Sooner or later it you will need to change access to a file or directory for the user (owner), group or other users. Often permissions are removed to restrict who can update or even view a file. Conversely you may want to grant more permissions to a file to encourage collaboration by allowing more people to view and edit files. It is also not unusual for an application to require specific permissions as a prerequisite for installation.

There are two methods of changing file permissions: with the abbreviations and with the numbers. Both have been described above, so now we’ll look at a couple examples of changing permissions using the chmod command.

The following example will demonstrate how to change permissions for the user (u), group (g), or others (o) using the alpha designations (r, w, x) for the permissions preceded by a + to add the permission or a to remove the permission. Adding and removing permissions can be combined into a single command as we see below.

Using the chmod Command with Alpha Designations to Change File Permissions:

$ ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
$ chmod o+w declaration.txt
$ ls -l
total 12
-rw-rw-rw- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
$ chmod go-w declaration.txt
$ ls -l
total 12
-rw-r--r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt

The first example of the chmod command here adds write permission to the file declaration.txt for other users. We can see in the second ls –l the w indication in the second to last column of the permissions in the directory listing. This illustrates the typical format of the chmod command where you specify user (owner), group and/or other, + to add permissions or – to remove them and read, write and/or execute followed by the filename. Notice that there is not a space on either side of the + or – with the chmod command.

In the second example we revoke write from both the group and other users. This demonstrates that we can affect more than one level of permissions with a single chmod command. We see this change reflected in the permissions listed in the last ls listing.

The next example makes the same permission changes as the previous example, but this time numeric permission designations are used.
Using the chmod Command with Numeric Designations

$ ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
$ chmod 666 declaration.txt
$ ls -l
total 12
-rw-rw-rw- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
$ chmod 644 declaration.txt
$ ls -l
total 12
-rw-r--r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt

Here we see the 666 mode being used to indicate that read (designated as 4) and write (designated as 2) but not execute (designated as 1) are combined (4+2+0=6) to grant read and write permissions to user, group and other. We then used the 644 mode to change the permissions so the owner could still read and write, but the group and other could only read.

It can be quicker to modify multiple permissions using the numeric designations but they tend to be much harder to remember. Using the abbreviations you can also easily change the group permissions, for example, without affecting the user or other permissions. The –R (recursive) option is also available for the chmod command allowing you to modify permissions on a directory and its contents. This should be done with caution as it is easy to lock lots of people out of files and directories, including yourself.

These permissions have a special meaning when applied to directories. Next week I’ll go over how these differ from files.

Easy Linux CommandsFor more tips like this check out my book Easy Linux Commands, only $19.95 from Rampant TechPress.

Buy it now!


unix, linux, system administration, sysadmin, security, file security, permissions, owner, group

While digging for some details on the NLS language settings in Oracle today I came across a great FAQ on the topic right on Oracle’s site.

The FAQ includes such topics as:
NLS_LANG Parameter Fundamentals
Checking the current NLS_LANG Settings
How to setup the NLS_LANG Property for UNIX
Where to set the NLS_LANG in Windows
A Whole Pile of Other Frequently Asked Questions

Check out the NLS_LANG FAQ if you’re looking to learn about the NLS_LANG and associated settings or to find the answers to many common questions on these parameters.

oracle, dba, database administration, system administration, UNIX, Linux

As I mentioned in in a my post about file security every file and directory in Linux has an owner and a group associated with it. The need commonly arises where the user or group ownership for files or directories needs to be changed. For example, if user the sally, in group finance is responsible for a number of files and Sally gets transferred to the purchasing group the ownership of the files might need to be changed to marge because Marge is the user who is taking Sally’s place in finance. The chown command is used to change file or directory ownership.

As another example if a number of files that are currently accessed by the test group are ready for production and need to be changed to the prod group, the chgrp command can be used to give access to the prod group.

Actually the chown command can be used to change both user and group ownership, while the chgrp command can only be used to change group ownership. This command will be covered later in this chapter. When using either chown or chgrp commands, the system will first check the permissions of the user issuing the commands to make certain they have sufficient permissions to make the change.

Now we’ll look at some examples of how to use the chown and chgrp commands. We’ll start with the chgrp command, then look at chown and then finally see how chown can be used to do the work of both!

Change Group Ownership

The chgrp command is used to change the group with which a file is associated. The first thing you will need to provide this command is the group which you want to change the file or directory to. After that you can list a single file or directory to be changed or list separate entities separated by spaces. The chgrp command will not have any affect on the access granted to the group (the rw- in the middle of the three permissions sets) but will change who can use those permissions.

Using the chgrp Command on a File

# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark authors 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
# chgrp presidents gettysburg.txt
# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt

The chgrp command works the same for directories as it does for files. In the following example, the group ownership of the directory called examples will be changed. Directories are identified by the letter d in the first column of the ls –l display.

Using the chgrp Command on a Directory

# ls -l
total 4
-rw-rw-r-- 1 tclark tclark 0 Jan 13 21:13 example1.fil
-rw-rw-r-- 1 tclark tclark 0 Jan 13 21:13 example2.xxx
drwxrwxr-x 2 tclark tclark 4096 Jan 13 21:35 examples
# chgrp authors examples
# ls -l
total 4
-rw-rw-r-- 1 tclark tclark 0 Jan 13 21:13 example1.fil
-rw-rw-r-- 1 tclark tclark 0 Jan 13 21:13 example2.xxx
drwxrwxr-x 2 tclark authors 4096 Jan 13 21:35 examples

You can change the group for multiple files and/or directories by using the –R (recursive) option for the chgrp command. This is one of the few commands (we’ll see two of the others shortly) which use an upper-case R for the recursive option. When applied on a directory the –R option will apply the chgrp command to the directory and all its subdirectories and files. Care should be taken when using the –R option.

Next we’ll look at changing the ownership of files.

Change User Ownership

The chown (change owner) command can be used to change ownership of a file or directory. The syntax is very similar to chgrp.

# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark authors 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
# chown abe gettysburg.txt
# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 abe authors 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt

Just like with chgrp we see that chown accepts the username of the user who should get ownership and the file or directory to change. Again we could list multiple files or directories here with spaces separating them.

The chown command can be used to change the group ownership instead of the user ownership of a file or directory. If you wish to use chown to change the group ownership you can list a group preceded with either a colon (:) or a period (.). Here’s an example of how to use chown to change the group ownership of a file:

# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 abe authors 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
# chown :presidents gettys*
# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 abe presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt

If you wish to simultaneously change both the user and group ownership of a file you can specify the user and group in the format of user:group.

In the following example the user will be changed back to tclark and the group back to authors using a single command.

Using the chown Command to Change File Ownership

# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 abe presidents 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt
# chown tclark:authors gettys*
# ls -l
total 12
-rw-rw-r-- 1 tclark authors 2229 Jan 13 21:35 declaration.txt
-rw-rw-r-- 1 tclark authors 1310 Jan 13 17:48 gettysburg.txt
-rw-rw-r-- 1 tclark authors 360 Jan 13 17:48 preamble.txt

Here we see the user and group has been changed with a single command. Just like with chgrp the chown command will take the –R (recursive) option and apply the chown command to a directory and its subdirectories. This should be used with care.

Easy Linux CommandsFor more tips like this check out my book Easy Linux Commands, only $19.95 from Rampant TechPress.

Buy it now!


unix, linux, system administration, sysadmin, security, file security, permissions, owner, group

Linux file security is quite simplistic in design, yet quite effective in controlling access to files and directories.

Directories and the files which are stored in them are arranged in a hierarchical tree structure. Access can be controlled for both the files and the directories allowing a very flexible level of access.

File Security Model

In Linux, every file and every directory are owned by a single user on that system. Each file and directory also has a security group associated with it that has access rights to the file or directory. If a user is not the directory or file owner nor assigned to the security group for the file, that user is classified as other and may still have certain rights to access the file.

Each of the three file access categories, owner, group, and other, has a set of three access permissions associated with it. The access permissions are read, write, and execute.

A user may belong to more than one group. Regardless of how many groups a user belongs to if permissions are granted on a file or directory to one of the user’s groups they will have the granted level of access. You can check what groups a user belongs to with the groups command.

$ groups tclark
tclark : authors users

The groups command is called with one argument, the username you want to investigate. As you can see in the output above the output lists the username and all the groups they belong to. In this output tclark belongs to the groups authors and users.

From the information previously presented about file and directory commands, using the –l option with the ls command will display the file and directory permissions as well as the owner and group as demonstrated below:

Viewing permissions, owner and group


The ls –l command is the best way to view file and directory ownership and permissions. Now let’s look at what each of these permissions do.

File Permissions

File permissions are represented by positions two through ten of the ls –l display. The nine character positions consist of three groups of three characters. Each three character group indicates read (r), write (w), and execute (x) permissions.

The three groups indicate permissions for the owner, group, and other users respectively.

Breakdown of the permissions listing


In the example above, both the owner and the group have read (r) and write (w) permissions for the file, while other users have only read (r) permission.

The example below indicates read, write, and execute (rwx) permissions for the owner, read and execute (r-x) permissions for the group, and no permissions for other users (—).

Another permission listing breakdown


The alphabetic permission indicators are commonly assigned numeric values according to the scheme shown in the table below:

Alpha Numeric Permission
0 No permission granted
x 1 Execute permission granted
w 2 Write permission granted
r 4 Read permission granted

Then, each three character permission group can be assigned a number from zero to seven calculated by adding together the three individual numeric permissions granted. For example, if the owner has read, write, and execute permissions, the owner’s permissions can be represented by the single digit 7 (4+2+1). If the group has read and execute permissions, that can be represented by the single digit 5 (4+0+1). If other users have no permissions, that can be represented by the single digit 0 (0+0+0). These three numbers would then be listed in the order of owner, group, other, in this case 750 as a way to definitively describe the permissions on this file.

There are some additional abbreviations that can be used with commands that manipulate permissions. These abbreviations are:

  • u: user owner’s permissions
  • g: group’s permissions
  • o: other’s permissions

These abbreviations can also be used to change permissions on files. As we will see later, they will allow you to manipulate one level of the permissions (perhaps just the permissions granted to group) without changing the others.

Of course just being able to read these permissions isn’t enough… we want to be able to manipulate them. Stay tuned for more on that in the near future.

Easy Linux CommandsFor more tips like this check out my book Easy Linux Commands, only $19.95 from Rampant TechPress.

Buy it now!


unix, linux, system administration, sysadmin, hidden files, config files

Need to get hardware information on an IBM AIX server? On AIX 4.3.3 and later you can use the prtconf command.

$ prtconf

You don’t need to be root to use this command. The output includes model, serial number, processor type, number of processors, speed of processors, 32-bit or 64-bit, memory size, firmware version, network information, paging (swap) overview, volume information and a long list of available devices.

The prtconf command will only be there in AIX 4.3.3 and later but since it is just a shell script if you can find a copy of it you can easily see the commands it is calling to gather the information. The command seems to live in /usr/sbin/prtconf. If it’s not in your path you should be able to call it directly.

aix, unix, system administration, sysadmin, ibm

« Previous PageNext Page »