{
    "content": [
        {
            "type": "text",
            "text": "# F (info)\n\n## Sections\n\n- **27 File permissions** (5 subsections)\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n"
        }
    ],
    "structuredContent": {
        "command": "F",
        "section": "",
        "mode": "info",
        "summary": null,
        "synopsis": null,
        "tldr_summary": null,
        "tldr_examples": [],
        "tldr_source": null,
        "flags": [],
        "examples": [],
        "see_also": [],
        "section_outline": [
            {
                "name": "27 File permissions",
                "lines": 14,
                "subsections": [
                    {
                        "name": "27.1 Structure of File Mode Bits",
                        "lines": 80
                    },
                    {
                        "name": "27.2 Symbolic Modes",
                        "lines": 263
                    },
                    {
                        "name": "27.3 Numeric Modes",
                        "lines": 55
                    },
                    {
                        "name": "27.4 Operator Numeric Modes",
                        "lines": 17
                    },
                    {
                        "name": "27.5 Directories and the Set-User-ID and Set-Group-ID Bits",
                        "lines": 62
                    }
                ]
            }
        ],
        "sections": {
            "27 File permissions": {
                "content": "Each file has a set of \"file mode bits\" that control the kinds of access\nthat users have to that file.  They can be represented either in\nsymbolic form or as an octal number.\n\n* Menu:\n\n* Mode Structure::              Structure of file mode bits.\n* Symbolic Modes::              Mnemonic representation of file mode bits.\n* Numeric Modes::               File mode bits as octal numbers.\n* Operator Numeric Modes::      ANDing, ORing, and setting modes octally.\n* Directory Setuid and Setgid:: Set-user-ID and set-group-ID on directories.\n\nFile: coreutils.info,  Node: Mode Structure,  Next: Symbolic Modes,  Up: File permissions\n",
                "subsections": [
                    {
                        "name": "27.1 Structure of File Mode Bits",
                        "content": "The file mode bits have two parts: the \"file permission bits\", which\ncontrol ordinary access to the file, and \"special mode bits\", which\naffect only some files.\n\nThere are three kinds of permissions that a user can have for a file:\n\n1. permission to read the file.  For directories, this means\npermission to list the contents of the directory.\n2. permission to write to (change) the file.  For directories, this\nmeans permission to create and remove files in the directory.\n3. permission to execute the file (run it as a program).  For\ndirectories, this means permission to access files in the\ndirectory.\n\nThere are three categories of users who may have different\npermissions to perform any of the above operations on a file:\n\n1. the file's owner;\n2. other users who are in the file's group;\n3. everyone else.\n\nFiles are given an owner and group when they are created.  Usually\nthe owner is the current user and the group is the group of the\ndirectory the file is in, but this varies with the operating system, the\nfile system the file is created on, and the way the file is created.\nYou can change the owner and group of a file by using the 'chown' and\n'chgrp' commands.\n\nIn addition to the three sets of three permissions listed above, the\nfile mode bits have three special components, which affect only\nexecutable files (programs) and, on most systems, directories:\n\nThe \"set-user-ID bit\" (\"setuid bit\").\nOn execution, set the process's effective user ID to that of the\nfile.  For directories on a few systems, give files created in the\ndirectory the same owner as the directory, no matter who creates\nthem, and set the set-user-ID bit of newly-created subdirectories.\n\nThe \"set-group-ID bit\" (\"setgid bit\").\nOn execution, set the process's effective group ID to that of the\nfile.  For directories on most systems, give files created in the\ndirectory the same group as the directory, no matter what group the\nuser who creates them is in, and set the set-group-ID bit of\nnewly-created subdirectories.\n\nThe \"restricted deletion flag\" or \"sticky bit\".\nPrevent unprivileged users from removing or renaming a file in a\ndirectory unless they own the file or the directory; this is\ncommonly found on world-writable directories like '/tmp'.  For\nregular files on some older systems, save the program's text image\non the swap device so it will load more quickly when run, so that\nthe image is \"sticky\".\n\nIn addition to the file mode bits listed above, there may be file\nattributes specific to the file system, e.g., access control lists\n(ACLs), whether a file is compressed, whether a file can be modified\n(immutability), and whether a file can be dumped.  These are usually set\nusing programs specific to the file system.  For example:\n\next2\nOn GNU and GNU/Linux the file attributes specific to the ext2 file\nsystem are set using 'chattr'.\n\nFFS\nOn FreeBSD the file flags specific to the FFS file system are set\nusing 'chflags'.\n\nEven if a file's mode bits allow an operation on that file, that\noperation may still fail, because:\n\n* the file-system-specific attributes or flags do not permit it; or\n\n* the file system is mounted as read-only.\n\nFor example, if the immutable attribute is set on a file, it cannot\nbe modified, regardless of the fact that you may have just run 'chmod\na+w FILE'.\n\nFile: coreutils.info,  Node: Symbolic Modes,  Next: Numeric Modes,  Prev: Mode Structure,  Up: File permissions\n"
                    },
                    {
                        "name": "27.2 Symbolic Modes",
                        "content": "\"Symbolic modes\" represent changes to files' mode bits as operations on\nsingle-character symbols.  They allow you to modify either all or\nselected parts of files' mode bits, optionally based on their previous\nvalues, and perhaps on the current 'umask' as well (*note Umask and\nProtection::).\n\nThe format of symbolic modes is:\n\n[ugoa...][-+=]PERMS...[,...]\n\nwhere PERMS is either zero or more letters from the set 'rwxXst', or a\nsingle letter from the set 'ugo'.\n\nThe following sections describe the operators and other details of\nsymbolic modes.\n\n* Menu:\n\n* Setting Permissions::          Basic operations on permissions.\n* Copying Permissions::          Copying existing permissions.\n* Changing Special Mode Bits::   Special mode bits.\n* Conditional Executability::    Conditionally affecting executability.\n* Multiple Changes::             Making multiple changes.\n* Umask and Protection::              The effect of the umask.\n\nFile: coreutils.info,  Node: Setting Permissions,  Next: Copying Permissions,  Up: Symbolic Modes\n\n\nThe basic symbolic operations on a file's permissions are adding,\nremoving, and setting the permission that certain users have to read,\nwrite, and execute or search the file.  These operations have the\nfollowing format:\n\nUSERS OPERATION PERMISSIONS\n\nThe spaces between the three parts above are shown for readability only;\nsymbolic modes cannot contain spaces.\n\nThe USERS part tells which users' access to the file is changed.  It\nconsists of one or more of the following letters (or it can be empty;\n*note Umask and Protection::, for a description of what happens then).\nWhen more than one of these letters is given, the order that they are in\ndoes not matter.\n\n'u'\nthe user who owns the file;\n'g'\nother users who are in the file's group;\n'o'\nall other users;\n'a'\nall users; the same as 'ugo'.\n\nThe OPERATION part tells how to change the affected users' access to\nthe file, and is one of the following symbols:\n\n'+'\nto add the PERMISSIONS to whatever permissions the USERS already\nhave for the file;\n'-'\nto remove the PERMISSIONS from whatever permissions the USERS\nalready have for the file;\n'='\nto make the PERMISSIONS the only permissions that the USERS have\nfor the file.\n\nThe PERMISSIONS part tells what kind of access to the file should be\nchanged; it is normally zero or more of the following letters.  As with\nthe USERS part, the order does not matter when more than one letter is\ngiven.  Omitting the PERMISSIONS part is useful only with the '='\noperation, where it gives the specified USERS no access at all to the\nfile.\n\n'r'\nthe permission the USERS have to read the file;\n'w'\nthe permission the USERS have to write to the file;\n'x'\nthe permission the USERS have to execute the file, or search it if\nit is a directory.\n\nFor example, to give everyone permission to read and write a regular\nfile, but not to execute it, use:\n\na=rw\n\nTo remove write permission for all users other than the file's owner,\nuse:\n\ngo-w\n\nThe above command does not affect the access that the owner of the file\nhas to it, nor does it affect whether other users can read or execute\nthe file.\n\nTo give everyone except a file's owner no permission to do anything\nwith that file, use the mode below.  Other users could still remove the\nfile, if they have write permission on the directory it is in.\n\ngo=\n\nAnother way to specify the same thing is:\n\nog-rwx\n\nFile: coreutils.info,  Node: Copying Permissions,  Next: Changing Special Mode Bits,  Prev: Setting Permissions,  Up: Symbolic Modes\n\n\nYou can base a file's permissions on its existing permissions.  To do\nthis, instead of using a series of 'r', 'w', or 'x' letters after the\noperator, you use the letter 'u', 'g', or 'o'.  For example, the mode\n\no+g\n\nadds the permissions for users who are in a file's group to the\npermissions that other users have for the file.  Thus, if the file\nstarted out as mode 664 ('rw-rw-r--'), the above mode would change it to\nmode 666 ('rw-rw-rw-').  If the file had started out as mode 741\n('rwxr----x'), the above mode would change it to mode 745 ('rwxr--r-x').\nThe '-' and '=' operations work analogously.\n\nFile: coreutils.info,  Node: Changing Special Mode Bits,  Next: Conditional Executability,  Prev: Copying Permissions,  Up: Symbolic Modes\n\n\nIn addition to changing a file's read, write, and execute/search\npermissions, you can change its special mode bits.  *Note Mode\nStructure::, for a summary of these special mode bits.\n\nTo change the file mode bits to set the user ID on execution, use 'u'\nin the USERS part of the symbolic mode and 's' in the PERMISSIONS part.\n\nTo change the file mode bits to set the group ID on execution, use\n'g' in the USERS part of the symbolic mode and 's' in the PERMISSIONS\npart.\n\nTo set both user and group ID on execution, omit the USERS part of\nthe symbolic mode (or use 'a') and use 's' in the PERMISSIONS part.\n\nTo change the file mode bits to set the restricted deletion flag or\nsticky bit, omit the USERS part of the symbolic mode (or use 'a') and\nuse 't' in the PERMISSIONS part.\n\nFor example, to set the set-user-ID mode bit of a program, you can\nuse the mode:\n\nu+s\n\nTo remove both set-user-ID and set-group-ID mode bits from it, you\ncan use the mode:\n\na-s\n\nTo set the restricted deletion flag or sticky bit, you can use the\nmode:\n\n+t\n\nThe combination 'o+s' has no effect.  On GNU systems the combinations\n'u+t' and 'g+t' have no effect, and 'o+t' acts like plain '+t'.\n\nThe '=' operator is not very useful with special mode bits.  For\nexample, the mode:\n\no=t\n\ndoes set the restricted deletion flag or sticky bit, but it also removes\nall read, write, and execute/search permissions that users not in the\nfile's group might have had for it.\n\n*Note Directory Setuid and Setgid::, for additional rules concerning\nset-user-ID and set-group-ID bits and directories.\n\nFile: coreutils.info,  Node: Conditional Executability,  Next: Multiple Changes,  Prev: Changing Special Mode Bits,  Up: Symbolic Modes\n\n\nThere is one more special type of symbolic permission: if you use 'X'\ninstead of 'x', execute/search permission is affected only if the file\nis a directory or already had execute permission.\n\nFor example, this mode:\n\na+X\n\ngives all users permission to search directories, or to execute files if\nanyone could execute them before.\n\nFile: coreutils.info,  Node: Multiple Changes,  Next: Umask and Protection,  Prev: Conditional Executability,  Up: Symbolic Modes\n\n\nThe format of symbolic modes is actually more complex than described\nabove (*note Setting Permissions::).  It provides two ways to make\nmultiple changes to files' mode bits.\n\nThe first way is to specify multiple OPERATION and PERMISSIONS parts\nafter a USERS part in the symbolic mode.\n\nFor example, the mode:\n\nog+rX-w\n\ngives users other than the owner of the file read permission and, if it\nis a directory or if someone already had execute permission to it, gives\nthem execute/search permission; and it also denies them write permission\nto the file.  It does not affect the permission that the owner of the\nfile has for it.  The above mode is equivalent to the two modes:\n\nog+rX\nog-w\n\nThe second way to make multiple changes is to specify more than one\nsimple symbolic mode, separated by commas.  For example, the mode:\n\na+r,go-w\n\ngives everyone permission to read the file and removes write permission\non it for all users except its owner.  Another example:\n\nu=rwx,g=rx,o=\n\nsets all of the permission bits for the file explicitly.  (It gives\nusers who are not in the file's group no permission at all for it.)\n\nThe two methods can be combined.  The mode:\n\na+r,g+x-w\n\ngives all users permission to read the file, and gives users who are in\nthe file's group permission to execute/search it as well, but not\npermission to write to it.  The above mode could be written in several\ndifferent ways; another is:\n\nu+r,g+rx,o+r,g-w\n\nFile: coreutils.info,  Node: Umask and Protection,  Prev: Multiple Changes,  Up: Symbolic Modes\n\n\nIf the USERS part of a symbolic mode is omitted, it defaults to 'a'\n(affect all users), except that any permissions that are set in the\nsystem variable 'umask' are not affected.  The value of 'umask' can be\nset using the 'umask' command.  Its default value varies from system to\nsystem.\n\nOmitting the USERS part of a symbolic mode is generally not useful\nwith operations other than '+'.  It is useful with '+' because it allows\nyou to use 'umask' as an easily customizable protection against giving\naway more permission to files than you intended to.\n\nAs an example, if 'umask' has the value 2, which removes write\npermission for users who are not in the file's group, then the mode:\n\n+w\n\nadds permission to write to the file to its owner and to other users who\nare in the file's group, but not to other users.  In contrast, the\nmode:\n\na+w\n\nignores 'umask', and does give write permission for the file to all\nusers.\n\nFile: coreutils.info,  Node: Numeric Modes,  Next: Operator Numeric Modes,  Prev: Symbolic Modes,  Up: File permissions\n"
                    },
                    {
                        "name": "27.3 Numeric Modes",
                        "content": "As an alternative to giving a symbolic mode, you can give an octal (base\n8) number that represents the mode.\n\nThe permissions granted to the user, to other users in the file's\ngroup, and to other users not in the file's group each require three\nbits: one bit for read, one for write, and one for execute/search\npermission.  These three bits are represented as one octal digit; for\nexample, if all three are present, the resulting 111 (in binary) is\nrepresented as the digit 7 (in octal).  The three special mode bits also\nrequire one bit each, and they are as a group represented as another\noctal digit.  Here is how the bits are arranged, starting with the\nhighest valued bit:\n\nValue in  Corresponding\nMode      Mode Bit\n\nSpecial mode bits:\n4000      Set user ID\n2000      Set group ID\n1000      Restricted deletion flag or sticky bit\n\nThe file's owner:\n400      Read\n200      Write\n100      Execute/search\n\nOther users in the file's group:\n40      Read\n20      Write\n10      Execute/search\n\nOther users not in the file's group:\n4      Read\n2      Write\n1      Execute/search\n\nFor example, numeric mode '4751' corresponds to symbolic mode\n'u=srwx,g=rx,o=x', and numeric mode '664' corresponds to symbolic mode\n'ug=rw,o=r'.  Numeric mode '0' corresponds to symbolic mode 'a='.\n\nA numeric mode is usually shorter than the corresponding symbolic\nmode, but it is limited in that normally it cannot take into account the\nprevious file mode bits; it can only set them absolutely.  The\nset-user-ID and set-group-ID bits of directories are an exception to\nthis general limitation.  *Note Directory Setuid and Setgid::.  Also,\noperator numeric modes can take previous file mode bits into account.\n*Note Operator Numeric Modes::.\n\nNumeric modes are always interpreted in octal; you do not have to add\na leading '0', as you do in C.  Mode '0055' is the same as mode '55'.\nHowever, modes of five digits or more, such as '00055', are sometimes\nspecial (*note Directory Setuid and Setgid::).\n\nFile: coreutils.info,  Node: Operator Numeric Modes,  Next: Directory Setuid and Setgid,  Prev: Numeric Modes,  Up: File permissions\n"
                    },
                    {
                        "name": "27.4 Operator Numeric Modes",
                        "content": "An operator numeric mode is a numeric mode that is prefixed by a '-',\n'+', or '=' operator, which has the same interpretation as in symbolic\nmodes.  For example, '+440' enables read permission for the file's owner\nand group, '-1' disables execute permission for other users, and '=600'\nclears all permissions except for enabling read-write permissions for\nthe file's owner.  Operator numeric modes can be combined with symbolic\nmodes by separating them with a comma; for example, '=0,u+r' clears all\npermissions except for enabling read permission for the file's owner.\n\nThe commands 'chmod =755 DIR' and 'chmod 755 DIR' differ in that the\nformer clears the directory DIR's setuid and setgid bits, whereas the\nlatter preserves them.  *Note Directory Setuid and Setgid::.\n\nOperator numeric modes are a GNU extension.\n\nFile: coreutils.info,  Node: Directory Setuid and Setgid,  Prev: Operator Numeric Modes,  Up: File permissions\n"
                    },
                    {
                        "name": "27.5 Directories and the Set-User-ID and Set-Group-ID Bits",
                        "content": "On most systems, if a directory's set-group-ID bit is set, newly created\nsubfiles inherit the same group as the directory, and newly created\nsubdirectories inherit the set-group-ID bit of the parent directory.  On\na few systems, a directory's set-user-ID bit has a similar effect on the\nownership of new subfiles and the set-user-ID bits of new\nsubdirectories.  These mechanisms let users share files more easily, by\nlessening the need to use 'chmod' or 'chown' to share new files.\n\nThese convenience mechanisms rely on the set-user-ID and set-group-ID\nbits of directories.  If commands like 'chmod' and 'mkdir' routinely\ncleared these bits on directories, the mechanisms would be less\nconvenient and it would be harder to share files.  Therefore, a command\nlike 'chmod' does not affect the set-user-ID or set-group-ID bits of a\ndirectory unless the user specifically mentions them in a symbolic mode,\nor uses an operator numeric mode such as '=755', or sets them in a\nnumeric mode, or clears them in a numeric mode that has five or more\noctal digits.  For example, on systems that support set-group-ID\ninheritance:\n\n# These commands leave the set-user-ID and\n# set-group-ID bits of the subdirectories alone,\n# so that they retain their default values.\nmkdir A B C\nchmod 755 A\nchmod 0755 B\nchmod u=rwx,go=rx C\nmkdir -m 755 D\nmkdir -m 0755 E\nmkdir -m u=rwx,go=rx F\n\nIf you want to try to set these bits, you must mention them\nexplicitly in the symbolic or numeric modes, e.g.:\n\n# These commands try to set the set-user-ID\n# and set-group-ID bits of the subdirectories.\nmkdir G\nchmod 6755 G\nchmod +6000 G\nchmod u=rwx,go=rx,a+s G\nmkdir -m 6755 H\nmkdir -m +6000 I\nmkdir -m u=rwx,go=rx,a+s J\n\nIf you want to try to clear these bits, you must mention them\nexplicitly in a symbolic mode, or use an operator numeric mode, or\nspecify a numeric mode with five or more octal digits, e.g.:\n\n# These commands try to clear the set-user-ID\n# and set-group-ID bits of the directory D.\nchmod a-s D\nchmod -6000 D\nchmod =755 D\nchmod 00755 D\n\nThis behavior is a GNU extension.  Portable scripts should not rely\non requests to set or clear these bits on directories, as POSIX allows\nimplementations to ignore these requests.  The GNU behavior with numeric\nmodes of four or fewer digits is intended for scripts portable to\nsystems that preserve these bits; the behavior with numeric modes of\nfive or more digits is for scripts portable to systems that do not\npreserve the bits.\n"
                    }
                ]
            }
        }
    }
}