File Protection: Who Can Read Your Files? You are the only person who can create, read, modify, delete, and list the files under your own HOME directory. This whole issue of who can see and do what to whose files is called file protection or mode. Unix organizes file protection as follows: The world of users is divided into three main categores: other All users, even users from other machines. This is often referred to as "the world," or "public". group A group is a subset of users as defined in the file /usr/group. You can be a member of any number of different groups at the same time. To see what groups you are in, enter the command: groups Everyone in a particular course may be in one group, say 2.10. All users are in a primary group called mit. Since everyone is in group mit, it is for all practical purposes the same as world ("other"). There is currently no way for users to create new groups themselves. user This is you. This may sometimes be referred to as "owner." A File is "owned" by: The user who created it. The user who created a file is the only person who can change the protection on a file. Only the superuser can change the owner of a file using the chown command. It is why you never have someone give you a file; you always copy it from them yourself. Otherwise, you may find files under your directories that you cannot delete because you don't own them. One group. By default, a file copies its group ownersip from the directory under which it was created. Your HOME directory is owned by your primary group, mit. It is NOT owned by any other group you may belong to. Therefore, unless you tpae active steps, all of your files will be owned by group mit. To see who the group owner of a file is, add the -g option to the ls command: host% ls -lg filename To see the group owner of a directory, say: host% ls -ldg dirname You can change the group owner of a file with the chgrp command. Only the user who owns the file can change its group owner. Each file, plain or directory ha three kinds of access that can be granted to it: read, write, and execute. The interpretations of these three access modes are slightly different for plain files and directories. They are as follows: (taken almost verbatim from McGilton) Read A user who has read permission for a file can look at the contents of that file. A user who has read permission for a directory can find out what files are in that directory. If detailed information about the files in the directory is required, the directory must also have execute permission for that user. Whether the user can see the contents of the files in the directory depends on the read permissions for the files themselves. Write A user who was write permission for a file can change the contents of that file. A user who was write permission for a directory can change the contents of the directory: he/she can create new files under that directory, and delete files stored in it. Whether he/she can change the contents of the files depends upon the write permission for the files themselves. Write is the most powerful access permission. Execute A user who has execute permission for a file can use that filename as a Unix system command, provided the directories above it also have read permission turned on. A user who has execute permission for a directory can change directory to that directory and can copy files from that directory, providing the user also has read permission for the directory. The execute permission is often called a "search" permission. Thus, each file can grant three types of permission to three different categories of users. This vector of permission is called the file's mode. The mode is expressed in two ways. The first format is what shows up when you do an ls -l command. A file with all permissions turned on looks like: rwx rwx rwx --- --- --- | | |____ other (world) permission | |________ group permission |____________ user permission A missing permission is indicated by a "-". Thus, a file with user-only read, write, and execute permission would look like: rwx------. There is a second, numeric format in which to describe protection. Here is a table of equivalences: (from McGilton) user group other r w x r w x r w x | | | | | | | | | 400 ---------------------- | | | | | | | | | | | | | | | | 200 ------------------------ | | | | | | | | | | | | | | 100 -------------------------- | | | | | | | | | | | | 40 ----------------------------------- | | | | | | | | | | 20 ------------------------------------- | | | | | | | | 10 --------------------------------------- | | | | | | 4 ----------------------------------------------- | | | | 2 ------------------------------------------------- | | 1 --------------------------------------------------- To translate the mode you require to a number, add up the numbers corresponding to the individual permissions you want. If you want the files to be user read and write, group read, and world read, you would perform the addition: 400 200 40 4 ---- 644 Seriously. A file with all permissions turned on (rwxrwxrwx) is referred to as a mode 777. rwx--x--x is 711. Notice that there is no way in this scheme to grant access to a file to a particular user. The Default Protection At Project Athena, the default protection for private files (under /mit) is rwx--x--x (711). That is, only the user who created the files can do anything with them. The group and world x (execute) permission does not give users in those categories any access to your files because they do not have permission to read the directories they must pass through to get to the files. It just makes it a little easier for you to share one of your files should you decide to later. Project files (under /projects) are meant to be shared among members of a group so their default is different: rwxr-x--x (751). Changing Protections You change the protection on a file with the chmod (for "change mode") command. The general form of the command is: chmod mode file Chmod does not accept protections expressed in the the simple rwxrwxrwx form, although it does allow a variant on that form. Usually, people use the numeric (711, 644, etc.) form for expressing modes. We will now show you how to do some common protection changes. You should be able to figure out your own minor variations from these examples. To Make a File Readable by Everyone in a Group If you have a particular file that you want everyone in a group to be able to read and execute: 1. Change the file's group owner from the default mit to the name of the group. (Again, the group must be predefined in /etc/group.) chgrp groupname filename 2. Now change the group protection on the file to allow group read and execute. chmod 751 filename To Make a Directory Where All Members of a Group Can Read and Write Groups often want a directory that everybody can write on to place the files they all want to share. Athena projects would likely do this under their /projects/projectname administrative directory. Here is how: 1. Make the directory. mkdir dirname 2. Change its group ownership to the correct group (must be predefined in /etc/group). chgrp groupname dirname 3. Change its protection to allow group read, write, and execute. chmod 771 dirname Any files that you create under this directory will still have the default protection of user /read/write/execute (rwx--x--x) only. You and the other members of your group will have to individually reset the protections to 711 for each file that you place here. Otherwise, people in your group will be in the strange position of being able to delete files they cannot even read! Athena courses may well wish to make directories that allow group read and execute only (751). To Make a Public Directory Many people will want to create a public directory where they will place things that they wish to offer for the public benefit of the community. 1. Make the directory. Calling it public would be intuitive. mkdir public 2. Change its protection to world read and execute. (World write is inviting trouble.) chmod 755 public Again, you will have to manually reset the protection of each file you place under your public directory to 755 because it will be created with the more restrictive 711 default. To Open Your Files to All: An Interesting Issue The traditional default file protection on Unix systems is rwxr-xr-x. In addition to the file's owner having full control of his/her own files, all other users are permitted to read a user's directories and files unless that user takes explicit action to close off access. Anyone can look at and copy anybody else's files. Project Athena started creating user accounts with this traditional rwxr-xr-x (755) protection. The MIT Committee on Privacy that is charged with safeguarding the privacy of MIT students, faculty, and staff reviewed this default protection and decided that it should be changed to rwx--x--x (711, owner access only). The default protection was changed on ????? (We havn't done it yet.) The reasoning is a combination of the belief that the "mom and pop shop" protection scheme of the traditional Unix would not scale up to the eventual Athena community size of 10,000+, that most people do not expect their files to be public, do not investigate the question, and are quite surprised and upset when they find out that this is the default, and that the Unix file protection mechanism is too complicated to grasp quickly when one is new to a system and not interested anyway and therefore the burden upon the novice to figure out how to make files private is unreasonably great. The feeling is very strong among Unix programmers that the traditional relaxed, sharing, open attitude toward file protection is a major factor contributing to Unix's success as an operating system. If you want to profess the Unix "live free or die" philosophy and make your files publically readable, here's how: 1. Edit your .login file. Change the line reading "umask 66" to "umask 22" (Umask uses yet a different numbering scheme, the octal ones complement of the other numbering scheme.) This is rwxr-xr-x (755). 2. You must change the protection on your HOME directory: chmod 755 ~/ 3. If you wish you can then change the protection on your existing files to 755 with the chmod command. Chmod does not have a -r recursive option. 4. If you do wish to have private files, the convention is to create a subdirectory and keep the files there: mkdir private chmod 711 private You do not have to individually change the protection to private on the files within the directory as you have to individually "liberalize" the protection of files in a public directory. This is because the private mode on the directory effectively locks the door to anything below it. Caveat Emptor: A Final Warning A conversation overheard: Systems programmer: "I came in on Saturday because I had to change some things and I discovered that G---- had changed the root password. Changed the root password without telling anyone what the new one is! Well, I had to get my stuff done, so I dinked around a bit and you know how long it took me to break in? Eleven minutes." Manager: "You're slipping." The expertise that let the programmer above figure out how to log in as the root user--who can do anything on a Unix system--in under fifteen minutes without knowing the password is fairly common around MIT. Unix is not a secure operating system. Although file protection is set up so that only you can manipulate your files, this is really not anymore effective against the determined intruder than the lock on your house door is against a burglar. The best that Athena can offer to keep data private is the crypt command. This allows you to encrypt a file using a key you specify so that even if someone does read the file, they will see only gibberish. This, however, doesn't protect against malicious deletion or overwritting. The final word must be that if you have data that MUST be private and that you cannot stand to lose, don't keep it on Athena.