< Previous | Index | Next > |
Chapter 5: File Permissions and Process Control
5.1 File system security (access rights)
In your linuxstuff directory, type
You will see that you now get lots of details about the contents of your directory, similar to the example below.
Each file (and directory) has associated access rights, which may be found
by typing ls -l
.
In the left-hand column is a 10 symbol string consisting of the symbols d, r, w, x, -, and, occasionally, s or S. If d is present, it will be at the left hand end of the string, and indicates a directory: otherwise "-" will be the starting symbol of the string.
The 9 remaining symbols indicate the permissions, or access rights, and are taken as three sets of 3.
- The left set of 3 gives the file permissions for the user that owns the file (or directory) (dhansen7 in the above example).
- the middle set of 3 gives the permissions for the group of people to whom the file (or directory) belongs (also dhansen7 in the above example). This group name may or may not be the same as the username. If the file is in your home directory, you are the only one who needs access to it and it is most likely the same. However, if you are working on files in a group (files found in the groups subdirectory of your home directory), the group name is most likely different, as everyone in your group needs to have access to those files. If you are working with other users on files in a group and one or more users of the group are unable to access certain files, it is most likely because this field is set incorrectly or because the group to which the file belongs is incorrect.
- The rightmost group gives the permissions for all others.
The symbols r, w, etc., have slightly different meanings depending on whether they refer to a simple file or to a directory.
Access rights on files.
- r (or -), indicates read permission (or otherwise), that is, the presence or absence of permission to read and copy the file
- w (or -), indicates write permission (or otherwise), that is, the permission (or otherwise) to change a file
- x (or -), indicates execution permission (or otherwise), that is, the permission to execute a file, where appropriate
Access rights on directories.
- r allows users to list files in the directory;
- w means that users may delete files from the directory or move files into it;
- x means the right to access files in the directory. This implies that you may read files in the directory provided you have read permission on the individual files.
So, in order to read a file, you must have execute permission on the directory containing that file, and hence on any directory containing that directory as a subdirectory, and so on, up the tree.
Some examples
-rwxrwxrwx |
a file that everyone can read, write and execute (and delete). |
-rw------- |
a file that only the owner can read and write - no-one else can read or write and no-one has execution rights (e.g. your mailbox file). |
5.2 Changing access rights
chmod (changing a file mode)
Only the owner of a file can use chmod
to change the permissions
of a file. The options of chmod
are as follows
Symbol | Meaning |
---|---|
u
|
user |
g
|
group |
o
|
other |
a
|
all |
r
|
read |
w
|
write (and delete) |
x
|
execute (and access directory) |
+
|
add permission |
-
|
take away permission |
For example, to remove read write and execute permissions on the file biglist for the group and others, type
This will leave the other permissions unaffected.
To give read and write permissions on the file biglist to all (this is generally a bad idea),
Exercise 5a
Try changing access permissions on the file science.txt and on the directory backups
Use ls -l
to check that the permissions have changed.
chown (changing the ownership of a file)
Just like chmod
, only the owner of a file can use chown
.
This command is used to change the ownership of a file or directory.
That is the user and group that owns a file can be changed. The format of the command is as follows:
So, if we wanted to change the owner of the file biglist to newuser and the group to newgroup we would do like so:
Also, a useful option when using chown on directories is the -R option. If -R is used, the new ownership will be applied to all files and subdirectories contained within the directory. Suppose that I have a folder named sharedgroup which is not accessible to the rest of my group, but I want the group to have access to everything in it. In order to give the rest of the group access, I could run
5.3 Processes and Jobs
A process is an executing program identified by a unique PID (process identifier). To see information about your processes, with their associated PID and status, type
A process may be in the foreground, in the background, or be suspended. In general the shell does not return the bash prompt until the current process has finished executing.
Some processes take a long time to run and hold up the terminal. Backgrounding a long process has the effect that the bash prompt is returned immediately, and other tasks can be carried out while the original process continues executing.
Running background processes
To background a process, type an & at the end of the command
line. For example, the command sleep
waits a given number of seconds
before continuing. Type
This will wait 10 seconds before returning the command prompt ($). Until the command prompt is returned, you can do nothing except wait.
To run sleep
in the background, type
[1] 6259
The & runs the job in the background and returns the prompt right away, allowing you run other programs while waiting for that one to finish.
The first line in the above example is typed in by the user; the next line, indicating job number and PID, is returned by the machine. The user is be notified of a job number (numbered from 1) enclosed in square brackets, together with a PID and is notified when a background process is finished. Backgrounding is useful for jobs which will take a long time to complete.
Backgrounding a current foreground process
At the prompt, type
You can suspend the process running in the foreground by holding down the [Ctrl]
key and typing [Z]
(written as ^Z) Then to put
it in the background, type
5.4 Listing suspended and background processes
When a process is running, backgrounded or suspended, it will be added to a list along with a job number. To examine this list, type
[1] Suspended sleep 100
[2] Running top
[3] Running nano
To resume (foreground) a suspended processes, type
For example, to resume sleep 100
, type
Typing fg
with no job number foregrounds the last suspended process.
5.5 Killing a process
kill (terminate or signal a process)
It is sometimes necessary to kill a process (for example, when an executing program is in an infinite loop)
To kill a job running in the foreground, type ^C ([Ctrl] [C]
).
For example, run
^C
To kill a suspended or background process, type
For example, run
$ jobs
If it is job number 4, type
To check whether this has worked, examine the job list again to see if the process has been removed.
ps (process status)
Alternatively, processes can be killed by finding their process numbers (PIDs)
and using kill PID_number
$ ps
PID TT S TIME COMMAND
20077 pts/5 S 0:05 sleep 100
21563 pts/5 T 0:00 top
21873 pts/5 S 0:25 nano
To kill off the process sleep 100
, type
and then type ps
again to see if it has been removed from the
list.
If a process refuses to be killed, use the -9 option, i.e. type
Summary
ls -lag |
list access rights for all files |
chmod [options] file |
change access rights for named file |
command & |
run command in background |
^C |
kill the job running in the foreground |
^Z |
suspend the job running in the foreground |
bg |
background the suspended job |
jobs |
list current jobs |
fg %1 |
foreground job number 1 |
kill %1 |
kill job number 1 |
ps |
list current processes |
kill 26152 |
kill process number 26152 |
< Previous | Index | Next > |