🛅 Mastering File Permissions & ACLs in Linux

Linux provides a powerful permission model to control who can access, modify, and execute files on a system. Proper permission management is crucial for security, stability, and efficient user management. Today, we will dive deep into file permissions, ownership, and Access Control Lists (ACLs) with real-world examples. 🚀

---

🏗 Understanding Linux File Permissions

Every file in Linux has three types of user classifications:

1️⃣ Owner (User) → The creator of the file (e.g., a developer working on a script).
2️⃣ Group → A set of users who share permissions (e.g., DevOps engineers in a team).
3️⃣ Others → Any other user on the system (e.g., external users accessing a shared server).

Each classification has three permission types:

• 🔍 Read (r) → Can view the file's contents.

• ✍️ Write (w) → Can edit or delete the file.

• 🚀 Execute (x) → Can run the file if it's a script or program.

💻 Checking File Permissions

To check a file’s permissions, run:

ls -l myfile.txt

Example Output:

-rwxr--r--  1 devops team  1024 Feb 22 10:00 deploy.sh

Breaking Down the Permissions:

• rwxr--r-- → Represents who can do what (user, group, others).

• devops → The owner of the file.

• team → The group assigned to the file.

• 1024 → File size in bytes.

• Feb 22 10:00 → Last modified date.

• deploy.sh → File name.

📌 Decoding the Permission Code

---

🔧 Modifying File Permissions Using chmod

🔹 Symbolic Mode (User-Based)

Change permissions for User (u), Group (g), and Others (o):

Example 1: Grant execute permission to the owner:

chmod u+x deploy.sh

✅ Now, the owner can execute the script.

Example 2: Remove write access from the group:

chmod g-w deploy.sh

✅ The group can no longer modify the file.

🔢 Octal Mode (Numeric Representation)

Permissions are represented as:

• r (Read) = 4, w (Write) = 2, x (Execute) = 1

Example 3: Set permissions to rw-r--r-- (Owner: Read & Write, Group & Others: Read-Only)

chmod 644 deploy.sh

✅ Ensures only the owner can edit the file.

---

👑 Changing File Ownership with chown

Every file has an owner and an associated group. The chown command is used to change the owner or group of a file.

Example 1: Assign john as the new owner of deploy.sh:

sudo chown john deploy.sh

✅ Now, John owns the file.

Example 2: Change both owner and group to john:developers:

sudo chown john:developers deploy.sh

✅ Now, John and the developers group manage the file.

---

🛡️ Advanced Access Control Lists (ACLs)

Traditional permissions (chmod and chown) are sometimes too restrictive. What if you want to give a specific user extra permissions without changing the group? That’s where Access Control Lists (ACLs) come in!

📌 Checking ACLs for a File

getfacl deploy.sh

✅ This displays custom permissions beyond standard Linux permissions.

✍️ Adding ACLs

Example: Grant alice read and execute access to deploy.sh without modifying group settings:

setfacl -m u:alice:rx deploy.sh

✅ Now, Alice can read & execute the file.

❌ Removing ACLs

To remove all ACLs from a file:

setfacl -b deploy.sh

✅ Now, the file follows only traditional permissions.

---

🎯 Real-Life Use Cases for File Permissions & ACLs

🔹 Example 1: Securing Deployment Scripts in DevOps

Scenario: A DevOps team maintains a deploy.sh script used for server updates.

• The script owner should have read, write, and execute permissions.

• The DevOps team (group) should have read & execute access.

• Other users should not have any access.

Solution:

chmod 750 deploy.sh

✅ This ensures only authorized team members can execute the script.

🔹 Example 2: Shared Project Folder for Developers

Scenario: A development team is working on a project.

• The Project Lead should have full access.

• Developers should have read and write access.

• Interns should have only read access.

Solution Using ACLs:

setfacl -m u:lead:rwx project_folder
setfacl -m g:developers:rw project_folder
setfacl -m g:interns:r project_folder

✅ This customizes access levels for different roles in the team.

🔹 Example 3: Preventing Accidental File Deletion

Scenario: A critical system log file should never be modified by regular users.
Solution: Apply immutable flag to prevent accidental edits:

chattr +i /var/log/syslog

✅ Now, even root cannot delete it without removing the flag.

---

🚀 Key Takeaways for IT Professionals

✔️ File Permissions (chmod) control who can read, write, and execute files.
✔️ Ownership (chown) defines who manages a file.
✔️ ACLs (setfacl) allow fine-grained access control beyond traditional permissions.
✔️ Immutable files (chattr) can protect critical files from accidental deletion.

---

🎯 Next Steps

💡 Practice Task:
1️⃣ Create a test file and experiment with chmod, chown, and ACLs.
2️⃣ Try setting different access levels for different users in a group.
3️⃣ Learn about special permissions (SUID, SGID, Sticky Bit) for advanced security.

📌 Coming Next: Day 7 – Linux Process Management! ⚙️ Stay tuned!