Day 01: Read and set file permissions

-rw-r--r-- is ten characters that answer three questions for three audiences. Once you can read it without counting on your fingers, most "permission denied" messages explain themselves.

1. Read the string

mkdir -p ~/labs/perms && cd ~/labs/perms
touch report.txt
ls -l report.txt

You get something like -rw-r--r-- 1 you you 0 ... report.txt. Take the first field apart:

So -rw-r--r-- is: a regular file, the owner can read and write, everyone else can only read.

2. Set permissions symbolically

chmod u+x report.txt
ls -l report.txt
chmod go-r report.txt
ls -l report.txt
chmod a=r report.txt
ls -l report.txt

u owner, g group, o others, a all. + adds, - removes, = sets exactly. a=r is the only one of the three that discards whatever was there before.

3. Set the same thing numerically

Each of r, w, x is a bit: read is 4, write is 2, execute is 1. Add them per audience.

chmod 644 report.txt   # 6=rw- owner, 4=r-- group, 4=r-- other
ls -l report.txt
chmod 600 report.txt   # owner only
ls -l report.txt
chmod 755 report.txt   # the standard for something executable
ls -l report.txt

Three numbers worth memorising: 644 for a normal file, 600 for a secret, 755 for a script or a directory.

4. Learn what x means on a directory

This is the part that surprises people. On a file, x means "may execute". On a directory it means "may traverse".

mkdir vault
touch vault/secret.txt
chmod 400 vault          # r-- : can list, cannot enter
ls vault
cat vault/secret.txt

ls vault works — you can read the list of names. cat vault/secret.txt fails — you cannot traverse into it to reach the file. Now the opposite:

chmod 100 vault          # --x : can enter, cannot list
ls vault
cat vault/secret.txt

Now ls fails and cat succeeds, provided you know the filename. A directory that is --x is why some servers can serve /files/known-name.pdf while refusing to index the folder.

5. Fix a whole tree without breaking it

The naive recursive fix is wrong:

chmod 755 vault
mkdir -p vault/{a,b}
touch vault/a/one.txt vault/b/two.txt
chmod -R 644 vault        # WRONG: directories lose their x
ls vault/a

That fails — the directories are no longer traversable. The correct form treats files and directories differently:

find vault -type d -exec chmod 755 {} +
find vault -type f -exec chmod 644 {} +
ls -l vault vault/a

Clean up

cd ~ && rm -rf ~/labs/perms

Where this goes next

Permissions say what each of three audiences may do. Tomorrow answers the other half: who counts as the owner and the group in the first place.