Linux File System and Permissions

Introduction

In Linux every file and directory has read (r), write (w), execute (x) permissions for owner, group, and others. This model has been the foundation of Unix security since the 1970s.

The file system hierarchy is organized under a single root (/). ext4, XFS, and Btrfs are common file systems with different journaling and scaling features.

This guide covers permission notation, symbolic/octal chmod, chown, ACL, and setuid/setgid/sticky bit.

File System Structure

FHS defines purposes of /bin, /etc, /var, /home. /etc is configuration, /var is variable data, /home is user directories.

inode holds file metadata; the inode number not the filename is the file system's basic unit. Check inode exhaustion with df -i.

ext4: genel amaçlı, journaling
XFS: büyük dosyalar
Btrfs: snapshot, subvolume
tmpfs: RAM tabanlı geçici

ls -li /etc/passwd
df -hT
df -i

Basic Permission Model

ls -l shows -rw-r--r-- 1 user group 4096 date file. First char is type (-, d, l), next 9 are permissions.

For directories x means traverse; for files execute. r without x on a directory does not allow listing.

ls -l /var/log
chmod u+x script.sh
chmod 644 file.txt
chmod 755 directory/

chmod and chown

Symbolic chmod u+x, g-w, o=r and octal 755, 644 are equivalent. chown user:group file changes ownership; -R is recursive.

chgrp changes only group. Wrong chown in production breaks web server access; use carefully.

chmod 750 /var/www/app
chown -R www-data:www-data /var/www/app/static
chown deploy:www-data /var/www/app

Special Permissions

setuid (4): runs as file owner (e.g. passwd). setgid (2): as group. sticky bit (1): only owner deletes in dir (/tmp).

Octal 4755 means setuid + 755. Audit risky setuid binaries: find / -perm -4000.

chmod u+s /usr/bin/passwd
chmod 1777 /tmp
find / -perm -4000 -type f 2>/dev/null

ACL (Access Control Lists)

Traditional permissions limit you to one owner and one group. ACL defines extra user/group permissions: setfacl -m u:alice:rwx file.

getfacl file lists ACLs. default ACL on directories inherits to new files. + in ls -l indicates ACL.

Web dizinlerinde minimum izin prensibi uygulayın: dosyalar 644, dizinler 755, hassas config 600.

Practical Scenarios

Web server: static 755/644, app code owned by deploy user, socket www-data group. SSH key 600, authorized_keys 600.

Shared project dir: setgid + common group makes new files group-owned. Add individual access with ACL.

chmod 660 /run/uwsgi/app.sock
chgrp www-data /run/uwsgi/app.sock
setfacl -m g:developers:rwx /srv/project

Conclusion

Linux permissions look simple but production scenarios get complex. Learn octal notation, add flexibility with ACL, audit setuid binaries.

Manage permissions as code with automation (Ansible, cloud-init); avoid manual chmod mistakes.

Data Usage Notice