Permissions and sudo · Linux and the Command Line
Who is allowed to read, change and run each file?
Course contentsWhy you need it
Permissions are Linux's first line of defence. A password file readable by everyone, or a script anyone can change and the server then runs, is a classic way in for attackers. "Permission denied" is also the error beginners meet most, and it always has a clear reason.
The intuition
ls -l shows something like -rwxr-x---. After the first character (- file, d folder) come three groups of three:
| owner | group | others |
|---|---|---|
| rwx | r-x | --- |
r read, w write, x execute (for a folder: enter it).
Each group is also a digit: r = 4, w = 2, x = 1, added up. So rwx r-x --- is 750, and chmod 750 file sets it. chmod u+x file adds execute for the owner only.
sudo runs one command as root, the administrator, who may do anything.
Definition
Permission bits
Read, write and execute for the owner, the group and everyone else, written as letters (rwxr-xr--) or digits (754).
Least privilege
Give each user and program only the access it needs. Secrets are often 600: the owner reads and writes, nobody else can even read.
Examples
Read the permissions
Run it in the lessondeploy.sh can't run yet; secret.env belongs to root and only root can read it.
ls -l
chmod u+x deploy.sh
ls -l deploy.sh
./deploy.sh- L1deploy.sh is rw-r--r-- (644): no x anywhere.
- L2u+x: add execute for the owner (you).
- L3Now rwxr--r--, which is 744.
- L4./ means: run the file in this folder.
deploying
Permission denied, and sudo
Run it in the lessonYou are not root, so the 600 file is closed to you. sudo opens it, which is exactly why sudo should be used rarely.
whoami
sudo cat secret.env
cat secret.envThis example stops with an error on purpose: reading the message is the point.
- L1You are learner.
learner - L2As root, the read works.
- L3As learner: Permission denied, and the run stops here.
Common mistakes
chmod 777
777 lets anyone read, change and run the file. It "fixes" permission errors by removing all protection. Find out who actually needs access instead.
sudo by habit
A typo with sudo can damage the whole system, and files you create with sudo belong to root. Use it only for the one command that needs it.
Quick quiz
1. What digits mean `rw-r-----`?
Show the answer
Answer: A
Owner rw- = 4 + 2 = 6, group r-- = 4, others --- = 0.
2. What does this print?
touch key.pem
chmod 600 key.pem
ls -l key.pemShow the answer
Answer: A
6 = rw for the owner, 0 and 0 for everyone else.
Practice
3 exercises in three steps: predict what a program prints, change a program to meet a new requirement, then write one from scratch. Your code runs in the browser and is checked the moment you submit.
- PredictDigits to letters
After these commands, what permissions does
ls -lshow for a and b? - ModifyLock down the key
chmod 777makes the key readable and writable by everyone. Change it so only you can read and writeapi.key, and nobody can run it. - WriteMake a script runnable
Make
deploy.shexecutable for its owner, readable by everyone, and writable only by its owner (that's 744), then run it.
Practise this lesson
Open the interactive lesson to edit and run these examples and solve the exercises with instant feedback. Free to start, no sign-up.
Interactive lessons open in order. If you have not done the earlier ones yet, you start at the course map.
Terms in this lesson
| Term | Chinese | Definition |
|---|---|---|
| Permission | 权限 | Whether a user may read, write or execute a file. |
| root | root 超级用户 | The administrator account on Linux; it may do anything. |
| sudo | sudo | Runs one command as root. |