File Permissions Basics and ACL - Revision history

Jrwrigh: /* "Mode" Parameter */ Syntax fix

2022-10-24T14:37:54Z

‎"Mode" Parameter: Syntax fix

Jrwrigh: Correct how umask is used

2022-06-17T21:49:34Z

Correct how umask is used

Jrwrigh at 15:34, 5 September 2020

2020-09-05T15:34:31Z

Jrwrigh at 03:46, 7 July 2020

2020-07-07T03:46:46Z

Jrwrigh: /* Permissions as Octal Numbers */

2020-07-07T03:45:28Z

‎Permissions as Octal Numbers

Jrwrigh at 02:29, 7 July 2020

2020-07-07T02:29:40Z

Jrwrigh at 02:20, 7 July 2020

2020-07-07T02:20:38Z

Jrwrigh at 17:59, 6 July 2020

2020-07-06T17:59:41Z

Jrwrigh at 02:02, 5 July 2020

2020-07-05T02:02:46Z

Jrwrigh at 01:17, 5 July 2020

2020-07-05T01:17:11Z

@@ Line 178: / Line 178: @@
 ==== "Mode" Parameter ====
-When a new file is created, the <code>syscall</code> <code>open()</code> (among others) is used and a file mode parameter must be chosen by that program. For example, `touch` will automatically apply the mode <code>666</code> to the file, which will make the file owner, file group, and "others" all have <code>rw-</code> permissions.
+When a new file is created, the <code>syscall</code> <code>open()</code> (among others) is used and a file mode parameter must be chosen by that program. For example, <code>touch</code> will automatically apply the mode <code>666</code> to the file, which will make the file owner, file group, and "others" all have <code>rw-</code> permissions.
 ==== ACL Defaults ====

@@ Line 174: / Line 174: @@
 ==== umask ====
-<code>umask</code> is a function that contains file permission settings for any file created by a user and it is unique to the user. The user can change it at anytime using the <code>umask</code> command. To see what it is set to, simply run <code>umask</code> with no arguments.
+<code>umask</code> is a function that contains file permission settings for any file created by a user and it is unique to the user. The user can change it at anytime using the <code>umask</code> command. To see what it is set to, simply run <code>umask</code> with no arguments. The output is usually in octal notation, and represents the bits that will be ''blocked'', not the bits that will be set. So an output of <code>022</code> will allow any user permission bits to be set, but will not allow for the executable bit to be set for user and group settings.
 ==== "Mode" Parameter ====
@@ Line 197: / Line 197: @@
 * If the parent directory '''does not have default ACL rules''', only <code>umask</code> and "mode" parameter are used:
-** The new file/subdirectory's <code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> are set based on the permissions set by <code>umask</code>
+** The new file/subdirectory's <code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> are set based on the permissions set by <code>umask</code> via a bit wise NAND
 ** The new file/subdirectory's are then adjusted to limit permissions to be no looser than the "mode" parameter
 Note that this all means that if you have a default ACL rule that gives execute permissions to a group, the group will ''not'' have execute permissions by default ''unless'' the "mode" parameter also has execute permissions. Most compilers will use the execute permission bit for the "mode" parameter of it's executable, but other files will not.

@@ Line 1: / Line 1: @@
-This is an overview of how file permissions and Access-control Lists (ACL) work on POSIX-based file systems. This forms a primer to understanding how exactly the actions in [[Setting Default File Permissions]] work and how to debug them.
+'''Access-control Lists (ACL)''' are how POSIX-based file systems control '''file permissions'''. This article forms a primer to understanding how exactly the actions in [[Setting Default File Permissions]] work and how to debug them.
 In short, ACL helps to control which users can read, write, or execute certain file objects, which are defined as anything in the file system (regular files, directories, symlinks, etc.). Note that ACL does ''not'' have complete authority on ''creating'' permissions for new file objects.
 In analogy, ACL is akin to the guest list at a club. Continuing the analogy, the OS kernel is the bouncer of the club, determining who can get in to which section of the club based on the ACL.

@@ Line 159: / Line 159: @@
 |}
-Using <code>test2file</code> as the example permissions block, it is stored as <code>110 101 000</code>. When translated into decimal, that equals <code>3 5 0</code>.
+Using <code>test2file</code> as the example permissions block(<code>rw-r-x---</code>), it is stored as <code>110 101 000</code>. When translated into decimal, that equals <code>3 5 0</code>.
 Another way to think about it is that the octal number equivalent of a permission set = 1*x + 2*w + 4*r, where r, w, and x equal 1 or 0 depending on whether they're set or not.

@@ Line 105: / Line 105: @@
 |-
 ! style="text-align:left;" | Permissions
-! Read bit
+! Execute bit
 ! Write Bit
-! Execute Bit
+! Read Bit
 ! Octal Number equivalent
 |-
@@ Line 116: / Line 116: @@
 | 0
 |-
-| style="text-align:left;" | <code>r--</code>
+| style="text-align:left;" | <code>--x</code>
 | 1
 | 0
@@ Line 128: / Line 128: @@
 | 2
 |-
-| style="text-align:left;" | <code>rw-</code>
+| style="text-align:left;" | <code>-wx</code>
 | 1
 | 1
@@ Line 134: / Line 134: @@
 | 3
 |-
-| style="text-align:left;" | <code>--x</code>
+| style="text-align:left;" | <code>r--</code>
 | 0
 | 0
@@ Line 146: / Line 146: @@
 | 5
 |-
-| style="text-align:left;" | <code>-wx</code>
+| style="text-align:left;" | <code>rw-</code>
 | 0
 | 1
@@ Line 161: / Line 161: @@
 Using <code>test2file</code> as the example permissions block, it is stored as <code>110 101 000</code>. When translated into decimal, that equals <code>3 5 0</code>.
-Another way to think about it is that the octal number equivalent of a permission set = 1*r + 2*w + 4*x, where r, w, and x equal 1 or 0 depending on whether they're set or not.
+Another way to think about it is that the octal number equivalent of a permission set = 1*x + 2*w + 4*r, where r, w, and x equal 1 or 0 depending on whether they're set or not.
 == Custom Permissions ==

@@ Line 31: / Line 31: @@
   ACL_OTHER       The ACL_OTHER entry denotes access rights for processes that do not match any other entry in the ACL.
-**<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> correspond to the standard three user categories: file owner, file group, and "other". These three categories are the ones listed by <code>ls -l</code>.
+:*<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> correspond to the standard three user categories: file owner, file group, and "other". These three categories are the ones listed by <code>ls -l</code>.
-***The file owner and file group are set to the user that originally created the file and their respective user group (though this can be changed using <code>chown</code>).
+:**The file owner and file group are set to the user that originally created the file and their respective user group (though this can be changed using <code>chown</code>).
-**"Others" simply refers to all other users that are not the file owner and are not members of the file group.
+:*"Others" simply refers to all other users that are not the file owner and are not members of the file group.
-**The other three tags, <code>ACL_MASK</code>, <code>ACL_GROUP</code>, and <code>ACL_USER</code>, are only used for [[File_Permissions_Basics_and_ACL#Custom Permissions|custom ACL entries]] that are set by a user.
+:*The other three tags, <code>ACL_MASK</code>, <code>ACL_GROUP</code>, and <code>ACL_USER</code>, are only used for [[File_Permissions_Basics_and_ACL#Custom Permissions|custom ACL entries]] that are set by a user.
-*** Additionally, <code>ACL_MASK</code> is only required if <code>ACL_GROUP</code> or <code>ACL_USER</code> entries are utilized.
+:** Additionally, <code>ACL_MASK</code> is only required if <code>ACL_GROUP</code> or <code>ACL_USER</code> entries are utilized.
 * The file permissions for <code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> together form the file <code>mode</code> parameter
 ** This parameter is used by programs to set the permissions of files they create. This is discussed further in [[File_Permissions_Basics_and_ACL#Custom Permissions|the Custom Permissions section]].
-==== Viewing them ====
+==== Viewing Them ====
 ===== Using ls =====
@@ Line 98: / Line 98: @@
   default:other::---
-==== Octal numbers ====
+=== Permissions as Octal Numbers ===
 The file <code>mode</code> is often conveyed in the form of three octal numbers (ie. base 8 numbers). It is very similar to how PHASTA handles specifying boundary conditions using bitwise logic.
 The first bit handles read, the second bit handles write, and the third handles execute.

@@ Line 2: / Line 2: @@
 In short, ACL helps to control which users can read, write, or execute certain file objects, which are defined as anything in the file system (regular files, directories, symlinks, etc.). Note that ACL does ''not'' have complete authority on ''creating'' permissions for new file objects.
 == Basics of Unix/POSIX File Permissions ==
@@ Line 27: / Line 31: @@
   ACL_OTHER       The ACL_OTHER entry denotes access rights for processes that do not match any other entry in the ACL.
-<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> correspond to the standard three user categories: file owner, file group, and "other". These three categories are the ones listed by <code>ls -l</code>.
+**<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> correspond to the standard three user categories: file owner, file group, and "other". These three categories are the ones listed by <code>ls -l</code>.
+***The file owner and file group are set to the user that originally created the file and their respective user group (though this can be changed using <code>chown</code>).
-The file owner and file group are set to the user that originally created the file and their respective user group (though this can be changed using <code>chown</code>).
+**"Others" simply refers to all other users that are not the file owner and are not members of the file group.
-"Others" simply refers to all other users that are not the file owner and are not members of the file group.
+**The other three tags, <code>ACL_MASK</code>, <code>ACL_GROUP</code>, and <code>ACL_USER</code>, are only used for [[File_Permissions_Basics_and_ACL#Custom Permissions|custom ACL entries]] that are set by a user.
+*** Additionally, <code>ACL_MASK</code> is only required if <code>ACL_GROUP</code> or <code>ACL_USER</code> entries are utilized.
 * The file permissions for <code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code> together form the file <code>mode</code> parameter
@@ Line 76: / Line 79: @@
 This argument will show all permissions for a file object, including custom ones. <code>user::</code>, <code>group::</code>, and <code>other::</code> refer to the permissions set for the <code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code>.
-To be more specific, a group or user can be inserted between the colons. This can be seen in the line <code>group:a1983:</code> where the members of the group have <code>r-x</code> permissions to the file. These permissions fall under the <code>ACL_USER</code> and <code>ACL_GROUP</code> tags.
+To set more specific permissions, a group or user can be inserted between the colons. This can be seen in the line <code>group:a1983:</code> where the members of the group have <code>r-x</code> permissions to the file. These permissions fall under the <code>ACL_USER</code> and <code>ACL_GROUP</code> tags.
-If default ACL entries are used, they will also be displayed here:
+If default ACL entries are used, they will also be displayed using <code>getfacl</code>. An example is presented below for the directory <code>test</code> (note that default ACL entries can ''only'' be applied to directories):
   $ getfacl test
@@ Line 94: / Line 97: @@
   default:mask::r-x
   default:other::---
 ==== Octal numbers ====
@@ Line 164: / Line 166: @@
 The other two tags, <code>ACL_GROUP</code> and <code>ACL_USER</code>, are for more custom permissions and are not set by default on a blank system.
-The <code>ACL_MASK</code> entry plays an important role in [[Setting_Default_File_Permissions#How are file permissions set?|how new file permissions are set]].
+Different sets of permissions can be set on a per user and per group basis.
-Note that the <code>ACL_MASK</code> is only used when <code>ACL_GROUP</code> or <code>ACL_USER</code> are used for ACL entries.
+For more information on complex interactions (ie. if a user has permissions set and is a member of a group that has its own custom permissions), I recommend seeing the ACL manpage section on the [https://linux.die.net/man/5/acl Access Check Algorithm]
 === What determines the permissions for a new file? ===
-There are three sources that determine what file permissions will be set; <code>umask</code>, the "mode" parameter used by the program creating the file, and ACL.
+When a new file object is created, a new set of ACL entries must be created for that file object. There are three sources that determine what ACL entries will be set; <code>umask</code>, the "mode" parameter used by the program creating the file, and ACL entries of the parent directory of the file object being created.
 ==== umask ====
@@ Line 177: / Line 179: @@
 ==== "Mode" Parameter ====
-When a new file is created, the <code>syscall</code> <code>open()</code> (among others) is used and a file mode parameter must be chosen by that program. For example, `touch` will automatically apply the mode <code>666</code> to the file, which will make the file owner, file group, and "others" all have <code>rw-</code> permissions
+When a new file is created, the <code>syscall</code> <code>open()</code> (among others) is used and a file mode parameter must be chosen by that program. For example, `touch` will automatically apply the mode <code>666</code> to the file, which will make the file owner, file group, and "others" all have <code>rw-</code> permissions.
 ==== ACL Defaults ====
-ACL can have default permissions set. This default entry is set for a directory and is used for files and subdirectories created inside that directory.
+ACL default entries are set for a directory and are used for files and subdirectories created inside that directory. Note that ACL default entries can ''only'' be set for directories.
 === How are new file permissions set? ===
-The manpage for ACL is a great resource to answering this question. Most of the information below is simply paraphrasing what is written in the "Object Creation and Default ACLs" section.
+This is simply a paraphrasing/rewording of the "Object Creation and Default ACLs" section of the [https://linux.die.net/man/5/acl ACL manpage].
 When creating a file/subdirectory in a parent directory:
-* If the parent directory '''does have default ACL rules''', only the ACL default rules and "mode" parameter are used:
+* If the parent directory '''does have default ACL rules''', only the ACL default entries of the parent directory and "mode" parameter are used:
-** The new file/subdirectory first inherits the default ACL rules of its parent directory
+** The new file/subdirectory first inherits the ACL default entries of its parent directory as its normal ACL entries
 ** The new file/subdirectory has its ACL entries adjusted such that no permissions exceed the "mode" parameter.
 *** The <code>ACL_USER_OBJ</code> and <code>ACL_OTHER</code> are changed directly
@@ Line 199: / Line 201: @@
 ** The new file/subdirectory's are then adjusted to limit permissions to be no looser than the "mode" parameter
-Note that this all means that if you have a default ACL rule that gives execute permissions to a group, the group will not have execute permissions by default ''unless'' the "mode" parameter also has execute permissions. Most compilers will use the execute permission bit for the "mode" parameter of it's executable, but other files will not.
+Note that this all means that if you have a default ACL rule that gives execute permissions to a group, the group will ''not'' have execute permissions by default ''unless'' the "mode" parameter also has execute permissions. Most compilers will use the execute permission bit for the "mode" parameter of it's executable, but other files will not.

@@ Line 38: / Line 38: @@
 ==== Viewing them ====
 The simplest and most common way of viewing the basic permissions of a file is by using <code>ls</code>. As an example, if you run <code>ls -l</code> on a directory, you might see:
@@ Line 45: / Line 47: @@
-The first block (<code>-rw-r-x---+</code>) shows the permissions of the file for the three primary ACL tags (<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code>). (described below). The file owner is shown as <code>jrwrigh7</code> and the file group is <code>a1983</code>. These correspond to <code>ACL_USER_OBJ</code> and <code>ACL_GROUP_OBJ</code>
+The first block (<code>-rw-r-x---+</code>) shows the permissions of the file for the three primary ACL tags (<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code>). (described below). The file owner is shown as <code>jrwrigh7</code> and the file group is <code>a1983</code>. These correspond to <code>ACL_USER_OBJ</code> and <code>ACL_GROUP_OBJ</code>.
 '''Permissions Block:'''
@@ Line 57: / Line 59: @@
 See [https://www.gnu.org/software/coreutils/manual/html_node/What-information-is-listed.html#What-information-is-listed the ls coreutils manual] for more information on the 'long' format for <code>ls</code>.
 ==== Octal numbers ====
@@ Line 143: / Line 181: @@
 ==== ACL Defaults ====
-The Access-control List (ACL) has the ability to set more nuanced permissions for files (ie. permissions for specific users or groups that are not file owner or file group). They can be set for a specific file/directory, or as a ''default'' setting. This default setting is set for a directory and is used for files and subdirectories created inside that directory.
+ACL can have default permissions set. This default entry is set for a directory and is used for files and subdirectories created inside that directory.
 === How are new file permissions set? ===

@@ Line 38: / Line 38: @@
 ==== Viewing them ====
-As an example, if you run <code>ls -l</code> on a directory, you might see:
+The simplest and most common way of viewing the basic permissions of a file is by using <code>ls</code>. As an example, if you run <code>ls -l</code> on a directory, you might see:
   drwxr-x---+ 2 jrwrigh7 a1983 4.0K 2020-07-04 08:09 test2
@@ Line 45: / Line 45: @@
-The first block (<code>-rw-r-x---+</code>) shows the permissions for the file (described below). The user owner is shown as <code>jrwrigh7</code> and the group owner is <code>a1983</code>.
+The first block (<code>-rw-r-x---+</code>) shows the permissions of the file for the three primary ACL tags (<code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code>). (described below). The file owner is shown as <code>jrwrigh7</code> and the file group is <code>a1983</code>. These correspond to <code>ACL_USER_OBJ</code> and <code>ACL_GROUP_OBJ</code>
 '''Permissions Block:'''
 * First character displays what kind of file it is, be it a link (<code>l</code>), directory (<code>d</code>), regular file (<code>-</code>), etc.
-* The next 9 characters show the permissions for the file owner, file group, and "others".
+* The next 9 characters show the permissions for the <code>ACL_USER_OBJ</code>, <code>ACL_GROUP_OBJ</code>, and <code>ACL_OTHER</code>
 ** So for <code>test2file</code> in the above output:
 *** File Owner: <code>rw-</code>