Permissions

Linux was built for many people sharing one machine, which is exactly what a cluster is. Every file records who may read it, change it and run it. Permissions usually get in your way in one of two ways: a script you wrote refuses to run with Permission denied, or ssh rejects your key because its permissions are too open.

Reading ls -l

$ ls -l
total 56
-rw-r--r-- 1 kim kim    62 Sep 29 00:10 get-energy.sh
drwxr-xr-x 2 kim kim  4096 Sep 29 00:10 scripts
-rw-r--r-- 1 kim kim 48678 Sep 29 00:10 water.out

A first character of - means a regular file, d a directory, and l a symbolic link (a shortcut pointing to another file).

rwx for user, group and others

Read the nine permission characters in groups of three.

-  rwx  r-x  r-x
│   │    │    └─ o (other): everyone else
│   │    └────── g (group): members of the file's group
│   └─────────── u (user):  the owner
└─────────────── type

-rw-r--r-- means only the owner can change the file and everyone else can only read it. Whether a file can be deleted depends not on the file but on the w permission of the directory that holds it. Some system files cannot even be read.

$ cat /etc/shadow
cat: /etc/shadow: Permission denied

chmod

chmod (change mode) changes permissions. The most common case is making a script you wrote executable. New files do not get x, so they will not run as they are.

$ ./get-energy.sh water.out
bash: ./get-energy.sh: Permission denied
$ chmod +x get-energy.sh
$ ls -l get-energy.sh
-rwxr-xr-x 1 kim kim 62 Sep 29 00:10 get-energy.sh
$ ./get-energy.sh water.out
FINAL SINGLE POINT ENERGY       -76.321274411145

The ./ prefix is needed because of PATH (chapter 05): the shell does not look for commands in the current directory, so you give the path yourself. Passing the file to bash, as in bash get-energy.sh water.out, works without execute permission. Writing the script itself is covered in chapter 01 of the shell guide.

The symbolic form says who (u, g, o, or a for all) gets what added (+), removed (-) or set exactly (=).

Numeric modes: 755, 644, 600

Count r as 4, w as 2 and x as 1, and add them up for each group of three. You will see this form in documentation and error messages.

$ chmod 644 get-energy.sh; ls -l get-energy.sh
-rw-r--r-- 1 kim kim 62 Sep 29 00:10 get-energy.sh
$ chmod 755 get-energy.sh; ls -l get-energy.sh
-rwxr-xr-x 1 kim kim 62 Sep 29 00:10 get-energy.sh

Online advice sometimes suggests chmod -R 777 to make a permission problem go away. On a shared cluster that lets anyone modify or delete your files. Do not use it.

Why ssh keys must be 600

An ssh private key is as good as a password, and ssh will not use one that other users can read. This comes up when you copy a key over from /mnt/c in WSL or restore it from a backup.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/kim/.ssh/id_ed25519' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/kim/.ssh/id_ed25519": bad permissions

$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/id_ed25519
$ ls -l ~/.ssh
total 8
-rw------- 1 kim kim 399 Sep 29 00:10 id_ed25519
-rw-r--r-- 1 kim kim  92 Sep 29 00:10 id_ed25519.pub

The public key (.pub) is meant to be shared, so 644 is fine for it. Creating and using keys is covered in chapter 06.

Owners and groups

id or groups shows which groups you belong to. Some clusters create a group per lab or project and share a common directory through group permissions. Group names and where shared directories live vary from site to site.

$ id
uid=1000(kim) gid=1000(kim) groups=1000(kim),27(sudo)
$ chgrp mygroup results.csv      # change the file's group (only to a group you are in)
$ chmod g+r results.csv          # let group members read it

chown, which changes a file's owner, is reserved for the administrator. To hand files to someone else, let them copy the files themselves.

sudo and clusters

sudo runs a single command as the administrator (root). On your laptop or in WSL you use it to install software system-wide, as in sudo apt install tree, and it asks for the password you chose during setup.

umask

The default permissions of new files come from umask, whose value lists the bits to remove. With 022, files are created as 644 and directories as 755. Ubuntu desktops use 002, which gives 664 and 775, with group write permission.

$ umask
0022

You rarely need to change it unless you share files with a group on the cluster. To change it, add a line such as umask 027 to ~/.bashrc (chapter 05).