أساسيات الصلاحيات

Written Explanation

Three permissions

For each file or folder, the system records whether certain people may do three things:

The GNU chmod documentation says that x on a directory means permission to search it. That is the "enter" idea in plain words.

Three classes of people

Permissions are set separately for three classes:

• u: the user, meaning the owner of the file.
• g: the group the file belongs to. A group is a named set of accounts.
• o: others: everyone else.

The letter a means all three together.

Reading ls -l

$ ls -l
-rw-r--r--  1 ana  staff   42 Nov  3 10:15 notes.txt
-rwxr-xr-x  1 ana  staff   31 Nov  3 10:20 hello.sh
drwxr-xr-x  3 ana  staff   96 Nov  3 10:18 projects

The exact columns (and the group name) vary by system. Focus on the first column, which has ten characters:

- rw- r-- r--
| |   |   |
| |   |   +-- others: read only
| |   +------ group:  read only
| +---------- owner:  read and write
+------------ type:   - means a regular file, d means a folder

Each class gets three slots in the order r, w, x. A dash means "not allowed". So:

• notes.txt is -rw-r--r--. The owner can read and change it, and everyone else can read it. Nobody can execute it, which is right for a text file.
• hello.sh is -rwxr-xr-x. Everyone can read and run it, and only the owner can change it.
• projects starts with d: it is a folder, and it is enterable by all.

Why a script fails

You write a script, then try to run it by path:

$ ./hello.sh
bash: ./hello.sh: Permission denied

The wording can differ between shells. The file exists, but its permissions have no x (look at the first column: -rw-r--r--). The shell will not start a file that is not marked as executable. A file you create with an editor or with > normally starts without x, so this happens to nearly every beginner.

The fix: chmod

chmod ("change mode") changes permissions. Its symbolic form is: who, then + or - or =, then what.

$ chmod +x hello.sh
$ ls -l hello.sh
-rwxr-xr-x  1 ana  staff   31 Nov  3 10:20 hello.sh
$ ./hello.sh
Hello from my script

• chmod +x file adds execute permission.
• chmod -x file takes it away.
• chmod u+x file adds it for the owner only. The GNU documentation explains that + adds to existing permissions without removing any, and that leaving out the class letters acts like a, except that bits set in your umask (a system setting for default permissions) are left alone. In practice, chmod +x and chmod u+x are enough for you.
• chmod u-w file would make a file read-only for its owner.

You can also write permissions as numbers. For example chmod 755 hello.sh and chmod 644 notes.txt are common. I did not verify the digit rules on a source in this session, so use the letter form until you learn them properly; the numbers add r=4, w=2, and x=1 for each class.

Why ./hello.sh?

If you type just hello.sh, the shell looks for a program with that name in every folder listed in PATH. The current folder is normally not on that list, so it will not be found, even though the file is right there. Writing ./hello.sh gives a path (. is the current folder, Lesson 2), so the shell skips the search. You can also add the folder to PATH (Lesson 5), but be careful about doing that for the current folder.

The first line of a script: the shebang

A script's first line can say which program should interpret it:

#!/bin/bash
echo "Hello from my script"

The #! followed by a program path is called a shebang. When you run the file as a program, the system uses that line to pick the interpreter. It only matters on Linux and macOS.

You can run a script with its interpreter named directly, bash hello.sh, and it usually works even without the execute permission, because the interpreter only needs to read the file. That is a workaround, not a replacement for knowing the permission rules.

Windows does it differently

Windows has no chmod and no x bit in the Unix sense. It uses access control lists to decide who can read, change, or run a file, and, as a rule, it decides whether a file is runnable from its extension. Microsoft's documentation notes the PATHEXT variable, which lists the extensions Windows treats as executable, such as .exe.

PowerShell adds one more rule: an execution policy. It controls whether PowerShell will run .ps1 script files. If scripts are blocked, you may see an error saying running scripts is disabled on this system, even though you did nothing wrong. You can look at the current setting with Get-ExecutionPolicy. Microsoft's documentation also mentions that a policy can be set for just the current session with Set-ExecutionPolicy and -Scope Process. Changing system or security settings can matter for your safety, so read Microsoft's documentation for about_Execution_Policies and ask your administrator if this is a work or school computer before changing it.

If you use Git Bash or WSL on Windows, the chmod behavior can depend on where the file is stored. Files in the Linux side of WSL follow the Linux rules, but files on the Windows disk may not honor chmod the same way. Test on your own system.

Other causes of "Permission denied"

The execute bit is the most common cause, but not the only one:

• No write permission. Writing into a read-only file, or deleting from a folder where you lack w.
• Someone else's file. A system file owned by another account, such as the administrator. Administrator tools such as sudo can override this, but do not use them just to silence an error until you understand what the command will change.

When you see the message, run ls -l on the file and on its folder, and read the permissions before changing anything.