Managing File Ownership and Permissions

This month's two module release continues our series of modules on Unix filesystems. The first module, introduces the basic concept of file ownership under Unix, i.e., the notion that all files, including those which represent running processes, belong to an individual user and to a user group. The second module details the methods by which individual owners, group owners and general system users may be given various levels of permission to use particular files and processes.

After introducing the basic concepts, including the distinction between the root user (administrator) and every other class of user, the ownership module details the commands used to change user and group ownership (chown and chgrp) of individual files. Attention then moves to changing the ownership of directories and all of their contents, including their subdirectories, i.e., using chown and chgrp recursively.

The second module begins by attempting to clarify the distinction between the basic concepts of ownership and permission, making the point that the two issues should be considered seperately, i.e., deciding who a file belongs to is not the same question as deciding how much control different classes of user should exercise over the same file. Early foils explain simple file permissions, pointing out that each class of user (owner, group and others) can have read (r), write (w) or execute (x) permission on a file. They also point out that the three types of permission (r,w,x) have slightly different meanings when applied to directory files, e.g. execute (x) means permission to change (cd) into a directory.

A subsequent foil highlights the potential problem of changing the permissions on a file when you act upon it (e.g., by copying it), and explains how to preserve your original permissions. By contrast later foils explain how to set and change permissions manually using the chmod command, and how to set them automatically with a ‘user mask’ using the umask command. Finally a block of foils explains both the purpose for, and the methods of using, special permissions, i.e., the so-called ‘sticky’ permission, set user identity (setuid) and set group identity (setgid).