Owners, Groups, and the Three Classes
Each file has one owner. The owner is usually the user who created the file. That user can change the file’s permissions. On Linux systems the owner also belongs to one primary group, and the file itself is assigned to exactly one group. Group membership lets an owner give the same rights to several people without listing each name. Everyone else falls into the third class, often called other or world. Permissions are checked in order: first the owner class, then the group class, then other. The first matching class determines the effective rights.
Windows uses a similar idea but stores permissions in access control lists attached to each file. The owner can still modify those lists. Both systems make the owner the starting point for control.
- Owner class applies to the single user who owns the file.
- Group class applies to members of the file’s assigned group.
- Other class applies to any remaining users on the system.
Read, Write, and Execute Rights
Read permission lets a user view the contents of a file. For a directory it lets the user list the names of files inside. Write permission lets a user change or delete a file. For a directory it lets the user add, remove, or rename entries, but only when execute permission is also present. Execute permission lets a user run a file as a program or script. For a directory it lets the user enter the directory and access the metadata of files inside it.
These three rights combine in different ways. A common setting for programs is read and execute for everyone, with write limited to the owner. Data files often allow read for everyone and write only for the owner. Giving write without read is rare because changing a file you cannot read is usually impractical.
- Read (r): view file contents or list directory names.
- Write (w): modify or delete a file; add, delete, or rename directory entries.
- Execute (x): run a file or traverse a directory to reach its contents.
Applying Least Privilege in Practice
Least privilege means giving each account the smallest set of rights required for its job. On a shared system this often means the owner keeps full rights, the group receives read and execute, and other receives nothing or only read. When a file must be edited by multiple people, place those people in a dedicated group and grant that group write access. Avoid granting write to other unless the file truly needs to be changed by any user.
Directories that hold temporary files, such as /tmp on Linux, use a special sticky bit. The bit lets users create files but prevents them from deleting files they do not own. This is one example of extending the basic model to meet a specific security need without giving broad rights.
- Create a group for each distinct team or role that needs shared access.
- Grant write only to the owner or to the specific group that must edit the file.
- Use the sticky bit on shared directories to protect files from deletion by other users.
Viewing and Changing Permissions
On Linux the ls -l command shows the current permissions in a compact string. The first character indicates file type, followed by three triads for owner, group, and other. The chmod command changes permissions using either symbolic notation such as u+r or numeric notation such as 644. The chown command changes ownership, but only the root account can transfer ownership to another user. On Windows the Properties dialog or icacls command displays and edits the access control list.
Always verify changes after you make them. A single extra write bit can let an attacker modify a configuration file or script. Test the new settings with a non-owner account to confirm the intended restrictions are in place.
- Use ls -l to inspect permissions on Linux.
- Use chmod and chown to adjust rights and ownership.
- Re-check settings from a different account after every change.
Limitations and Cautions
Permissions only protect against users who respect the operating system’s rules. A user with physical access or root privileges can bypass them. Permissions also do not encrypt data; anyone who can read the raw storage can still examine the bytes. Finally, moving a file to a different directory or filesystem can reset its permissions to the defaults of the new location.
Review permissions whenever you add new users or change group membership. Old broad settings left behind after a project ends are a common source of unintended access.