🔐 Lesson 5: Users, Permissions and sudo

Who you are, what you are allowed to do, how to read those cryptic letters, and how to change them safely

▶

Why Linux keeps asking "are you allowed?"

Linux was built from the start to be shared by many people, and a program can run as one user or another. So every file and every action belongs to someone, and the system checks, every single time, whether that someone is allowed. This is one reason malicious software has a harder time spreading on a well-run Linux machine, and also why you keep meeting "Permission denied". It is not a bug. It is the lock on the door, and in this lesson you get the key and learn how the lock works.

All the output below was run on a real Ubuntu 24.04, in the practice container.

Who are you?

ubuntu@practice:~$ whoami
ubuntu
ubuntu@practice:~$ id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev)
ubuntu@practice:~$ groups
ubuntu adm dialout cdrom floppy sudo audio dip video plugdev
ubuntu@practice:~$ ls -l /etc/passwd /etc/shadow
-rw-r--r-- 1 root root   888 Sep 17 02:29 /etc/passwd
-rw-r----- 1 root shadow 502 Sep 17 02:29 /etc/shadow
ubuntu@practice:~$ cat /etc/shadow
cat: /etc/shadow: Permission denied
ubuntu@practice:~$ touch /etc/newfile
touch: cannot touch '/etc/newfile': Permission denied
ubuntu@practice:~$ ls -ld /root /home/ubuntu /tmp
drwxr-x--- 2 ubuntu ubuntu 4096 Sep 17 02:29 /home/ubuntu
drwx------ 2 root   root   4096 Sep 17 02:29 /root
drwxrwxrwt 2 root   root   4096 Sep 17 02:29 /tmp

• whoami is your user name, ubuntu.
• id shows your numbers and your groups. A group is a named collection of users, so a permission can be given to many people at once. You are in ubuntu, adm, video and several others. Look at 27(sudo): **you are in the sudo group**. On a normal Ubuntu, that is the group whose members are allowed to act as the administrator. We come back to that at the end.
• groups is the short version of the same list.

Reading the permission letters

The long listing above shows the permissions. Take this line:

-rw-r----- 1 root shadow 502 Sep 17 02:29 /etc/shadow

The first ten characters are the whole story:

• Character 1 is the type: - for an ordinary file, d for a directory.
• Characters 2 to 4 are what the file's owner may do.
• Characters 5 to 7 are what the file's group may do.
• Characters 8 to 10 are what everybody else may do.

In each group of three, r means read, w means write (change or delete), x means execute (run it as a program), and - means "not allowed". So rw-r----- reads: the owner can read and write, the group can read, everyone else gets nothing. The next two columns say who the owner (root) and the group (shadow) are.

That is why cat /etc/shadow said Permission denied: you are not root and you are not in the shadow group, so you fall into "everybody else", who have no permissions. And touch /etc/newfile was refused too, because /etc only lets root create files in it.

Compare the other files in the same listing:

• /etc/passwd is -rw-r--r--: root can write, everybody can read. That is why you could read it in lesson 4.
• /home/ubuntu is drwxr-x---: your own home. You can do everything, your group can look in, others cannot.
• /root is drwx------: only root, nobody else at all. That is your Permission denied from lesson 2.
• /tmp is drwxrwxrwt: everyone can read, write and enter. The final t is the "sticky bit": it means everyone can put files in there, but you can only delete your own.

For a directory, r lets you list what is inside, w lets you add and remove files, and x lets you enter it with cd. A folder without x is a closed door.

Changing permissions: chmod

chmod means "change mode". Only the owner of a file (or root) may use it. The classic first meeting is a script that will not run:

ubuntu@practice:~$ echo 'echo Hello from my script' > hello.sh
ubuntu@practice:~$ ls -l hello.sh
-rw-r--r-- 1 ubuntu ubuntu 26 Oct  5 14:01 hello.sh
ubuntu@practice:~$ ./hello.sh
bash: ./hello.sh: Permission denied
ubuntu@practice:~$ chmod +x hello.sh
ubuntu@practice:~$ ls -l hello.sh
-rwxr-xr-x 1 ubuntu ubuntu 26 Oct  5 14:01 hello.sh
ubuntu@practice:~$ ./hello.sh
Hello from my script
ubuntu@practice:~$ echo "my secret" > secret.txt
ubuntu@practice:~$ chmod 600 secret.txt
ubuntu@practice:~$ ls -l secret.txt
-rw------- 1 ubuntu ubuntu 10 Oct  5 14:01 secret.txt
ubuntu@practice:~$ stat -c "%a %A %n" hello.sh secret.txt
755 -rwxr-xr-x hello.sh
600 -rw------- secret.txt
ubuntu@practice:~$ chmod go+r secret.txt
ubuntu@practice:~$ stat -c "%a %A %n" secret.txt
644 -rw-r--r-- secret.txt
ubuntu@practice:~$ chmod 600 secret.txt
ubuntu@practice:~$ chmod u-w secret.txt
ubuntu@practice:~$ stat -c "%a %A %n" secret.txt
400 -r-------- secret.txt
ubuntu@practice:~$ echo more >> secret.txt
bash: secret.txt: Permission denied

• A new file is created without the x permission. ./hello.sh ("run the file hello.sh in this folder") was refused: Permission denied.
• chmod +x hello.sh adds the execute permission. Now the listing says -rwxr-xr-x and the script runs: Hello from my script.
• stat -c "%a %A %n" prints the permissions in two ways, which leads to the second notation.

There are two ways to tell chmod what you want:

Letters (symbolic). Who: u (user, the owner), g (group), o (others), or a (all). Then + to add, - to remove or = to set exactly, and then r, w, x. So chmod go+r secret.txt gave group and others read permission, chmod u-w removed the owner's write permission.

Numbers (octal). Each permission has a value: r is 4, w is 2 and x is 1. Add them up per group. rwx is 4+2+1 = 7, rw- is 4+2 = 6, r-- is 4. A mode like 755 therefore means: owner 7 (rwx), group 5 (r-x), others 5 (r-x). The numbers you will use the most:

• 755 is rwxr-xr-x: programs and folders everybody may use.
• 644 is rw-r--r--: ordinary files.
• 600 is rw-------: private files, only you (like secret.txt above, and SSH keys).

The very last step is a surprise. After chmod u-w, the file is -r--------, mode 400, and echo more >> secret.txt was refused: even the owner cannot write to a file the owner made read-only. Permissions apply to you too.

Users and groups (as the administrator)

So far you were an ordinary user, so you cannot create other users. To see how it works we open a second practice machine as root, which is the default of docker run -it --rm ubuntu:24.04 from lesson 1. Notice the prompt now ends in #, not $. That is the administrator, who is allowed to do everything. Be careful with a # prompt on any real machine.

root@practice:/# useradd -m -s /bin/bash alice
root@practice:/# useradd -m -s /bin/bash bob
root@practice:/# ls -l /home
total 12
drwxr-x--- 2 alice  alice  4096 Oct  5 14:02 alice
drwxr-x--- 2 bob    bob    4096 Oct  5 14:02 bob
drwxr-x--- 2 ubuntu ubuntu 4096 Sep 17 02:29 ubuntu
root@practice:/# id alice
uid=1001(alice) gid=1001(alice) groups=1001(alice)
root@practice:/# su - alice
alice@practice:~$ whoami
alice
alice@practice:~$ pwd
/home/alice
alice@practice:~$ echo "Alice's notes" > notes.txt
alice@practice:~$ ls -l
total 4
-rw-rw-r-- 1 alice alice 14 Oct  5 14:02 notes.txt
alice@practice:~$ exit
logout
root@practice:/# su - bob
bob@practice:~$ cat /home/alice/notes.txt
cat: /home/alice/notes.txt: Permission denied
bob@practice:~$ exit
logout

• useradd -m -s /bin/bash alice created the user alice. The -m makes her a home folder, and -s /bin/bash gives her the normal shell. We made bob the same way.
• ls -l /home shows each home folder is owned by its user and is drwxr-x---: nobody else gets in.
• su - alice means "switch user": it opened a new shell as alice (the prompt changed, and pwd shows her home). The dash gives her a fresh, normal login. Root may become anyone without a password. She made a file, and exit went back to root.
• As bob, cat /home/alice/notes.txt gave Permission denied. Bob cannot even go into Alice's home. Users are kept apart by default.

To share on purpose, use a group:

root@practice:/# groupadd team
root@practice:/# usermod -aG team alice
root@practice:/# usermod -aG team bob
root@practice:/# id bob
uid=1002(bob) gid=1002(bob) groups=1002(bob),1003(team)
root@practice:/# mkdir /srv/shared
root@practice:/# chgrp team /srv/shared
root@practice:/# chmod 770 /srv/shared
root@practice:/# ls -ld /srv/shared
drwxrwx--- 2 root team 4096 Oct  5 14:02 /srv/shared
root@practice:/# su - alice -c 'echo "from alice" > /srv/shared/hello.txt'
root@practice:/# su - bob -c 'cat /srv/shared/hello.txt'
from alice
root@practice:/# ls -l /srv/shared
total 4
-rw-rw-r-- 1 alice alice 11 Oct  5 14:02 hello.txt
root@practice:/# chown bob /srv/shared/hello.txt
root@practice:/# ls -l /srv/shared
total 4
-rw-rw-r-- 1 bob alice 11 Oct  5 14:02 hello.txt
root@practice:/# exit

• groupadd team makes a group, and usermod -aG team alice adds Alice to it. (The -a means append. Leave it out and you would replace all her other groups, which is a classic way to lock yourself out.)
• id bob shows he is now in team.
• The shared folder /srv/shared got its group set to team (chgrp team) and the mode 770: drwxrwx---, which means the owner and the group can do everything and everyone else nothing.
• Alice wrote a file in it, and Bob could read it. They share, and nobody else can see it.
• chown bob /srv/shared/hello.txt changed the file's owner to Bob. Only root may give files away like this. (chown bob:team FILE changes the owner and the group in one go.)

sudo: borrowing the administrator's power, carefully

It is a bad idea to be root all day. One typo as root can ruin the machine. So on Ubuntu you work as an ordinary user, and when one command needs administrator rights you put the word sudo in front of it. sudo means "do this one thing as the superuser": it checks that you are in the sudo group (you are: 27(sudo) in the id output), asks for your own password, runs just that command with full rights, and goes back to normal. On a normal Ubuntu it looks like this (from the documentation, not run here):

you@laptop:~$ sudo ls /root
[sudo] password for you:

You will need sudo for things ordinary users may not do: installing software (lesson 6), changing system settings and reading the protected files. In this bare-bones practice container sudo is not installed, and the shell tells you so:

ubuntu@practice:~$ sudo ls /root
bash: sudo: command not found

That is the container being stripped down, not you doing anything wrong. Lesson 6 installs it, and then you can use it for real.

A few ground rules for sudo, because it removes the safety belt:

1. **Never put sudo in front of a command you do not understand**, or one you pasted from a stranger. The command will run with full power.
2. Read the command twice before you press Enter. A typo with sudo is a typo with no safety net.
3. Do not use sudo to make an error go away. "Permission denied" usually means "this is not yours to change". Check the permissions with ls -l first.
4. sudo asks for your password, and typing it shows nothing on screen, not even dots. That is normal.

The cheat sheet

• whoami your name. id your numbers and groups. groups just the groups.
• ls -l shows permissions: type, then rwx for owner, group and others.
• chmod +x FILE make it executable. chmod 644 FILE, chmod 755 FILE, chmod 600 FILE set the numbers. chmod u+w, go-r change single permissions.
• r=4 w=2 x=1. Add them per group: 7 is everything, 6 is read and write, 5 is read and run, 4 is read.
• chown USER:GROUP FILE change who owns it (root only). chgrp GROUP FILE change the group.
• useradd -m NAME make a user (root). su - NAME become them. usermod -aG GROUP USER add a user to a group (the -a matters).
• sudo COMMAND run one command as administrator, with your password, once. Never with a command you do not understand.

← Lesson 4 · ↑ All lessons · Lesson 6: Installing Software with apt →