The Linux Security Blueprint: Users, Groups, and Permissions

 At the core of Linux's rock-solid security is its multi-user architecture. In Linux, everything is either a file or a process, and every file and process belongs to a specific owner and group.

Understanding how to manage users, groups, and permissions is essential for keeping systems secure and running smoothly. Let's break down these concepts with practical examples.

👥 1. Users, Groups, and Access Control

Linux is designed for multiple people to share system resources securely. Access is controlled through three layers:

• Users: Individual accounts on the system. The most powerful user is root (the system administrator, which has unrestricted access).
• Groups: Collections of users. Instead of assigning permissions to users one by one, you assign permissions to a group and add users to it.
• Sudo: Short for "SuperUser DO." It allows permitted regular users to execute commands with administrator (root) privileges.

Managing Users & Groups

To create, delete, and manage accounts, use these foundational administration commands:

# Create a new user named 'alice'
$ sudo useradd -m alice

# Set or change a password for 'alice'
$ sudo passwd alice

# Create a new group named 'developers'
$ sudo groupadd developers

# Add user 'alice' to the 'developers' group
$ sudo usermod -aG developers alice

# Delete a user and remove their home folder
$ sudo userdel -r alice

The Power of sudo

Regular users cannot change system files or install software. If you have admin rights, you prefix your command with sudo to run it as root:

# Running this as a normal user will fail
$ apt update
Permission denied

# Running with sudo prompts for your password and succeeds
$ sudo apt update

🔒 2. Understanding File Permissions

Every file and directory in Linux has an ownership structure consisting of three tiers:

1. User (u): The individual user who owns the file.
2. Group (g): The group that has access to the file.
3. Others (o): Everyone else on the system.

When you run ls -l (list details), you will see the permission string representing these tiers:

$ ls -l script.sh
-rwxr-xr-- 1 alice developers 1024 Jul 17 10:00 script.sh

Look at the first ten characters: -rwxr-xr--

• Position 1 (-): File type (- is a regular file, d is a directory).
• Positions 2–4 (rwx): User permissions. Alice (owner) can Read, Write, and Xecute.
• Positions 5–7 (r-x): Group permissions. Members of the "developers" group can Read and Xecute, but cannot write (modify).
• Positions 8–10 (r--): Others permissions. Anyone else on the system can only Read.

🔢 3. Symbolic vs. Numeric Permissions

You can modify permissions using the chmod (Change Mode) command. This can be done in two ways: Symbolic mode (using letters) or Numeric mode (using octal numbers).

Numeric (Octal) Permissions

Numeric mode uses math to set permissions quickly. Each permission type is assigned a number:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1

Add these numbers together to get the permission value for a tier (ranging from 0 to 7):

# Set

# Set permissions to: User (rwx), Group (rx), Others (r)
$ chmod 754 script.sh

Symbolic Permissions

Symbolic mode is perfect when you want to add or remove a specific permission without rewriting the whole set. It uses operators:

• + (Add permission)
• - (Remove permission)
• = (Set exact permission)

# Add execute (+x) permission for the User/Owner (u)
$ chmod u+x script.sh

# Remove write (-w) permission from Group (g) and Others (o)
$ chmod go-w config.yaml

# Give everyone (a = all) read access
$ chmod a+r readme.md

🛠️ 4. Advanced Permissions: SUID, SGID, and Sticky Bit

Standard permissions are sometimes not enough. Linux provides three special flags for advanced access control.

SUID (Set Owner User ID)

When SUID is set on an executable file, any user who runs it will execute it with the privileges of the file's owner (often root), rather than their own.

• Classic Example: The passwd command. Regular users need to write to the protected /etc/shadow file to change their password. SUID allows them to do this safely.
• Representation: An s appears in the user's execute field (e.g., -rwsr-xr-x).

# Set SUID on a file numerically (prefixed with 4)
$ chmod 4755 tools/admin-helper

SGID (Set Group ID)

SGID behaves like SUID but applies to groups.

• On a file, it runs the executable with the privileges of the file's group.
• On a directory, any new file created inside inherits the group owner of the parent directory automatically, rather than the group of the user who created it. This is incredibly useful for shared team folders.
• Representation: An s appears in the group's execute field (e.g., drwxrwsr-x).

# Set SGID on a directory (prefixed with 2)
$ chmod 2775 shared_folder/

Sticky Bit

The Sticky Bit is used to protect directories shared by many users. When applied, a user can only delete or rename files that they actually own, even if other users have write permissions to the directory.

• Classic Example: The /tmp directory where everyone can write files, but users shouldn't be allowed to delete each other's files.
• Representation: A t appears in the others' execute field (e.g., drwxrwxrwt).

# Set Sticky Bit on a folder (prefixed with 1)
$ chmod 1777 public_drop/

🏗️ 5. Default Security: umask and chown

Changing Ownership with chown

To change who owns a file or group, use the chown (Change Owner) command. You must run this command with sudo privileges.

# Change the owner of 'app.log' to 'alice'
$ sudo chown alice app.log

# Change both the owner (to 'alice') and the group (to 'developers')
$ sudo chown alice:developers app.log

# Recursively change ownership for an entire directory and its contents
$ sudo chown -R alice:developers project_dir/

The Default Filter: umask

When you create a new file or directory, Linux automatically assigns default permissions. How does it decide what those are? It uses the umask (User Mask).

Think of umask as a subtraction mask. The system starts with a maximum permission limit and "subtracts" the umask value to determine the final default permissions.

• Max Starting Point for Files: 666 (Read & Write for everyone, no execute)
• Max Starting Point for Directories: 777 (Read, Write, and Execute for everyone)

If your system's umask is set to 022, the math works like this:

Default Directory Permissions = 777 - 022 = 755 (rwxr-xr-x)

Default File Permissions = 666 - 022 = 644 (rw-r--r--)

# View your current umask value
$ umask
0022

# Temporarily change umask so new files are private (User gets 6-0=6, Group gets 6-6=0)
$ umask 0077