DevOps Tutorial · Linux and the Shell · Lesson 5 of 25
Users and Permissions
Read and change Linux file permissions, understand users and groups, and why containers shouldn't run as root.
Reading permissions
ls -l shows permissions as ten characters, for example -rwxr-x---:
- The first character is the type (
-file,ddirectory,llink). - Then three groups of
rwxfor the owner, the group and others: read, write, execute.
Permissions are also written as numbers: r = 4, w = 2, x = 1, added per group. 750 is rwxr-x---.
touch script.sh secret.env notes.txt
chmod 755 script.sh
chmod 600 secret.env
chmod 644 notes.txt
stat -c '%A %a %n' script.sh secret.env notes.txt
Output
-rwxr-xr-x 755 script.sh -rw------- 600 secret.env -rw-r--r-- 644 notes.txt
Run this on your computer — see “Get Started” for setup.
Changing ownership and permissions
chmod 640 app.conf # owner rw, group r, others nothing
chmod +x deploy.sh # make a script executable
sudo chown app:app /srv/app # change owner and group
Least privilege
- Secrets files should be readable only by the service's user (
600or640). - Don't run services as root. In containers, add a
USERinstruction to the Dockerfile so a compromised app can't take over the container (and is less dangerous if it escapes). sudoruns one command as root and is logged; avoid working in a root shell.
printf '#!/bin/bash\necho "deploying..."\n' > deploy.sh
./deploy.sh 2>&1 || echo "exit code $? (not executable yet)"
chmod +x deploy.sh
./deploy.sh
Output
script.sh: line 2: ./deploy.sh: Permission denied exit code 126 (not executable yet) deploying...
Run this on your computer — see “Get Started” for setup.
Test yourself
What does chmod 640 give?
Owner read/write, group read, others nothingEveryone read/writeOwner execute onlyGroup write, others read
Show answer
Answer: Owner read/write, group read, others nothing
6 = r+w for the owner, 4 = r for the group, 0 = nothing for others.