Bash: File Permissions
File permissions are critical for both Linux system administration and penetration testing. Understanding how to read, modify, and exploit permissions can mean the difference between user access and root access. This lesson covers everything from basic permissions to SUID exploitation.
What You'll Learn
- Reading file permissions
- Understanding users, groups, and others
- Numeric (octal) permission mode
- Symbolic permission mode
- chmod, chown, chgrp commands
- Special permissions (SUID, SGID, Sticky Bit)
- umask
- Privilege escalation opportunities
Linux Permission System
The Three Permission Types
r = Read (4) - View file contents or list directory
w = Write (2) - Modify file or create/delete in directory
x = Execute (1) - Run file as program or enter directory
The Three User Classes
u = User (Owner) - The file owner
g = Group - Users in the file's group
o = Others - Everyone else
Reading Permissions
ls -la Output
$ ls -la
-rw-r--r-- 1 user group 1234 Jan 15 10:30 file.txt
drwxr-xr-x 2 user group 4096 Jan 15 10:30 directory
-rwxr-xr-x 1 user group 8192 Jan 15 10:30 script.sh
Breaking Down: -rw-r--r--
Position: 0 1 2 3 4 5 6 7 8 9
Symbol: - r w - r - - r - -
│ └─┬─┘ └─┬─┘ └─┬─┘
│ │ │ │
Type ──────┘ │ │ │
User (owner) ───┘ │ │
Group ─────────────────┘ │
Others ────────────────────────┘
Position 0 - File Type:
- = Regular file
d = Directory
l = Symbolic link
b = Block device
c = Character device
p = Pipe
s = Socket
Positions 1-3 - User (Owner) permissions:
rwx = Read, Write, Execute
rw- = Read, Write, No Execute
r-- = Read only
--- = No permissions
Positions 4-6 - Group permissions
Positions 7-9 - Others permissions
Examples:
-rw-r--r-- file.txt
# Owner: read, write
# Group: read
# Others: read
drwxr-xr-x directory
# Owner: read, write, execute (enter)
# Group: read, execute
# Others: read, execute
-rwxr-xr-x script.sh
# Owner: read, write, execute (run)
# Group: read, execute
# Others: read, execute
-rw------- secrets.txt
# Owner: read, write
# Group: no access
# Others: no access
Numeric (Octal) Permissions
Permission Values
r = 4
w = 2
x = 1
- = 0
Add them up:
rwx = 4+2+1 = 7
rw- = 4+2+0 = 6
r-x = 4+0+1 = 5
r-- = 4+0+0 = 4
-wx = 0+2+1 = 3
-w- = 0+2+0 = 2
--x = 0+0+1 = 1
--- = 0+0+0 = 0
Three-digit Notation
chmod 755 file.sh
7 = rwx (owner)
5 = r-x (group)
5 = r-x (others)
Result: -rwxr-xr-x
Common Permissions:
777 = rwxrwxrwx Everyone can do everything (DANGEROUS!)
755 = rwxr-xr-x Owner full, others read/execute
644 = rw-r--r-- Owner read/write, others read only
600 = rw------- Owner read/write, no one else
700 = rwx------ Owner full access, no one else
666 = rw-rw-rw- Everyone read/write (BAD!)
chmod - Change Permissions
Numeric Mode
# Basic syntax
chmod MODE file
# Examples:
chmod 755 script.sh # rwxr-xr-x
chmod 644 file.txt # rw-r--r--
chmod 600 secret.key # rw-------
chmod 700 private.sh # rwx------
chmod 777 shared.txt # rwxrwxrwx (DANGEROUS!)
# Recursive
chmod -R 755 directory/
# Multiple files
chmod 644 *.txt
Symbolic Mode
Syntax: chmod [ugoa][+-=][rwx] file
Who:
u = user (owner)
g = group
o = others
a = all (ugo)
Operation:
+ = add permission
- = remove permission
= = set exact permission
Permission:
r = read
w = write
x = execute
Examples:
# Add execute for owner
chmod u+x script.sh
# Remove write for others
chmod o-w file.txt
# Add read for group
chmod g+r file.txt
# Set exact: owner rwx, group rx, others none
chmod u=rwx,g=rx,o= file.sh
# Add execute for all
chmod a+x script.sh
# Or: chmod +x script.sh
# Remove write for group and others
chmod go-w file.txt
# Add write for owner and group
chmod ug+w file.txt
# Remove all permissions for others
chmod o= file.txt
# Or: chmod o-rwx file.txt
chown - Change Ownership
Change Owner
# Change owner
sudo chown newuser file.txt
# Change owner recursively
sudo chown -R newuser directory/
# View current owner
ls -l file.txt
Change Owner and Group
# Change owner and group
sudo chown user:group file.txt
# Examples:
sudo chown root:root important.conf
sudo chown www-data:www-data /var/www/html/index.html
sudo chown user:users file.txt
chgrp - Change Group
# Change group
sudo chgrp newgroup file.txt
# Change group recursively
sudo chgrp -R developers project/
# Examples:
sudo chgrp www-data /var/www/html/
sudo chgrp users file.txt
Special Permissions
SUID (Set User ID)
Permission: 4000 or u+s
Symbol: s in user execute position
What it does: Execute file with owner's permissions
# Example: /usr/bin/passwd
-rwsr-xr-x 1 root root /usr/bin/passwd
# Lowercase 's' = SUID + execute
# Uppercase 'S' = SUID only, no execute
# When regular user runs passwd:
# They temporarily become 'root' to edit /etc/shadow
Set SUID:
chmod 4755 file
# Or:
chmod u+s file
Find SUID files:
find / -perm -4000 -type f 2>/dev/null
Privilege Escalation: SUID binaries owned by root are gold for privesc!
SGID (Set Group ID)
Permission: 2000 or g+s
Symbol: s in group execute position
What it does:
- On file: Execute with group permissions
- On directory: New files inherit directory's group
# Example: Shared directory
drwxrwsr-x 2 user developers shared/
# Files created in shared/ automatically belong to 'developers' group
Set SGID:
chmod 2755 directory
# Or:
chmod g+s directory
Find SGID files:
find / -perm -2000 -type f 2>/dev/null
Sticky Bit
Permission: 1000 or +t
Symbol: t in others execute position
What it does: On directory - only owner can delete files
# Example: /tmp
drwxrwxrwt 10 root root /tmp
# Anyone can create files in /tmp
# But only the owner can delete their files
Set Sticky Bit:
chmod 1777 /tmp
# Or:
chmod +t /tmp
Find sticky bit directories:
find / -perm -1000 -type d 2>/dev/null
umask - Default Permissions
What Is umask?
umask = Default permission mask
- Subtracts from default permissions
- Default file: 666 (rw-rw-rw-)
- Default directory: 777 (rwxrwxrwx)
Common umask Values
umask 0022
Directories: 777 - 022 = 755 (rwxr-xr-x)
Files: 666 - 022 = 644 (rw-r--r--)
umask 0077
Directories: 777 - 077 = 700 (rwx------)
Files: 666 - 077 = 600 (rw-------)
Check and Set umask
# View current umask
umask
# Set umask temporarily
umask 0022
# Set umask permanently
echo "umask 0022" >> ~/.bashrc
Practical Pentesting Scenarios
Scenario 1: Finding SUID Binaries
# Find all SUID binaries (privilege escalation check)
find / -perm -4000 -type f 2>/dev/null
# More detailed
find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null
# Find writable SUID binaries (jackpot!)
find / -perm -4000 -type f -writable 2>/dev/null
# Find SUID binaries owned by root
find / -uid 0 -perm -4000 -type f 2>/dev/null
GTFOBins: Check https://gtfobins.github.io/ for exploitation
Scenario 2: Finding Writable Directories
# Find world-writable directories
find / -type d -perm -002 2>/dev/null
# Find directories writable by current user
find / -type d -writable 2>/dev/null
# Find writable directories without sticky bit (can delete files!)
find / -type d -perm -002 ! -perm -1000 2>/dev/null
Scenario 3: Finding Writable Config Files
# Find writable /etc files
find /etc -type f -writable 2>/dev/null
# Find writable service files
find /etc/systemd/system -type f -writable 2>/dev/null
# Find writable cron jobs
find /etc/cron* -type f -writable 2>/dev/null
Scenario 4: Fixing Web Server Permissions
# Typical web server setup
sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html
sudo chmod 644 /var/www/html/*.html
# WordPress permissions
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
Scenario 5: Secure Private Keys
# SSH private key should be 600
chmod 600 ~/.ssh/id_rsa
# SSH directory should be 700
chmod 700 ~/.ssh
# Public key can be 644
chmod 644 ~/.ssh/id_rsa.pub
Privilege Escalation Checklist
When you gain access to a system, check:
# 1. SUID binaries
find / -perm -4000 -type f 2>/dev/null | xargs ls -la
# 2. SGID binaries
find / -perm -2000 -type f 2>/dev/null | xargs ls -la
# 3. Writable /etc files
find /etc -writable -type f 2>/dev/null
# 4. Writable service files
find /usr/lib/systemd/system -writable 2>/dev/null
# 5. Writable cron jobs
ls -la /etc/cron* 2>/dev/null
# 6. Capabilities (alternate to SUID)
getcap -r / 2>/dev/null
# 7. World-writable directories
find / -type d -perm -002 2>/dev/null
Practical Exercises
Exercise 1: Basic chmod
# Create file
touch testfile.txt
# View permissions
ls -l testfile.txt
# Change to 644 (rw-r--r--)
chmod 644 testfile.txt
# Change to 755 (rwxr-xr-x)
chmod 755 testfile.txt
# Verify
ls -l testfile.txt
Exercise 2: Symbolic Mode
# Create script
echo '#!/bin/bash' > script.sh
echo 'echo "Hello"' >> script.sh
# Add execute for owner
chmod u+x script.sh
# Run script
./script.sh
# Remove execute for others
chmod o-x script.sh
# Verify
ls -l script.sh
Exercise 3: Find SUID
# Find SUID binaries in /usr/bin
find /usr/bin -perm -4000 -type f 2>/dev/null
# Check /bin
find /bin -perm -4000 -type f 2>/dev/null
# Full system scan
find / -perm -4000 -type f 2>/dev/null | tee suid_binaries.txt
Exercise 4: Directory Permissions
# Create shared directory
mkdir shared
chmod 777 shared
# Create file inside
touch shared/file.txt
# Who can delete this file?
# Answer: Anyone! (no sticky bit)
# Add sticky bit
chmod +t shared
# Now only the owner can delete files
Quick Reference
Permission Values:
r = 4, w = 2, x = 1
Common Numeric:
777 = rwxrwxrwx (all permissions)
755 = rwxr-xr-x (scripts, directories)
644 = rw-r--r-- (files)
600 = rw------- (private files)
700 = rwx------ (private scripts/dirs)
chmod Commands:
chmod 755 file # Numeric mode
chmod u+x file # Add execute for user
chmod go-w file # Remove write for group/others
chmod a+r file # Add read for all
chmod u=rwx,go=rx file # Set exact permissions
chown/chgrp:
sudo chown user file # Change owner
sudo chown user:group # Change owner and group
sudo chgrp group file # Change group only
Special Permissions:
chmod 4755 file # SUID
chmod 2755 dir # SGID
chmod 1777 dir # Sticky bit
chmod u+s file # SUID symbolic
chmod g+s dir # SGID symbolic
chmod +t dir # Sticky bit symbolic
Find Commands:
find / -perm -4000 # Find SUID
find / -perm -2000 # Find SGID
find / -perm -1000 # Find sticky bit
find / -writable # Find writable by me
Resources
Man Pages:
man chmod
man chown
man chgrp
man find
Online:
- GTFOBins: https://gtfobins.github.io/ (SUID exploitation)
- Linux Permissions: https://linuxcommand.org/lc3_lts0090.php
Next Steps
- Practice on test system - don't break production!
- Memorize common permissions (644, 755, 600, 700)
- Learn SUID exploitation with GTFOBins
- Always check permissions during privilege escalation
- Use symbolic mode when you want to add/remove without changing others
File permissions are fundamental to Linux security. Understand them deeply - they're your key to privilege escalation!
"chmod 777: The lazy admin's gift to pentesters."