UNIX File Protection Overview (cont.)

To change the "set user", "set group", or "sticky" modes, you need a fourth digit, with this encoding:

• 4000 set user
• 2000 set group
• 1000 sticky

For example, "chmod 4755 file" sets the permissions to 755 and enables "set user" mode (-rwsr-xr-x). Because many directories have "set group" mode and because it's easy to forget about this when using chmod, you cannot alter "set group" mode on a directory with the numeric syntax. You must use "chmod g+s dir" to enable "set group" mode or "chmod g-s dir" to disable it. The numeric syntax does change the "set group" mode on files. To give a directory the same permissions as /tmp, use "chmod 1777 dir". This sets read, write, and execute for all users and enables "sticky" mode.

CONTROLLING DEFAULT PERMISSIONS WITH UMASK
Whenever you create a new object, the system automatically sets the permissions in accordance with your "umask", an encoding of the access modes that you want the system to disable by default. The most common umask is 022, which turns off group write access and other write access. The permissions on new files default to 666 with the umask modes disabled. So if your umask is 022, your new files default to 644 (-rw-r--r--). New directories (and new executable files) default to 777 minus the umask, or 755 (drwxr-xr-x). To see your umask, type "umask" with no arguments. To change your umask type "umask num" where "num" is the sum of the access modes that you want disabled. For example, "umask 077" disables all access for group and other on any object you create from then on. Note that umask is inherited (like an environment variable) from the parent process. If you have several windows and change the umask in one of them, it does not affect the other windows. Furthermore, umask only modifies the system default. A program can explicitly set the access modes on a new file, overriding the umask.

SETTING THE GROUP OF AN OBJECT
When you create a new object, the system must assign a group to it. Since you can belong to several groups, the system assigns your "current group" to objects that you create. Your current group is set when you login. To display it, use the "id" command and note the "gid". To see all the groups you belong to, run the command "groups". You can change your current group to any other group that you belong to with the "newgrp" command. For example, "newgrp foo" changes your current group to "foo".

Note that if you create an object in a directory that has "set group" enabled, the object inherits the group of the directory rather than your current group, even if you are not a member of the directory's group.

You can change the group of an object with the "chgrp" command. Only the owner of an object (and superuser) can change its group and you can only chgrp an object to a group that you belong to. To set a file to group "foo", run "chgrp foo file". Note that changing the group of an object does not change its access modes. However, this does change which users now fall into the "group" and "other" categories with respect to the object.