How Linux Manages File Permissions Natively

This article provides an overview of native file permission management within the Linux operating system. Linux controls access to system resources through a native Discretionary Access Control (DAC) model that assigns specific read, write, and execute rights to files and directories based on user identity. By categorizing access levels into owners, groups, and all other users, Linux maintains system security, prevents unauthorized file modification, and ensures process isolation natively without the immediate requirement of external security modules.

The Three Permission Classes

Linux manages file access by categorizing every entity attempting to interact with a file into one of three distinct classes:

• User (Owner): The specific user account that owns the file, usually the account that created it.
• Group: A designated collection of users. Any user belonging to this group inherits the group's specific permissions for the file.
• Others: Everyone else on the system who is neither the file owner nor a member of the assigned group.

Basic Permission Types

Every class has three primary permission bits that dictate what actions can be performed on a target:

• Read (r): Grants permission to view the contents of a file. On a directory, it allows listing the names of files inside.
• Write (w): Grants permission to modify, overwrite, or delete the contents of a file. On a directory, it allows creating, deleting, or renaming files within that directory.
• Execute (x): Allows running a file as a program or script. On a directory, the execute permission (often called the search or traverse bit) is required to enter the directory (cd) and access its contents.

Permission Representation

Linux represents permissions in two primary formats: symbolic and octal.

1. Symbolic Notation

When viewing files using ls -l, permissions appear as a 10-character string (for example, -rwxr-xr--):

• The first character indicates the file type (- for regular file, d for directory, l for symbolic link).
• Characters 2–4 represent the User permissions (rwx).
• Characters 5–7 represent the Group permissions (r-x).
• Characters 8–10 represent the Others permissions (r--).

A hyphen (-) indicates that a permission is not granted.

2. Octal (Numeric) Notation

Permissions are calculated mathematically using a base-8 numeric system where each permission corresponds to a power of two:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1
• None (-) = 0

Adding these values yields a single digit (0 through 7) for each category. For example, rwxr-xr-- translates to:

• User: 4 + 2 + 1 = 7
• Group: 4 + 0 + 1 = 5
• Others: 4 + 0 + 0 = 4
• Octal mode: 754

Management Commands

Native utilities within core Linux distributions allow administrators to configure permissions:

• chmod (Change Mode): Modifies file permissions using either octal values (chmod 755 file.sh) or symbolic syntax (chmod u+x,g-w file.sh).
• chown (Change Owner): Transfers ownership of a file to another user or group (chown user:group file.txt).
• chgrp (Change Group): Specifically updates the group ownership of a file (chgrp developers file.txt).
• umask (User Mask): Determines default permissions for newly created files and directories by filtering out specified permission bits at creation time.

Special Permission Bits

In addition to standard read, write, and execute rights, the Linux kernel natively provides three special permission bits:

• Setuid (SUID): Applied to executable files; causes the file to execute with the privileges of the file owner rather than the user running it (represented as an s in the owner's execute field).
• Setgid (SGID): Applied to executables to run with group privileges. When applied to directories, new files created inside inherit the group ownership of the directory rather than the primary group of the creating user.
• Sticky Bit: Primarily applied to shared directories (such as /tmp). It prevents users from deleting or renaming files owned by other users, even if they have write access to the directory itself (represented as a t in the others' execute field).