# 1. Introduction

### **Users, Groups, and Files & Directories**

* At a basic level, permissions in Linux are a relationship between users, groups, and files & directories.
* Users can belong to multiple groups.
* Groups can have multiple users.
* Every file and directory defines its permissions in terms of a user, a group, and “others” (all other users).

#### Users

* User accounts are configured in the **/etc/passwd** file.
* User password hashes are stored in the **/etc/shadow** file.
* Users are identified by an integer user ID (**UID**).
* The “root” user account is a special type of account in Linux.
  * It has an UID of **0**, and the system grants this user access to every file.

#### Groups

* Groups are configured in the **/etc/group** file.
* Users have a primary group, and can have multiple secondary (or supplementary) groups.
* By default, a user’s primary group has the same name as their user account.

#### Files & Directories

* All files & directories have a single owner and a group.
* Permissions are defined in terms of read, write, and execute operations.
* There are three sets of permissions, one for the owner, one for the group, and one for all “other” users (can also be referred to as “world”).
* Only the owner can change permissions.

***

### **Permissions**

#### File Permissions

* **Read** – when set, the file contents can be read.
* **Write** – when set, the file contents can be modified.
* **Execute** – when set, the file can be executed (i.e. run as some kind of process).

#### Directory Permissions

* Execute – when set, the directory can be entered. Without this permission, neither the read nor write permissions will work.
* Read – when set, the directory contents can be listed.
* Write – when set, files and subdirectories can be created in the directory.

#### Special Permissions

1. **setuid (SUID) bit**
   * When set, files will get executed with the privileges of the file owner
2. **setgid (SGID) bit**
   * When set on a file, the file will get executed with the privileges of the file group.
   * When set on a directory, files created within that directory will inherit the group of the directory itself.

#### Viewing Permissions

The `ls` command can be used to view permissions:

```
$ ls -l /bin/date
-rwxr-xr-x 1 root root 60416 Apr 28 2010 /bin/date
```

* The first 10 characters indicate the permissions set on the file or directory.
* The first character simply indicates the type (e.g. '-' for file, 'd' for directory).
* The remaining 9 characters represent the 3 sets of permissions (owner, group, others).
* Each set contains 3 characters, indicating the read (r), write (w), and execute (x) permissions.
* SUID/SGID permissions are represented by an 's' in the execute position.

***

### **Real, Effective, & Saved UID/GID**

Each user has 3 user IDs in Linux (real, effective, and saved).

#### Real UID/GID

* A user’s real ID is who they actually are (the ID defined in /etc/passwd). Ironically, the real ID is actually used less often to check a user’s identity

#### Effective UID/GID

* A user’s effective ID is normally equal to their real ID, however when executing a process as another user, the effective ID is set to that user’s real ID.
* The effective ID is used in most access control decisions to verify a user, and commands such as `whoami` use the effective ID.

#### Saved UID/GID

The saved ID is used to ensure that SUID processes can temporarily switch a user’s effective ID back to their real ID and back again without losing track of the original effective ID.

#### Viewing UID/GID

Print real and effective user / group IDs using `id` command:

```
# id
uid=1000(user) gid=1000(user) euid=0(root) egid=0(root)
groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),1000(user)
```

Print real, effective, saved, and file system user / group IDs of the current process (i.e. our shell):

```
# cat /proc/$$/status | grep "[UG]id"
Uid:	1000	0	0	0
Gid:	1000	0	0	0
```

***