A directory's access permissions help to control access to the files and subdirectories in that directory:

The access permissions on a file control what can be done to the file's contents. The access permissions on the directory where the file is kept control whether the file can be renamed or removed. (If this seems confusing, think of it this way: the directory is actually a list of files. Adding, renaming, or removing a file changes the contents of the directory. If the directory isn't writable, you can't change that list.)

Once you know what permissions a file or directory needs--and if you're the owner (listed in the third column of ls -l output)--you can change the permissions with the chmod program.

There are two ways to change permissions: by specifying the permissions to add or delete, or by specifying the exact permissions.[8] For instance, if a directory's permissions are almost correct, but you also need to make it writable by its group, tell chmod to add group-write permission. But if you need to make more than one change to the permissions--for instance, you want to add read and execute permission, but delete write permission--it's easier to set all permissions explicitly instead of changing them one-by-one. The syntax is:

[8] Early versions of chmod can't add or delete particular permissions. Instead, you have to give an exact permission as three digits between 0 and 7. If you need to use chmod that way, please see a more detailed Unix reference.

1. The category of permission you want to change. There are three: the owner's permission (which chmod calls "user," abbreviated u), the group's permission (g), or others' permission (o). To change more than one category, string the letters together, such as go for "group and others," or simply use a to mean "all" (same as ugo).

2. Whether you want to add (+) the permission, delete (-) it, or specify it exactly (=).

3. What permissions you want to affect: read (r), write (w), or execute (x). To change more than one permission, string the letters together--for example, rw for "read and write."

Some examples should make this clearer! In the following command lines, you can replace dirname or filename with the pathname (absolute or relative) of the directory or file. An easy way to change permissions on the working directory is by using its relative pathname, . (dot), as in "chmod a-w .". You can combine two permission changes in the same chmod command by separating them with a comma (,), as shown in the final example.

• To protect a file from accidental editing, delete everyone's write permission with the command "chmod a-w filename". On the other hand, if you own an unwritable file that you want to edit, but you don't want to change other peoples' write permissions, you can add "user" (owner) write permission with "chmod u+w filename".

• To keep yourself from accidentally removing files (or adding or renaming files) in an important directory of yours, delete your own write permission with the command "chmod u-w dirname". If other users have that permission, too, you could delete everyone's write permission with "chmod a-w dirname".

• If you want you and your group to be able to read and write all the files in your working directory--but those files have various permissions now, so adding and deleting the permissions individually would be a pain--this is a good place to use the = operator to set the exact permissions you want. Use the filename wildcard *, which means "everything in this directory" (explained in Section 4.2 of Chapter 4) and type: "chmod ug=rw *".

  If your working directory had any subdirectories, though, that command would be wrong because it takes away execute permission from the subdirectories, so the subdirectories couldn't be accessed anymore. In that case, you could try a more specific wildcard. Or, instead of a wildcard, you can simply list the filenames you want to change, separated by spaces, as in "chmod ug=rw afile bfile cfile".

• To protect the files in a directory and all its subdirectories from everyone else on your system, but still keep the access permissions you have there, you could use "chmod go-rwx dirname" in order to delete all "group" and "others" permission to read, write, and execute. A simpler way is to use the command "chmod go= dirname" to set "group" and "others" permission to exactly nothing.

• You want full access to a directory. Other people on the system should be able to see what's in the directory--and read or edit the files if the file permissions allow it--but not rename, remove, or add files. To do that, give yourself all permissions, but give "group" and "others" only read and execute permission. Use the command "chmod u=rwx,go=rx dirname".

After you change permissions, it's a good idea to check your work at first with "ls -l filename" or "ls -ld dirname".

Most Linux systems have a program named chattr that gives you more choices on file and directory protection. chattr is being developed, and your version may not have all the features that it will have in later Linux versions. For instance, chattr can make a Linux file append-only (so it can't be overwritten, only added to), compressed (to save disk space automatically), immutable (so it can't be changed at all), undeletable, and more. Check your online documentation (type man chattr--see Chapter 8).

Group ownership lets a certain group of users have access to a file or directory. You might need to let a different group have access. The chgrp program sets the group owner of a file or directory. You can set the group to any of the groups you belong to. (The system staff control the list of groups you're in.) On most versions of Unix, the groups program lists your groups.

For example, if you're an instructor creating a directory named csc303 for students in a course, the directory's original group owner might be faculty. You'd like the students, all of whom are in the group named csstudnt, to access the directory; members of other groups should have no access. Use commands such as these:[9]

[9] Many Unix systems also let you set a directory's group ownership so that any files you later create in that directory will be owned by the same group as the directory. Try the command "chmod g+s dirname". If this works, the permissions listing from ls -ld should show an s in place of the second x, such as drwxr-s---.

The chown program changes the owner of a file or directory. On most Unix systems, only the superuser can use chown.[10]

[10] If you have permission to read another user's file, you can make a copy of it (with cp; see Section 4.4.2 in Chapter 4). You'll own the copy.