Managing file permissions in Linux

In this section I will be using the command line in Linux to change file permissions.

Scenario:

You are a security professional at a large organization. You mainly work with their research team. Part of your job is to ensure users on this team are authorized with the appropriate permissions. This helps keep the system secure.

Your task is to examine existing permissions on the file system. You’ll need to determine if the permissions match the authorization that should be given. If they do not match, you’ll need to modify the permissions to authorize the appropriate users and remove any unauthorized access.

Current file permissions

This document displays the file structure of the /home/researcher2/projects directory and the permissions of the files and subdirectory it contains.

In the /home/researcher2/projects directory, there are five files with the following names and permissions:

project_k.txt
- User = read, write,
- Group = read, write
- Other = read, write
project_m.txt
- User = read, write
- Group = read
- Other = none
project_r.txt
- User= read, write
- Group = read, write
- Other = read
project_t.txt
- User = read, write
- Group = read, write
- Other = read
.project_x.txt
- User = read, write
- Group = write
- Other = none

There is also one sub directory inside the projects directory named drafts. The permissions on drafts are:

User = read, write, execute
Group = execute
Other = none

Check file and directory details

The first line displays the working directory I was in. I needed to be in the projects directory so I used cd in the next line to move the terminal to that directory. I then used pwd again to make sure that I was in the projects directory on the next line. I then told the terminal to list all contents of the projects directory. I used the ls command with the -la option to display a detailed listing of the file contents that also returned hidden files. The output from my command shows one directory named drafts, one hidden finale named .projects_x.txt and five other projects. The 10 character string in the first column represents the permissions set for each file and directory.

Describing the file string

The 10-character string can be broken down to determine who is authorized to access the file and their specific permissions. The characters and what they represent are as follows:

1st character: the first character is either a d or a hyphen(-) and indicates the file type. The d means it is a directory but if it is a hyphen(-) it is just a regular file.
2nd-4th characters: these characters can be read(r), write(w) or execute(x). These characters are for the permissions of the user. If one of the characters is a hyphen(-) it indicates that this permission is not granted for the user.
5th-7th characters: these characters can be read(r), write(w) or execute(x). These characters are for the permissions of the group. If one of the characters is a hyphen(-) it indicates that this permission is not granted for the group.
8th-10th characters: these characters can be read(r), write(w) or execute(x). These characters are for the permissions of all others on the system apart from the user or group. If one of the characters is a hyphen(-) it indicates that this permission is not granted for others.

For example, The file permissions for project_m_.txt are -rw-r—--. Since the first character is a hyphen(-) it indicates that it is a file and not a directory. The second and fifth characters are both r which indicates that user and group all have read permissions. The third character is a w, which indicates that only the user has write permissions. No one has executed permissions for this file.

Changing file permissions

The organization does not allow others to have write access to any files. I am going to change the permissions of the files so that they align with the organization's stance. The following code demonstrates how I used linux commands to achieve this

The first two lines of this screenshot display the commands I entered and the other lines are the terminal's output. I used the chmod command to change the permission of project_k.txt so that others do not have write permissions. The first argument of chmod shows what permission should be changed (o-w) and the second argument specifies the file or directory. After using chmod I used ls -la to review the updates I had made in the system.

Change file permissions on a hidden file

The research team has archived .project_x.txt which is why it is a hidden file. This file should not have write permission for anyone but the user and group should be able to read the file. The following code demonstrates how I used Linux commands to change the permissions:

The first two lines of the screenshot display the commands I entered and the other lines display the output of the second command given to the terminal. What confirms that .project_x.txt is a hidden file is the fact it has a period(.) at the beginning. In this example I removed write permissions from the user and the group while simultaneously added read permissions to the group. I used u-w and g-w to remove the write permissions and used g+r t to give the group read permissions.

Change directory permissions

My organization only wants the researcher2 user to have access to the drafts directory and its contents. This means that no one other than researcher2 should have execute permissions. The following code demonstrates how I used Linux commands to change the permissions:

The output in the terminal here displays the permission listing for several directories and files. Line 4 is the directory (drafts) that we changed permissions for. You can see that only researcher2 has execute permissions. It was previously demonstrated that the group had execute permissions, so I used the chmod command to remove them. The researcher2 user already had execute permissions so they did not need to be added.

Summary

I was able to change multiple permissions to match the level of authorization that my organization was looking for in the projects directory. The first step was to use ls -la to check the permissions already given for the directory. This gave me the information I needed for what to change. I used the chmod command multiple times to change permissions on files and directories that included both adding and removing permissions per my organization request.

*All screenshots were taken from google Qwiklabs page during the completion of labs*

Page updated

Google Sites

Report abuse