Ubuntu – Understanding Group Permissions

permissions

I'd appreciate help with a couple questions regarding standard file permissions. Assume that I'm not using access control lists.

If a file is associated with multiple groups, must all groups have the same permissions?
If the group permission includes write access, can any member of any group the file is associated with change the file permissions? Can such a person change the file owner?
Say now the file permission is rwxr—– (owner can do everything, but group members can only read). I am in the group associated with the file. I am also the file owner. Which permission am I granted? Read-only, or rwx?

Best Answer

A file can only have one group

Only the owner of the file can do that.

$ sudo touch ~/tmp/test
$ sudo chown root:aboettger ~/tmp/test
$ ls -la ~/tmp/test
-rw-rw-r-- 1 root aboettger 853 Jun 19 08:26 /home/aboettger/tmp/test
$ chmod g-w ~/tmp/test 
chmod: changing permissions of 'test': Operation not permitted

You have rwx access rights

And you should read this. ;)

Related Solutions

Ubuntu – Do octal permissions start with 40

They are the file type. 10 is a fifo, and 40 is a directory. From man 2 stat:

   The following flags are defined for the st_mode field:

       S_IFMT     0170000   bit mask for the file type bit fields
       S_IFSOCK   0140000   socket
       S_IFLNK    0120000   symbolic link
       S_IFREG    0100000   regular file
       S_IFBLK    0060000   block device
       S_IFDIR    0040000   directory
       S_IFCHR    0020000   character device
       S_IFIFO    0010000   FIFO
       S_ISUID    0004000   set-user-ID bit
       S_ISGID    0002000   set-group-ID bit (see below)
       S_ISVTX    0001000   sticky bit (see below)
       S_IRWXU    00700     mask for file owner permissions
       S_IRUSR    00400     owner has read permission
       S_IWUSR    00200     owner has write permission
       S_IXUSR    00100     owner has execute permission
       S_IRWXG    00070     mask for group permissions
       S_IRGRP    00040     group has read permission
       S_IWGRP    00020     group has write permission
       S_IXGRP    00010     group has execute permission
       S_IRWXO    00007     mask for permissions for others (not in group)
       S_IROTH    00004     others have read permission
       S_IWOTH    00002     others have write permission
       S_IXOTH    00001     others have execute permission

Ubuntu – Unix permissions – what EXACTLY is the “owner group” (note: singular)

A user may be a member of multiple groups.
A file is be owned by exactly one group and one user.
If the user is a member of the file's owner group (i.e., group foo owns the file and one of the user's groups is foo), then the respective group permissions apply to that user (unless overridden by the owner permissions).

The owner group is part of the file's ownership. Consider:

$ stat /usr/bin/crontab 
  File: ‘/usr/bin/crontab’
  Size: 35984       Blocks: 72         IO Block: 4096   regular file
Device: 803h/2051d  Inode: 131439      Links: 1
Access: (2755/-rwxr-sr-x)  Uid: (    0/    root)   Gid: (  103/ crontab)
Access: 2015-02-05 20:20:43.438507538 +0530
Modify: 2013-02-09 12:32:23.000000000 +0530
Change: 2014-09-30 19:22:09.508515013 +0530
 Birth: -

This states that the file's ownership is with user root and group crontab.

Say I'm member of group A, group B, and group C. Now I create a file somewhere. ... [To] which group get's the owner_group permissions applied ?

That depends on what your primary group is at the time you created that file. The primary group is the first one listed when you run the groups command. Usually, this is determined by your GID. However, you can temporarily set one of your other groups as primary using the newgrp command. For example:

$ groups 
muru adm cdrom sudo dip plugdev lpadmin sambashare
$ rm foo; touch foo
$ stat -c %G foo  # this prints the owner group of the file
muru
$ newgrp sudo   
$ rm foo; touch foo
$ stat -c %G foo
sudo

I have the distinct feeling I don't really understand something here, or that I misunderstand the meaning of the term "owner group".

That the owner group is an attribute of the file, not the user.

I understand the string (after the first char) is partitioned into groups of 3 (rwx) for
owner
owner_group
all/world/anyone

Slightly off: the third field is others, not all. Others covers everyone except the owner of the file and members of the owner group of the file. The distinction comes into play when using symbolic modes with chmod:

chmod a-x takes away everyone's execute permissions
chmod o-x takes away everyone else's execute permission, while leaving the owner and owner group's execute permission untouched.

Lastly, a note on user private groups. UPGs are fairly common on desktop systems, but do not take them for granted elsewhere. If UPGs are enabled, it is likely that the user's primary group and username have the same numeric id and name, and there is a unique group for each user. That is all.

Best Answer

Related Solutions

Ubuntu – Do octal permissions start with 40

Ubuntu – Unix permissions – what EXACTLY is the “owner group” (note: singular)

Related Question