User Groups and Permissions in Linux
From smartphones to cars, supercomputers and home appliances, home desktops to enterprise servers, the Linux operating system is everywhere.
Introduction
To create a secure environment in Linux, you need to learn about user groups and permissions. For example, if you work in a company and you want the finance department to read a file but not make any modification to it, then you need to use permissions in Linux. It is a must for every programmer working with Linux nowadays.
Prerequisites
To follow along with this tutorial, you should have:
Table of contents
File permissions
Let’s start by talking about the ownership of Linux files.
- User: the owner of the file (person who created the file).
- Group: the group can contain multiple users. Therefore, all users in that group will have the same permissions. It makes things easier than assign permission for every user you want.
- Other: any person has access to that file, that person has neither created the file, nor are they in any group which has access to that file.
When you perform the following command:
Then you will see the file’s permissions, like the following:
We will work with this part “-rw-r–r–”.
As we see above, the empty first part means that it is a file. If it were a directory then it will be the letter “d” instead. The second part means that the user “Home” has read and write permissions but he does not have the execute one. The group and others have only the read permission.
Let’s change the permissions using the chmod command.
This command will add the write permission for other users to my text file “section.txt”.
Now if you try to execute ls -l then you will see -rw-r—rw- .
“o” refers to others, “g” for the group, “u” for the user, and “a” for all.
Now let’s add the execute permission to the user with:
The permissions will be -rwxr—rw- .
If you want to remove the permission, you can use the same method but with “-” instead of “+”. For example, let’s remove the execute permission from the user by:
And the permissions now are: -rw-r—rw- .
Also, you can use Symbolic Mode to modify permissions like the following:
| Number | Permission |
|---|---|
| 0 | No permission |
| 1 | Execute |
| 2 | Write |
| 3 | Execute and Write |
| 4 | Read |
| 5 | Read and Execute |
| 6 | Read and Write |
| 7 | Read, Write and Execute |
For example, let’s give every permission for all with:
Then the permissions will be: -rwxrwxrwx .
Let’s remove the execute from the group and the write from other by:
The permissions will be: -rwxrw-r-x .
User accounts
Create a user
We can create a new user account by issuing the following command:
We can make sure that the user has been created in two ways:
And the output will be something like this:
uid=1007(testuser) gid=1009(testuser) groups=1009(testuser) This will show the user id and the groups that the user is currently in, usually, a new group with the same username is assigned to the user.
So we can issue cat /etc/passwd and we will see the new user that has been created.
After creating the user using the command above, you notice that no user directories have been created inside /home directory, which is not good since the user cannot log in to his account.
To create a new user with its directories, we can issue:
sudo useradd -m -s /bin/bash testuser If you navigate to the /home directory, you notice that a new directory with the name testuser is created.
Afterwards, you need to set a new password to the testuser by:
We noticed that creating a new user takes a lot of commands to accomplish, so there is a command that automates everything:
After creating a new user and setting a password to it, you can log in in two ways:
Delete a user
Like the process of adding users, there are two commands that delete a user.
If you try that command, you will notice that the user directory has not been deleted and you need to delete it by yourself.
You can use this automated command to do everything for you:
sudo deluser --remove-home testuser User groups
A group is a collection of users. The primary purpose of the groups is to define a set of privileges like read, write, or execute permission for a given resource that can be shared among the users within the group.
Create a group
You can see all of the groups you have by opening the following file:
Let’s create a group with the name of section by:
Add user to a group
We will add the testuser user to the section group by:
sudo usermod -aG section testuser Delete user from a group
You can delete the testuser from the group with:
sudo gpasswd -d testuser section Delete a group
Let’s delete the previous group by:
Conclusion
Linux is one of the most secure systems because it allows an admin to create multiple users with different permissions in the same hardware.
And now you know exactly how to do it!✨
Further reading
Peer Review Contributions by: Odhiambo Paul
Users and groups
Users and groups are used on GNU/Linux for access control—that is, to control access to the system’s files, directories, and peripherals. Linux offers relatively simple/coarse access control mechanisms by default. For more advanced options, see ACL, Capabilities and PAM#Configuration How-Tos.
Overview
A user is anyone who uses a computer. In this case, we are describing the names which represent those users. It may be Mary or Bill, and they may use the names Dragonlady or Pirate in place of their real name. All that matters is that the computer has a name for each account it creates, and it is this name by which a person gains access to use the computer. Some system services also run using restricted or privileged user accounts.
Managing users is done for the purpose of security by limiting access in certain specific ways. The superuser (root) has complete access to the operating system and its configuration; it is intended for administrative use only. Unprivileged users can use several programs for controlled privilege elevation.
Any individual may have more than one account as long as they use a different name for each account they create. Further, there are some reserved names which may not be used such as «root».
Users may be grouped together into a «group», and users may be added to an existing group to utilize the privileged access it grants.
Note: The beginner should use these tools carefully and stay away from having anything to do with any other existing user account, other than their own.
Permissions and ownership
The UNIX operating system crystallizes a couple of unifying ideas and concepts that shaped its design, user interface, culture and evolution. One of the most important of these is probably the mantra: «everything is a file,» widely regarded as one of the defining points of UNIX. This key design principle consists of providing a unified paradigm for accessing a wide range of input/output resources: documents, directories, hard-drives, CD-ROMs, modems, keyboards, printers, monitors, terminals and even some inter-process and network communications. The trick is to provide a common abstraction for all of these resources, each of which the UNIX fathers called a «file.» Since every «file» is exposed through the same API, you can use the same set of basic commands to read/write to a disk, keyboard, document or network device.
A fundamental and very powerful, consistent abstraction provided in UNIX and compatible operating systems is the file abstraction. Many OS services and device interfaces are implemented to provide a file or file system metaphor to applications. This enables new uses for, and greatly increases the power of, existing applications — simple tools designed with specific uses in mind can, with UNIX file abstractions, be used in novel ways. A simple tool, such as cat, designed to read one or more files and output the contents to standard output, can be used to read from I/O devices through special device files, typically found under the /dev directory. On many systems, audio recording and playback can be done simply with the commands, » cat /dev/audio > myfile » and » cat myfile > /dev/audio ,» respectively.
Every file on a GNU/Linux system is owned by a user and a group. In addition, there are three types of access permissions: read, write, and execute. Different access permissions can be applied to a file’s owning user, owning group, and others (those without ownership). One can determine a file’s owners and permissions by viewing the long listing format of the ls command:
total 13740 drwxr-xr-x 2 root root 4096 Jan 12 00:33 grub -rw-r--r-- 1 root root 8570335 Jan 12 00:33 initramfs-linux-fallback.img -rw-r--r-- 1 root root 1821573 Jan 12 00:31 initramfs-linux.img -rw-r--r-- 1 root root 1457315 Jan 8 08:19 System.map26 -rw-r--r-- 1 root root 2209920 Jan 8 08:19 vmlinuz-linux
The first column displays the file’s permissions (for example, the file initramfs-linux.img has permissions -rw-r—r— ). The third and fourth columns display the file’s owning user and group, respectively. In this example, all files are owned by the root user and the root group.
total 16 drwxrwx--- 1 root vboxsf 16384 Jan 29 11:02 sf_Shared
In this example, the sf_Shared directory is owned by the root user and the vboxsf group. It is also possible to determine a file’s owners and permissions using the stat command: