Checking and Changing Unix File and Directory Protections


Unix was designed to be a completely open system.  However, it is now used
in many environments where such openness can be dangerous.  When a large
number of new users are on a system every semester, things can happen
accidentally.  You are responsible for protecting your files from 
willful or inadvertent misuse by anyone else.

Three possible file permissions are read, write, and execute.
Each of these permissions can be set for three groups, owner/user,
group, others.  File permissions are changed using the Unix chmod
command.  You can see what file permissions are by using the -l option
of the ls command.  The -a option of the ls command lists files and
directories that begin with '.'. E.g, the results of issuing the command
ls -al /usr/public/cop3530/swallace on January 13,1998 are given below.

  
total 18
drwxr-xr-x   2 swallace faculty      512 Jan  8 10:09 ./
drwxr-xr-x   6 116      faculty      512 Jan  4  1995 ../
-rw-r--r--   1 swallace faculty     3200 Jan  6 14:37 Pgm1
-rw-r--r--   1 swallace faculty      522 Jan  7 15:55 Pgm1.sample.data
-rw-r--r--   1 swallace faculty      865 Jan 13 12:46 class.notes
-rw-r--r--   1 swallace faculty     1914 Jan  7 14:31 que.asc
-rw-r--r--   1 swallace faculty     1700 Jan  7 14:31 que.res
-rw-r--r--   1 swallace faculty      971 Jan  6 15:03 redirect.howto
-rw-r--r--   1 swallace faculty     1022 Jan  6 15:02 sharfile.howto
-rw-r--r--   1 swallace faculty     4005 Jan  8 09:44 unix.commands


The 10 characters on the left show the file permissions and whether the
file is a directory or not.  (Unix treats subdirectories as files.)
The first two entries have a d in the first position showing they are
directories.  The next three characters show the permissions for the
user/owner (u), the next three characters show the current permissions for
the group (g), and the last three characters show the current permissions
for all others, (o).  That is, the user/owner (swallace) has read (r) and
write (w) permission on the file Pgm1.  The group and others have
only read permission.  Since assnmt1 is not an executable file, it
would make no sense for there to be execute permission. Only the
owner of a file can change its permissions.  If I wanted to limit access
to Pgm1, I could delete read permission for others by issuing the 
following command:

chmod o-r Pgm1

Then the file permissions would appear as:

-rw-r-----   1 swallace faculty     3200 Jan  6 14:37 Pgm1


chmod go+w assnmt1

would give both group and others write permission to assnmt1 (and they
then would have permission to alter, replace, and/or delete the file.)
The file permissions would then appear as (assuming both group and others
already had read permission):

-rw-rw-rw-   1 swallace faculty     3200 Jan  6 14:37 Pgm1

The system administrator recommends that you leave your home directory
permissions set as per the default.  Put any files that you want to keep
private in one or more subdirectories and remove read permission from 
those directories for group (g) and others (o).  

Protect yourself by keeping your class assignments in protected directories 
and taking unneeded printouts out of building 15 to discard.