# LPI Linux Certification/Manage File Permissions And Ownership
## Detailed Objectives

(LPIC-1 Version 5.0)
Weight: 3
Description:
Candidates should be able to control file access through the proper use of permissions and ownerships.
Key Knowledge Areas:
* Manage access permissions on regular and special files as well as directories.
* Use access modes such as suid, sgid and the sticky bit to maintain security.
* Know how to change the file creation mask.
* Use the group field to grant file access to group members.
The following is a partial list of the used files, terms and utilities:
* chmod
* umask
* chown
* chgrp

## Changing file owner and group

To change the owner of a file or directory, use chown.
To change the group of a file or directory, use chgrp.
The programs gpasswd and yast2 allow you to administrate groups.
gpasswd [-A user,...] [-M user,...] group
    -A: Add users with group administrator privileges.
    -M: Add members in group.
Group administrators can add or delete members of the group
Group administrators can set or remove the password for the group.

## More privileges

It is possible to give more privileges to an user when it executes a particular script or program by setting the uid or gid bit of the file.
If the bit is set, the process will inherit the permissions of the owner of the file not the permissions of the user. To set the effective uid or gid, use chmod.
Example of such program is /bin/passwd.
The sticky bit can also be set and can make the program text segment resident in RAM. chmod 1640 [file] (1) The file program stays in RAM.

## File and Directory Permissions

The permission of a file or of a directory can be viewed with ls -l.
Examples of file permissions:
This means read,write, and execution permissions for user toto, read and write permissions for members of group users. No permissions for others. (0760)
This means read and write permissions for user root, read permissions for members of group root and all others. (0644)
Examples of directory permissions:
This means read,write, and execution permissions for user root, read and execution permissions for members of group root and others. (0755)
This means read, write, and execution permissions for user toto, read and execution permissions for members of group users and others. (0755)

## Default permissions

The default permissions when creating a file are 0666 and when creating a directory are 0777. Most of the systems overwrite this at boot time with the program umask. Generally the mask value is 022. It means the write for group and other will be blocked. To check or change the mask value, do:
Examples for file:
Examples for directory:

### Calculating umasks

Finding the correct umask is not all that easy of a process, but certainly doable. The final permission of a file is the result of a logical AND operation between the negation of the umask and the default permission. (The same applies to directories)
In order to visualize this, we translate the octal default permissions into binary form first:
Then we take the umask. This time we'll use 0027 for our umaks and translate that into binary. Then invert (~) it.
Now, to get the actual permission for a file, we logically AND it with the default permissions and translate back into octal:
And the same for directories:

## Changing file permissions

To change permissions on a file or directory, use chmod. To overwrite the existing permissions, do:
To change add or cancel some permissions without overwriting all the existing permissions, do:
To change in recursive mode, use the -R option.

## Exercises

* Exercises results
1) Write the command line by using letters with chmod to set the following permissions:
2) Write the command line by using octal numbers with chmod to set the following permissions:
3) With the following umask values what would be the files and directories creation permissions?
4) Create two user accounts
Logging in id: tst1, group users, with bash shell, home directory /home/tst1
Logging in id: tst2, group public, with bash shell, home directory /home/tst2
For the two accounts set a password.
Logging in as tst1 and copy /bin/ls into tst1 home directory as myls. Change the owner of myls to tst1 and the permissions to 0710. What does this permission value mean?
Logging in as tst2 and try to use /home/tst1/myls to list your current directory. Does it work ?
Create in /etc/group and /etc/gshadow a new group labo with tst1 and tst2. Change the owner group of myls to labo.
Try again from tst2 account to execute /home/tst1/myls to list your current directory. Does it work?
Exercises results