Not every file on the system should be readable by everyone. Likewise, some files that everyone needs (such as the executables for commands like cp, mv, etc.) should not be subject to accidental deletion or alteration by ordinary users. This is where file permissions come into play.

Unix allows three forms of access to any file: read, write, and execute. For an ordinary file, if you have read (r) permission, you can use that file as input to any command/program. If you have write (w) permission, you can make changes to that file. If you have execute (x) permission, you can ask the shell to run that file as a program.

The owner of a file can decide to give any, all, or none of these permissions to each of three classes of people:

These three classes are abbreviated “u” , “g” , and “o” , respectively. The “u” is for “user” , “g” for “group” , and “o” is for “others” . Until you actually join a project that needs its own group, you will mainly be concerned with “u” and “o” classes.

The ls -l command will show the permissions granted to each class. For example, if you said

you might see the response

On the far right, you see the actual file names. In front of that you are shown the date and time on which that file was last modified. In front of the date is the size of the file (in bytes). The two columns near the middle that contain names indicating the owner of the file (in this case, the owner has login name johndoe) and the group to which that file is assigned (in this case, the group student). Some typical groups are “wheel” , “faculty” , “gradstud” , and “student” . “Wheel” has no members, but groups like “student” and “gradstud” have very broad membership, as their names imply.19

Finally, look at the pattern of hyphens and letters at the far left of the ls output. The first character will be a “d” if the file is a directory, “-” if it is not. Obviously, none of these are directories. The next 3 positions indicate the owner's (u) permissions. By default, you get read and write permission for your own files, so each file has an “r” and a “w” . a.out is an executable program, so the compiler makes sure that you get execute (x) permission on it. The other files can't be executed, so they get no “x” . This way the shell will not even try to let you use hello.c or any of the other source code files as a program.

The next three character positions indicate the group permissions. In this case, the group permissions are the same as the student owner's permissions - all members of the student group can read or write these files and can execute the a.out program.

The final three character positions indicate the permissions given to the world (others). Note that in this case, people other than the owner or members of the same group cannot read, write, or execute any of these files.

Directories also can get the same rwx permissions, though the meaning is slightly different. If you have read permission on a directory, you can see the list of files in the directory via ls or other commands. If you have execute permission on a directory, then you can use that directory inside a file name to get at the files it contains. So, if you have execute permission but not read permission on a directory, you can use those files in the directory whose names you already know, but you cannot look to see what other files are in there. If you have write permission on a directory, you can change the contents of that directory (i.e., you can add or delete files).

The chmod command changes the permissions on files. The general pattern is

or Use “+” to add a permission, “-” to remove it. For example, chmod o+x a.out gives everyone permission to execute a.out. chmod g-rwx hello.* denies members of your group permission to do anything at all with the “hello” program source code files.

You can also add a -R option to chmod to make it “recursive” (i.e., when applied to any directories, it also applies to all files in the directory (and if any of those are directories, to the files inside them, and if…). For example, if I discovered that I really did not want the group to have permission to write or execute my files in ~/playing, I could say:

An alternate way of setting and removing permissions is to specify all 9 of the permissions (user, group and world - read write and execute) at once by giving them as a three-digit number. Each digit must be in the range 0-720

and the digits give the permissions for the owner, group and world, in that order. The digits are computed as binary numbers with read permission in the 4's position, write permission in the 2's position, and execute permission in the 1's position. Each bit in this number is 1 if permission is granted and zero if permission is denied. So, for example, if we wanted to give the owner read and write permission but not execute permission, the digit would be computed as: If we wanted to give the group read permission only, the digit would be computed as: and if we wanted to give no permissions at all to the world, We would then set the permissions for the file by giving these three digits in the chmod command:

Suppose you never use the chmod command. What would be the protection levels on any files you created?

The answer depends upon the value of umask. Look in your ~/.cshrc file for a command by that name, and note the number that follows it. If you don't have one, just give the command

and note the number that it prints.

The umask number is a 3 digit (base 8) number, similar to the numeric form of the permissions in the chmod command. The first digit describes the default permissions for the owner (you), the second digit describes the default permissions for the group, and the final digit describes the default permissions for others. Each of these three numbers is, in turn, formed as a 3-digit binary number where the first digit is the read permission, the second is the write permission, and the thrid digit is the execute permission.

Unlike the chmod command, however, in each binary digit of the umask, a 0 indicates that the permission is given, a 1 that the permission is denied.

So if my umask is 027, that means that

Of course, these permissions can be changed for individual files via the chmod command. The umask only sets the default permissions for cases where you don't say chmod.

If you want to change your default permissions, you do it via the umask command by giving it the appropriate 3-digit octal number for the new default permissions. Some common forms are:

Since the point of the umask command is to establish the default behavior for all your files, this command is normally placed within your .cshrc file.

At the very least, you will want to make sure that files that you are preparing to turn in for class assignments are protected from prying eyes. You need to do a little bit of planning to prepare for this. There are two plausible approaches: