The first ten characters of an ls -l line are the file's type and its permissions. You read them in pieces: one character and three triples.
The first character is the type: - for a regular file, d for a directory. The other nine are the permissions, three triples in a row: for the file's owner, for the file's group, and for others — everyone who is neither the owner nor a member of that group.
In each triple every letter has its own place: r is read, w is change, x is run. A forbidden action shows - in its place. Here is the report's line from the start of the lesson:
| Characters | For whom | What is allowed |
|---|---|---|
- |
type | regular file |
--- |
owner, student | nothing |
--- |
group, student | nothing |
r-- |
others | read |
ls -l prints the owner and the group further along the same line. Look at the permissions, owner, and group of two system files yourself:
/etc/passwd, the list of accounts, is readable by everyone: -rw-r--r--. /etc/shadow holds the passwords: the line is -rw-r-----, owner root, group shadow.
A + after the permission string (-rw-r-----+) means the file also has an ACL, extra access rules. getfacl shows them.
What may members of the shadow group do?
-rw-r----- 1 root shadow 888 Sep 27 06:16 /etc/shadow-
---is the third triple, for others. The shadow group has the second one,r--. -
rw-is the first triple, and it belongs to the owner root. The group has the second triple,r--. -
There is no
xin any triple of the line:/etc/shadowis not a program.
The second triple r-- holds the shadow group's rights: its members read the file. The owner root may change it, and others may do nothing.
Key points
- The permission string is the file type plus three triples: for the owner, for the group, and for others.
-
In a triple
ris read,wis change,xis run; a-in a letter's place means no.