Users, groups and permissions in Linux

This chapter follows Package management on Debian.

Linux is multi-user: the kernel checks UID, GID, and mode bits on almost every file access. Misconfigured ownership breaks web roots and SSH logins; understanding /etc/passwd, umask, and sudo prevents both “permission denied” loops and world-writable directories.

Users, groups, and identity files

Human and service accounts have numeric UIDs; groups have GIDs. /etc/passwd lists names, UIDs, home directories, and login shells. /etc/group lists group memberships. Password hashes live in /etc/shadow, readable only by root.

1
id
2
getent passwd www-data
3
groups

Debian services often run as dedicated users (www-data, postgres). Package maintainer scripts create those accounts on install.

rwx permissions and ownership

Each inode stores owner, group, and rwx for user, group, and others. Directories use x as search permission.

1
ls -l /var/www
2
chmod 640 secret.conf
3
chown root:www-data site.conf

Octal modes (755, 2750) encode the same bits; chmod u+s sets setuid on executables so they run with the file owner’s privileges—a powerful and risky pattern used sparingly (passwd, sudo).

umask and default creation modes

umask subtracts bits from the default 666 (files) or 777 (dirs) on create. A umask of 022 yields 644 files and 755 directories for many setups.

1
umask
2
touch demo.txt
3
ls -l demo.txt

Login sessions set umask in /etc/profile, /etc/login.defs, or user ~/.profile. Application umask overrides matter for uploaded files on servers.

setuid, setgid, and sticky bit

Audit unexpected setuid binaries: find / -perm -4000 -type f 2>/dev/null. Debian packages declare setuid in maintainer scripts; ad hoc copies are a red flag.

ACLs beyond owner-group-other

POSIX ACLs add fine-grained entries (setfacl, getfacl) on filesystems that support them (ext4, xfs with acl mount option). Useful for shared project trees without a single group.

Default ACLs on directories propagate to new files—handy for web teams; still prefer groups when simplicity suffices.

sudo and PAM

sudo runs commands as another user (usually root) with policy in /etc/sudoers and /etc/sudoers.d/. Use visudo to edit safely.

PAM (Pluggable Authentication Modules) stacks authentication for login, sudo, and services in /etc/pam.d/. SSH, desktop login, and su all pass through PAM modules (Unix, LDAP, 2FA modules).

macOS uses Open Directory and different defaults; BSD is similar conceptually with other file paths.

Kernel-level isolation—capabilities, namespaces, LSM—extends this model in Linux security primitives.

The next chapter is Linux security primitives.