Users and permissions
Users and groups
# Create a user, then add it to groups (copy another user's groups first)
sudo adduser newuser
groups olduser
sudo usermod -aG group1,group2 newuser
# Delete a user and its home directory
sudo deluser --remove-home olduser
sudo groupdel olduser
# Passwords
passwd # change your own
sudo passwd root # set root's password
sudo su - # switch to root with a login shell (- loads root's env)
Inspect users and groups:
id USER # uid, gid and group membership
groups USER # groups a user belongs to
who # active login sessions
w # active sessions plus what each is doing
compgen -u # list all users
compgen -g # list all groups
whoami reports the credentials of the current process; who/w report the
login-session table. They can differ, for example after sudo su -.
Permissions
A mode string like -rw-rw-r-- reads as: type, then owner / group / others,
each as r (read), w (write), x (execute).
| Octal | Permission | Symbolic |
|---|---|---|
| 0 | none | --- |
| 1 | execute | --x |
| 2 | write | -w- |
| 3 | write + execute | -wx |
| 4 | read | r-- |
| 5 | read + execute | r-x |
| 6 | read + write | rw- |
| 7 | read + write + execute | rwx |
touch creates files as 664 (-rw-rw-r--) by default.
sudo chown new-owner FILE # change owner
sudo chgrp group FILE # change group
chmod 770 DIR # rwx for owner and group, nothing for others
Fine-grained access with ACLs
When ownership and group bits are not enough, POSIX ACLs grant a specific user access without changing the file's owner or group:
setfacl -m u:postgres:r /root/service/backend/prod-oauth-postgresql.sql
getfacl /root/service/backend
Shared folder between two users
Give both users a common group and a group-writable, setgid directory so new files inherit the group:
sudo groupadd projectA
sudo mkdir /home/sharedFolder
sudo chgrp projectA /home/sharedFolder
sudo chmod 770 /home/sharedFolder # rwx owner + group, none for others
sudo chmod +s /home/sharedFolder # setgid: new files inherit the group
sudo usermod -aG projectA Bob
sudo usermod -aG projectA Alice
The setgid bit (chmod +s on a directory, or g+s) is what makes this work:
without it, files created in the shared folder keep the creator's primary group
and the other user cannot write them.