Each file has a set of permission codes (known as the file mode). The directory list ls -l shows these codes. e.g.:
drwxr-x--x 2 retallick itstaff 76 Jun 3 1997 bin drwx------ 3 retallick itstaff 4096 Jun 7 1999 bitpen -rw-r--r-- 1 retallick itstaff 53489 May 27 1998 brian.gif drwxr-x--x 3 retallick sys 27 May 29 1997 dumpster -rw-r--r-- 1 retallick itstaff 570786 May 24 1999 gocats.wav drwxr-xr-x 5 retallick itstaff 48 Jul 28 1996 mygdc
The left 10 characters tell us the permissions of the files:
Note: directory, command and executable files must have executable permission for the user.
change mode. Changes the file mode (permissions) on a file or files.
The permissions of any file can be changed by the chmod command (this is pronounced as ch-mod where where ch is sounded as in change and mod as in model).
Only the owner of a file (or the super-user) can alter a file's permissions. Syntax is:
chmod [-R] [ugoa][+-=][rwx] filenames
Where:
Note: "-" is not used to indicate an option (flag/switch). "+" is used to add permissions, "-" is used to remove permissions and "=" is used to set the permissions to that specified.
-R Recursive. Changes the mode on the files specified including subdirectories.
chmod u+rw afile (Add read and write permissions for the user (owner) to the file afile)
chmod go-rwx * (Takes all access away from group and others for every file in the current directory)
chmod a-w /usr/local/pub/*.gif (Takes write access away from all users for every file with a .gif extension in the /usr/local/pub directory)
chmod -R o=rx * (Anyone (others) can now read and execute but not write to files in the current directory and its subdirectories)
chmod can be used with numeric permission rather than strings.
The values are summed to form a permission digit e.g. read + write permission = 4 (for read, 100 in binary) + 2 (for write, 010 in binary) = 6 (110 in binary). Three digits are used to make up a permission; the first for user, the second for group and the third for other.
| Permission | String | Decimal Number | Binary Number |
|---|---|---|---|
| none | -- | 0 | 000 |
| execute | --x | 1 | 001 |
| write | -w- | 2 | 010 |
| execute and write | -wx | 3 | 011 |
| read | r-- | 4 | 100 |
| read and execute | r-x | 5 | 101 |
| read and write | rw- | 6 | 110 |
| read, write and execute | rwx | 7 | 111 |
chmod 700 afile (Equivalent to to u+rwx, g-rwx, o-rwx)
chmod 640 afile (Equivalent to to u+rw, u-x, g+r, g-wx, o-rwx)
chmod 777 afile (Equivalent to to u+rwx, g+rwx, o+rwx)
Common combinations of permissions for files (see below for directories)
| Permission String | Permission (Numeric) | Meaning |
|---|---|---|
| --- | 0 | No access |
| r-- | 4 | Read only access. Files can be read. Files cannot be changed, created or executed |
| r-x | 5 | Read and execute access. Files can be read and executed. This is the minimum required for programs and script files. |
| rw- | 6 | Read and write access. Files can be read and changed or created. Programs or script files cannot be executed. |
| rwx | 7 | All access |
Directories have different properties to normal files. The table below summaries the key permission settings for directories
| Permission String | Permission (Numeric) | Meaning |
|---|---|---|
| --- | 0 | No access |
| r-x | 5 | Read and execute access. The directory can be read and the files in the directory
accessed. read permission is necessary for a directory to be read (e.g. ls directory-name will list the names of files in the directory); execute permission is necessary to access the file contents (e.g. less directory-name/file-name will display the contents of the file). |
| rwx | 7 | All access. Allows files to be accessed, created, modified, renamed etc. Be wary of providing the access to group or other users. |
umask user file creation mask.
umask is used to specify the permissions given to all new files created. The permission specified is the opposite of the numeric permissions specified above - it specified what permissions are NOT given. Therefore a umask of 077 indicates a user can read, write and execute (rwx = 7 - (4 (read) + 2 (write) + 1 (execute)) = 0, group has no access (not rwx = 7 - 0 = 7) and other has no access (not rwx = 7 - 0 = 7). To grant read and write access to user (7 - (4 + 2) = 1), and group read and execute(7 - 4 + 1 = 2) and world read (7 - (4) = 3 gives a umask of 123. A umask of 077 is equivalent to a chmod of 777 - 077 = 700 = u=rwx, g-rwx, o-rwx.
After the umask is in effect until you log out or provide a new umask. The umask is applied to all new files and directories created It does not affect existing files. Remember directories need read and execute access.
umask [mode]
umask (octal) |
umask (binary) | Permission (octal) |
Permission (binary) | Permission (String) |
Meaning |
|---|---|---|---|---|---|
| 077 | 000111111 | 700 | 111000000 | rwx------ | User has read, write and execute access. Group and other have no access. |
| 027 | 000010111 | 750 | 111101000 | rwxr-x--- | User has read, write and execute access. Group has read access and execute access. Others have no access. |
| 022 | 000010010 | 755 | 111101101 | rwxr-xr-x | User has read, write and execute access. Group and Other have read and execute access. |
Note: the binary umask and binary permissions are the complement of each other.
umask Displays the current value of umask
umask 077 Set a usr mask equivalent to chmod 700 or u=rwx go-rwx
umask 123 Set a usr mask equivalent to chmod 654 or u=rw g=rx u=r
By default the files in your account are readable by other students. This is appropriate for some files e.g. web pages in the directory public_html. However tutorial work, assignments etc should not be readable by other users.
I recommend that you do the following to provide suitable levels of protection for your files:
1. Set the default mode (permissions) for files so that only you can access them. To do this insert the command:
umask 077
in your .login file. This provides rwx (read & write & eXecute) access for the user, and no access for any other users. Once .login has been executed all new files created will have this mode, from now on. To execute the .login file either (a) logout then login in again or (b) execute the login file by typing the command source .login
2. Change directory to your home directory. Set the mode on all files to user read & write & execute; and no group or other access. The -R results in all subdirectories and their files being changed.
chmod -R go-rwx *
or the equivalent command
chmod -R 700 *
The above command changes the permissions on files in the current directory and all subdirectories below this. If this is your home directory, this will protect all of your files, as other users won't have access to the subdirectories in the home directory so can't get at the files in them
3. Change the protection on files that you want other users to access. Ensure that users have access to the directory as well as the files. The following changes the permissions on the directory public_html to group & other to read and execute
chmod go+rx public_html
to change files in a directory, use cd to change directory to that directory and provide read access to everyone:
chmod go+rx *
or the equivalent command
chmod 755 *
For example change directory to the public_html directory and then execute the above command to provide read and execute access to the files in public_html.
Whenever you create or copy files to public_html you need to set their permissions (e.g. chmod go+rx *) if they are to be group or other accessible. This may be necessary for your assignments in some subjects.
A fundamental principle of the Unix OS is that output of one program can be used as input for another program. From the command line the operation of the input and output can also be redirected through the use of the redirection characters <, <<, >, >> and piping using the vertical bar character '|' where the standard output of one command becomes the standard input of another.
ls (ls outputs to stdout - i.e. the screen )
less afile.txt (less receives input from the file afile.txt and outputs it to stdout i.e. the screen)
ls > afile.txt (Output from ls is sent to the file afile.txt everything in afile.txt is overwritten)
ls >> afile.txt (Output from ls is appended to the end of afile.txt If it already exists, otherwise a new file is created)
cat file1.txt (cat receives input from file1.txt and outputs the file to the screen )
cat file1.txt file2.txt > file3.txt (cat concatenates file1.txt and file2.txt and outputs to the file file3.txt)
cat > file1.txt file2.txt (Copies from stdin (the keyboard) to the file afile.txt until the End-Of-File (EOF) is reached - a CTRL-D)
Input is usually from the keyboard, but it can be redirected also, really only used for programs that have a set input sequence, such as a list of numbers that can easily be stored in a file. eg:
progName < afile.txt
ls -l | less (Output from ls is sent as input into the program less. The output of less is displayed to stdout as a sequence of characters one screen at a time)
Problem: you want to display the largest 10 directories in your account as you want to find where all that space has gone.
Solution: (in steps).
grep is for searching files. grep stands for Global Regular Expression Print.
grep [-ciln] search-pattern files-to-search
-c count. Only count the
number of matching lines the search pattern was found on
-i ignore case. Ignore case (case insensitive
search)
-l list. Only list the names of the
files that contain the search pattern
-n numbers. List the line numbers the
search pattern was found on
grep hello *.java (Search for all the java programs
with the string hello in them)
grep smith /etc/passwd (Search for all occurrences of
"smith" in the password file)
grep -ic 'Prog Env' * | less (Search for all occurrences of "Prog Env"
in the any file in this directory using a
case insensitive search and only counting
occurrences)
The vi (pronounced Vee I) editor is a character based, full screen, text editor. It uses its own set of commands (you can get a summary from vi_guide.pdf).
Vi is a moded editor. This means that it operates in different modes. When you first start it, it is in command mode. Here you can give keystroke commands to move around the file, delete lines, copy, paste, and the like. When you give one of the text insertion commands, such as i, you move to insert mode where everything you type goes into the file. You leave insert mode by pressing the ESCAPE key, which returns you to command mode. There is also a bottom line mode which allows more complex search and replace operations. The commands are case sensitive e.g. a is different to A. Once you are familiar with the commands, vi is extremely quick to use, particularly if if you are a touch typist.
vi has a number of advantages:
Some useful vi commands:
Note: When you complete an editing session, you save the file and exit using ZZ
nano is a full screen text editor that doesn't require a graphical environment to run. This can be useful if you are logging in from a system that doesn't have a graphical environment. nano uses special keystrokes to perform commands, such as Ctrl+X to exit, Ctrl+G for help. It doesn't use the mouse. See http://www.nano-editor.org/ for more.
Some commands are shown at the bottom of the window. Many commands use the control key (Ctrl).
Unix is an old system, which has been updated constantly. There are many available editors. Some include:
Written by Tim Whitfort.