Permission Wizardry

0.1 The Story: The Digital Locksmith

Imagine you’re the security chief of a massive digital vault containing millions of valuable research files. Some files are public knowledge, others are confidential research data, and some are powerful tools that could cause damage if misused. You need a sophisticated lock system that can control exactly who can look at files, who can modify them, and who can execute programs.

In the Windows world, file security is often an afterthought – a simple “read-only” checkbox or sharing dialog. But in Unix HPC environments, you’re dealing with multi-user systems where hundreds of researchers share the same computers. Here, file permissions are your first line of defense and your key to collaborative success.

Today, you’ll become a digital locksmith, mastering the ancient Unix permission system that has protected files for over 50 years.

0.2 Understanding the Permission Landscape

0.2.1 The Three Realms of Access

Every file and directory in Unix has three types of users:

• Owner (u): The person who created the file (usually you)
• Group (g): People in the same research group or project
• Others (o): Everyone else on the system

Real-world analogy: Think of a laboratory where you have your personal desk (owner), your research team has access to shared equipment (group), and some areas are open to all visitors (others).

0.2.2 The Three Powers of Permission

For each realm, there are three types of access:

• Read (r): Can view the contents
• Write (w): Can modify or delete
• Execute (x): Can run the file as a program (or enter a directory)

Real-world analogy: It’s like having different keys: - Read key: Opens the display case (you can look but not touch) - Write key: Opens the editing room (you can make changes) - Execute key: Starts the machinery (you can run programs)

0.3 Decoding Permission Hieroglyphics

When you run ls -l, you see mysterious symbols like -rwxr-xr--. Let’s decode this ancient script:

ls -l example_file.txt
-rwxr-xr-- 1 username groupname 1024 Dec 15 10:30 example_file.txt

0.3.1 Breaking Down the Permission Code

-rwxr-xr--
│└┬┘└┬┘└┬┘
│ │  │  └── Others permissions (r--)
│ │  └───── Group permissions (r-x)
│ └──────── Owner permissions (rwx)
└─────────── File type (- = file, d = directory)

Translation: - Owner: Can read, write, and execute (rwx) - Group: Can read and execute, but not write (r-x) - Others: Can only read (r–)

Real-world analogy: It’s like a key card system where your card (owner) opens everything, your team’s cards (group) open most doors, and visitor cards (others) only open the lobby.

0.4 The Permission Calculator

0.4.1 Numeric Permission System

Unix also uses numbers to represent permissions, which is often faster for setting permissions:

• Read = 4
• Write = 2
  
• Execute = 1

You add these numbers together: - 7 = 4+2+1 = Read, Write, Execute (rwx) - 6 = 4+2 = Read, Write (rw-) - 5 = 4+1 = Read, Execute (r-x) - 4 = 4 = Read only (r–) - 0 = No permissions (—)

Common permission combinations: - 755: Owner can do everything, group and others can read and execute - 644: Owner can read and write, group and others can only read - 600: Only owner can read and write, others have no access - 777: Everyone can do everything (dangerous!)

Real-world analogy: It’s like having numbered security clearance levels – level 7 gives you full access, level 4 gives you viewing rights only.

0.5 The Permission Toolkit

0.5.1 Viewing Permissions

# See permissions for files in current directory
ls -l

# See permissions for specific file
ls -l important_file.txt

# See permissions for directories
ls -ld my_directory/

# See permissions recursively
ls -lR project_folder/

0.5.2 The Master Key: chmod

chmod (change mode) is your primary tool for setting permissions:

# Using numeric notation
chmod 755 script.sh          # rwxr-xr-x
chmod 644 data.txt           # rw-r--r--
chmod 600 secret.txt         # rw-------

# Using symbolic notation
chmod u+x script.sh          # Add execute for owner
chmod g-w data.txt           # Remove write for group
chmod o-r secret.txt         # Remove read for others
chmod a+r public.txt         # Add read for all (a = all)

0.5.3 Advanced chmod Patterns

# Set permissions for multiple files
chmod 644 *.txt              # All text files readable by all
chmod 755 *.sh               # All scripts executable

# Recursive permission changes
chmod -R 755 project_folder/ # Apply to folder and all contents

# Copy permissions from one file to another
chmod --reference=template.txt new_file.txt

0.6 Real-World HPC Permission Scenarios

0.6.1 Scenario 1: Setting Up a Research Project

#!/bin/bash
# setup_project_permissions.sh - Set up proper permissions for research project

PROJECT_DIR="experiment_2023"

# Create project structure
mkdir -p $PROJECT_DIR/{data,scripts,results,docs}

# Set directory permissions
chmod 755 $PROJECT_DIR                    # Everyone can enter and list
chmod 750 $PROJECT_DIR/{data,results}     # Only owner and group can access
chmod 755 $PROJECT_DIR/{scripts,docs}     # Scripts and docs are public

# Set default file permissions
touch $PROJECT_DIR/data/experiment.csv
chmod 640 $PROJECT_DIR/data/experiment.csv    # Group can read, others cannot

touch $PROJECT_DIR/scripts/analyze.py
chmod 754 $PROJECT_DIR/scripts/analyze.py     # Everyone can execute

touch $PROJECT_DIR/docs/README.txt
chmod 644 $PROJECT_DIR/docs/README.txt        # Everyone can read

echo "Project permissions set up successfully!"
ls -la $PROJECT_DIR/

0.6.2 Scenario 2: Securing Sensitive Data

#!/bin/bash
# secure_sensitive_data.sh - Lock down confidential research data

SENSITIVE_DIR="confidential_data"

# Create secure directory
mkdir -p $SENSITIVE_DIR
chmod 700 $SENSITIVE_DIR              # Only owner can access

# Move sensitive files and secure them
mv patient_data.csv $SENSITIVE_DIR/
mv preliminary_results.txt $SENSITIVE_DIR/

# Set strict permissions on sensitive files
chmod 600 $SENSITIVE_DIR/*            # Only owner can read/write

# Create a secure backup
tar -czf sensitive_backup_$(date +%Y%m%d).tar.gz $SENSITIVE_DIR/
chmod 600 sensitive_backup_*.tar.gz

echo "Sensitive data secured!"
echo "Directory permissions:"
ls -ld $SENSITIVE_DIR
echo "File permissions:"
ls -l $SENSITIVE_DIR/

0.6.3 Scenario 3: Collaborative Script Sharing

#!/bin/bash
# setup_shared_scripts.sh - Set up scripts for team collaboration

SCRIPTS_DIR="shared_scripts"
GROUP_NAME="research_team"

# Create shared directory
mkdir -p $SCRIPTS_DIR
chmod 775 $SCRIPTS_DIR                # Group can write, others can read

# Set group ownership (if you have permission)
chgrp $GROUP_NAME $SCRIPTS_DIR

# Process all Python scripts
for script in *.py; do
    if [ -f "$script" ]; then
        cp "$script" $SCRIPTS_DIR/
        chmod 754 $SCRIPTS_DIR/"$script"    # Group and others can execute
        chgrp $GROUP_NAME $SCRIPTS_DIR/"$script"
    fi
done

# Create a README with usage instructions
cat > $SCRIPTS_DIR/README.txt << EOF
Shared Scripts Directory
========================

These scripts are available for the entire research team.

Permissions:
- Team members can read and execute all scripts
- Only script owners can modify their scripts
- Others can execute but not modify

To add a new script:
1. Copy it to this directory
2. Set permissions: chmod 754 script_name.py
3. Set group: chgrp $GROUP_NAME script_name.py
EOF

chmod 644 $SCRIPTS_DIR/README.txt

echo "Shared scripts directory set up!"
ls -la $SCRIPTS_DIR/

0.7 Understanding Directory Permissions

Directories have special permission rules that often confuse newcomers:

0.7.1 Directory Permission Meanings

• Read (r): Can list the contents of the directory
• Write (w): Can create, delete, or rename files in the directory
• Execute (x): Can enter the directory (cd into it)

0.7.2 Important Directory Permission Combinations

# Common directory permissions
chmod 755 public_dir/         # Everyone can enter and list
chmod 750 team_dir/           # Only owner and group can access
chmod 700 private_dir/        # Only owner can access
chmod 555 read_only_dir/      # Everyone can enter and list, nobody can modify

0.7.3 The Directory Permission Trap

# This creates a weird situation:
chmod 644 weird_dir/          # Can list contents but can't enter!

# You need execute permission to enter a directory
ls weird_dir/                 # This works (can list)
cd weird_dir/                 # This fails! (can't enter)

# Fix it:
chmod 755 weird_dir/          # Now you can enter and list

Real-world analogy: It’s like having a glass door where you can see inside (read) but the door is locked (no execute), so you can’t actually enter the room.

0.8 Ownership Control: chown and chgrp

Sometimes you need to change who owns files or what group they belong to:

0.8.1 Changing Ownership

# Change owner (requires appropriate permissions)
chown newowner file.txt

# Change owner and group
chown newowner:newgroup file.txt

# Change only group
chgrp newgroup file.txt

# Recursive ownership changes
chown -R username:groupname project_folder/

0.8.2 Practical Ownership Scenarios

# Transfer project to new team lead
chown -R new_lead:research_team experiment_data/

# Make files accessible to web server
chown -R www-data:www-data web_files/

# Fix ownership after copying from another user
chown $(whoami):$(id -gn) copied_files/*

0.9 Special Permissions: The Advanced Techniques

0.9.1 The Sticky Bit

The sticky bit is used on directories to prevent users from deleting files they don’t own:

# Set sticky bit (often used on /tmp)
chmod +t shared_directory/
chmod 1755 shared_directory/      # Alternative notation

# Check for sticky bit (shows as 't' in permissions)
ls -ld shared_directory/
drwxr-xr-t 2 user group 4096 Dec 15 10:30 shared_directory/

Real-world analogy: It’s like a shared bulletin board where anyone can post notices, but only the person who posted a notice can remove it.

0.9.2 SetUID and SetGID

These advanced permissions allow programs to run with different privileges:

# SetUID - program runs as file owner
chmod u+s program
chmod 4755 program

# SetGID - program runs as file group
chmod g+s program
chmod 2755 program

Note: These are advanced features mainly used by system administrators. In HPC environments, you’ll rarely need to set these.

0.10 Permission Troubleshooting

0.10.1 Common Permission Problems

0.10.1.1 Problem 1: “Permission Denied” when running script

# Symptom: ./my_script.sh gives "Permission denied"
ls -l my_script.sh
-rw-r--r-- 1 user group 150 Dec 15 10:30 my_script.sh

# Solution: Add execute permission
chmod +x my_script.sh
# or
chmod 755 my_script.sh

0.10.1.2 Problem 2: Can’t modify file in shared directory

# Check directory permissions
ls -ld shared_folder/
drwxr-xr-x 2 otheruser group 4096 Dec 15 10:30 shared_folder/

# Problem: Directory doesn't have write permission for group
# Solution: 
chmod 775 shared_folder/

0.10.1.3 Problem 3: Others can see sensitive files

# Check current permissions
ls -l sensitive_data.txt
-rw-r--r-- 1 user group 1024 Dec 15 10:30 sensitive_data.txt

# Problem: Others can read the file
# Solution: Remove read permission for others
chmod 640 sensitive_data.txt
# or be more restrictive:
chmod 600 sensitive_data.txt

0.11 Security Best Practices for HPC

0.11.1 The Principle of Least Privilege

Give the minimum permissions necessary for the task:

# Good: Restrictive by default
chmod 600 new_file.txt        # Start restrictive
chmod g+r new_file.txt        # Add group read if needed

# Bad: Permissive by default
chmod 777 new_file.txt        # Everyone can do everything (dangerous!)

0.11.2 Regular Permission Audits

#!/bin/bash
# audit_permissions.sh - Check for potentially dangerous permissions

echo "Files with world-write permissions (dangerous):"
find . -type f -perm -002 -ls

echo -e "\nFiles with unusual permissions:"
find . -type f \( -perm -4000 -o -perm -2000 \) -ls

echo -e "\nDirectories accessible to everyone:"
find . -type d -perm -755 -ls

echo -e "\nFiles readable by everyone:"
find . -type f -perm -044 -ls

0.11.3 Safe Permission Defaults

# Set secure defaults for new files
umask 022                     # New files will be 644, directories 755

# Or more restrictive:
umask 077                     # New files will be 600, directories 700

# Add to your .bashrc to make it permanent
echo "umask 022" >> ~/.bashrc

0.12 Quick Reference: Permission Cheat Sheet

Task	Command	Example
View permissions	ls -l filename	ls -l script.sh
Set permissions (numeric)	chmod 755 file	chmod 644 data.txt
Add permission	chmod +x file	chmod u+w file.txt
Remove permission	chmod -w file	chmod o-r secret.txt
Recursive permissions	chmod -R 755 dir/	chmod -R 644 *.txt
Change owner	chown user file	chown alice data.txt
Change group	chgrp group file	chgrp team project/
Change both	chown user:group file	chown alice:team file.txt

0.12.1 Common Permission Patterns

Permission	Numeric	Use Case
rwx------	700	Private directories
rw-------	600	Private files
rwxr-xr-x	755	Public programs/directories
rw-r--r--	644	Public readable files
rwxrwx---	770	Team directories
rw-rw----	660	Team files

0.13 Practice Exercises

ImportantYour Permission Mastery Training

1. Create a secure project structure

   # Create directories with appropriate permissions:
   # - Public documentation (everyone can read)
   # - Team scripts (team can execute)
   # - Private data (only you can access)

2. Fix permission problems

   # Create files with wrong permissions and fix them:
   touch script.sh && chmod 644 script.sh  # Can't execute
   touch data.txt && chmod 777 data.txt    # Too permissive
   mkdir dir && chmod 644 dir               # Can't enter

3. Audit existing permissions

   # Check your home directory for:
   # - World-writable files (dangerous)
   # - Executable text files
   # - Directories you can't enter

4. Collaborative setup

   # Set up a shared directory where:
   # - Team members can add files
   # - Everyone can read files
   # - Only file owners can delete their files

0.14 What’s Next?

Now that you’re a permission wizard, you’re ready to learn SSH and Remote Access. Understanding permissions is crucial for secure remote connections to HPC systems, where you’ll need to manage access across multiple machines and users.

Remember: Permissions are the foundation of Unix security. In HPC environments where you’re sharing systems with many other researchers, proper permission management protects your work and enables effective collaboration. Master these concepts, and you’ll never accidentally expose sensitive data or lock yourself out of your own files.

TipPermission Mastery Challenge

Before moving on, try this security scenario: 1. Create a research project with different sensitivity levels 2. Set up proper permissions for team collaboration 3. Create a script that audits and reports permission issues 4. Practice fixing common permission problems

This mirrors real-world HPC security management!

---

You’ve mastered the ancient art of Unix permissions – the keys to the digital kingdom. Next, we’ll learn to use these skills across networks as we explore secure remote access to HPC systems!