[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.2.d
AP Cybersecurity · Securing Applications and Data
Linux File Permissions (chmod, octal)
Read the rwx string, do the 4–2–1 arithmetic, set it the numeric or symbolic way — then verify.
key idearwx in that order, three times over — owner, group, other. Add 4–2–1 per group to get the octal.
The syntax
Linux file permissions are the most concrete access control you will configure in this course. Two commands do all of it: ls -l to read the current settings and chmod to change them. Everything else is arithmetic.
Each group of three slots is worth $4+2+1$. A set slot contributes its value; a dash contributes $0$. So rwxr-xr-- is $7\,5\,4$.reading permissionsEK 5.2.D.4
# list files in long format — shows the permission string
ls -l
-rwxr-xr-- 1 jsmith staff 4096 Jul 25 09:14 deploy.sh
drwxr-x--- 4 jsmith staff 128 Jul 24 17:02 logs
-rw-r--r-- 1 root wheel 1201 Jul 20 11:48 motd
col 1File type: - is a regular file, d is a directory.cols 2–4Owner's permissions. rwx = read, write, execute.cols 5–7Group's permissions. r-x = read and execute, no write.cols 8–10Everyone else. r-- = read only.
| Octal | Binary | Letters | What that entity can do |
|---|
7 | 111 | rwx | read, write, execute — full control |
6 | 110 | rw- | read and write, cannot execute |
5 | 101 | r-x | read and execute, cannot modify |
4 | 100 | r-- | read only |
3 | 011 | -wx | write and execute, cannot read (rare) |
2 | 010 | -w- | write only |
1 | 001 | --x | execute only |
0 | 000 | --- | no access |
One digit per entity, always in the order owner → group → other.
Doing it step by step
1
Decide who needs what
Start from least privilege: give each entity the minimum that still lets it do its job. A deploy script the owner runs and the team reads is rwx / r-x / ---.
in a requirement out three rwx triples
2
Convert each triple to a digit
Add the values of the set slots: $r=4$, $w=2$, $x=1$. So rwx→$7$, r-x→$5$, ---→$0$.
in rwx triples out a three-digit octal
3
Run chmod — numeric method
chmod 750 deploy.sh. The numeric method sets all nine slots at once, overwriting whatever was there.
in octal out new permissions
4
Or use the symbolic method for a tweak
chmod g+w deploy.sh adds write for the group and leaves everything else alone. Entities are u (user/owner), g (group), o (other), a (all).
in one change out everything else preserved
5
Verify with ls -l
Never assume the change landed. Re-run ls -l and read the string back.
in nothing out proof
changing permissionsEK 5.2.D.5 – 5.2.D.7
# numeric — sets all nine slots at once
chmod 750 deploy.sh # rwx r-x ---
# symbolic — adjusts only what you name
chmod g+w deploy.sh # add write for the group
chmod o-r notes.txt # remove read for others
chmod a+x run.sh # add execute for everyone
Worked analysis
EX 1
From a requirement to a command
numeric methodA shared server holds payroll.csv. The owner (the finance lead) must read and edit it. The finance group must read it but never change it. Nobody else may see it at all. Write the chmod command.
1
Translate each entity to letters
Owner: read + write, no need to execute a data file → rw-. Group: read only → r--. Other: nothing → ---.
2
Convert to digits
rw- $=4+2+0=6$. r-- $=4$. --- $=0$.
3
Assemble in order
Owner, then group, then other: 640.
4
Run it
chmod 640 payroll.csv
5
Why not 644?
$644$ would give other read access — every account on the server could open the payroll file. That one digit is the whole control.
EX 2
Read a string back and spot the flaw
least privilegels -l shows -rwxrwxrwx 1 root wheel 882 config.sh. What is the octal, and what is wrong?
1
Split into three triples
rwx | rwx | rwx.
2
Convert
Each triple is $4+2+1=7$, so the file is 777.
3
Name the problem
Every user on the system can read, modify and execute a root-owned script. Any local account could edit config.sh to run arbitrary commands the next time it is invoked — a straightforward privilege-escalation path.
4
Apply least privilege
The owner needs full control; nobody else needs write. chmod 755 config.sh, or 750 if only the owner's group should run it.
5
Generalize
$777$ on anything is a finding. It is the permissions equivalent of a blank password.
EX 3
Numeric versus symbolic — pick the safe one
method choiceA file is currently rw-r----- ($640$). You need to let the group execute it as well. A colleague suggests chmod 710. Evaluate.
1
Work out what 710 actually sets
$7=$rwx for owner, $1=$--x for group, $0=$--- for other.
2
Compare with what was wanted
The group would lose its read permission and gain execute; the owner would gain execute it never needed. Only the execute-for-group part was requested.
3
Use symbolic instead
chmod g+x adds exactly one slot and preserves the other eight.
4
Verify
ls -l now shows -rw-r-x---, i.e. $650$ — the original $640$ plus group execute.
5
Rule of thumb
Numeric when you are setting a file's permissions from scratch; symbolic when you are adjusting one thing on a file already in service.
Verify the result
A permission change you have not read back is a permission change you have not made. The verification step is part of the procedure, not an optional extra.
verify
chmod 640 payroll.csv
ls -l payroll.csv
-rw-r----- 1 finlead finance 20481 Jul 25 10:02 payroll.csv
# ^^^ owner rw-, group r--, other --- → 640. Confirmed.
check 1Does the string match the octal you intended? Count the slots, do not eyeball it.check 2Is the owner and group correct? Permissions are meaningless if the file belongs to the wrong group.check 3A trailing + (e.g. -rw-r-----+) means extra ACL rules exist beyond the nine slots — ls -l alone no longer tells the whole story.
Check yourself
A file shows -rwxr-x---. What is the octal?
Show answer
750. Owner rwx$=7$, group r-x$=4+1=5$, other ---$=0$.
What does chmod 644 notes.txt allow?
Show answer
Owner can read and write; group and other can read only. Nobody can execute it.
Why is chmod 777 almost always wrong?
Show answer
It grants read, write and execute to every user on the system, which violates least privilege. On a script or config file it is a direct privilege-escalation path.
You need to remove read access for ‘other’ without disturbing anything else. Numeric or symbolic?
Show answer
Symbolic: chmod o-r filename. A numeric command would rewrite all nine slots and you would have to know the current values to avoid changing them.
What does the + at the end of -rw-r--r--+ tell you?
Show answer
An extended ACL is attached, so permissions beyond the standard owner/group/other model are in force. The nine-slot string is no longer a complete description of who can access the file.
In chmod 764, which entity gets write permission?
Show answer
Owner ($7=$rwx) and group ($6=$rw-). Other gets $4=$r--, read only.