File Permissions and Access Control Lists in Linux

File permissions in Linux control who can read, write, and execute files and directories. By default, all files and directories have three permissions:

User (owner): The user who created the file or directory has full permissions.
Group: The group that the file or directory belongs to has read and execute permissions.
Other: All other users on the system have read and execute permissions.

Permissions can be represented using a three-character string, where each character represents a permission:

r: Read permission
w: Write permission
x: Execute permission

For example, the permission string -rw-r--r-- means that the user who created the file has read and write permissions, the group has read-only permission, and all other users have read-only permission.

Permissions can be changed using the chmod command. For example, to change the permissions of a file to -rw-r--r--, you would use the following command:

chmod 644 filename

The number 644 is equivalent to the permission string -rw-r--r--.

Access control lists (ACLs) allow you to define more granular permissions for files and directories. ACLs allow you to specify permissions for individual users and groups.

To view the ACL for a file or directory, you can use the getfacl command. For example, to view the ACL for the file filename, you would use the following command:

getfacl filename

To set the ACL for a file or directory, you can use the setfacl command. For example, to set the ACL for the file filename to allow the user user1 to have read and write permissions, and the group group1 to have read-only permission, you would use the following command:

setfacl -m user:user1:rw group:group1:r filename

Examples

Here are some examples of how to use file permissions and ACLs in Linux:

To prevent other users from reading a file:

chmod 600 filename

This will set the permissions of the file so that only the user who created the file can read it.

To allow all users to execute a file:

chmod 755 filename

This will set the permissions of the file so that all users can execute it, but only the user who created the file can read or write to it.

To allow a specific user to read a file:

setfacl -m user:user1:r filename

This will add the user user1 to the ACL for the file and give them read permission.

To allow a specific group to write to a directory:

setfacl -m group:group1:w directory

This will add the group group1 to the ACL for the directory and give them write permission.

Commands

Here is a summary of the commands that were discussed in this blog post:

chmod: Change file permissions.
getfacl: View the ACL for a file or directory.
setfacl: Set the ACL for a file or directory.

getfacl & setfacl:

getfacl and setfacl are two powerful Linux commands that can be used to manage access control lists (ACLs). ACLs are a way to define more granular permissions for files and directories than the traditional Unix permissions system.

getfacl

The getfacl command is used to display the ACL for a file or directory. To use the getfacl command, simply type the following command:

getfacl <file or directory>

This will display the ACL for the specified file or directory. The output of the getfacl command will look something like this:

# file: filename
# owner: user1
# group: group1
user:user1:rw-
group:group1:r--
other:--x

This output shows that the file filename has the following ACL:

The user user1 has read and write permissions.
The group group1 has read-only permission.
All other users have execute-only permission.

setfacl

The setfacl command is used to set the ACL for a file or directory. To use the setfacl command, simply type the following command:

setfacl -m <permissions> <file or directory>

The -m option tells the setfacl command to modify the existing ACL. The permissions argument specifies the permissions that you want to add or remove from the ACL.

For example, to add read and write permissions for the user user2 to the file filename, you would use the following command:

setfacl -m user:user2:rw filename

To remove read permission for the group group1 from the file filename, you would use the following command:

setfacl -m group:group1:-r filename

You can also use the setfacl command to remove all ACLs from a file or directory. To do this, simply type the following command:

setfacl -x <file or directory>

Example

The following example shows how to use the getfacl and setfacl commands to manage the ACL for a file:

# Display the ACL for the file filename
getfacl filename

# Add read and write permissions for the user user2 to the file filename
setfacl -m user:user2:rw filename

# Display the ACL for the file filename again
getfacl filename

# Remove all ACLs from the file filename
setfacl -x filename

Explanation:

ACLs can be used to implement a variety of security policies. For example, you can use ACLs to:

Prevent unauthorized users from accessing sensitive files.
Allow specific users or groups to access files that are not readable by everyone.
Implement role-based access control (RBAC) by assigning different permissions to different users and groups based on their roles.

ACLs can also be used to improve the performance of your system by reducing the number of times that files need to be opened and closed. For example, if you have a file that is frequently accessed by a group of users, you can give that group read permission for the file. This will allow the users to open the file without having to check the permissions each time.

Takeaway:

File permissions and ACLs are powerful tools that can be used to control access to files and directories in Linux. By understanding how to use these tools, you can help to protect your system and data from unauthorized access, improve the security and performance of your Linux system.