In this lesson, you will learn how the Linux kernel uses bitmasks to enforce security boundaries between users, groups, and the public.
At the heart of the POSIX security model is the idea that every file or directory on your system must answer three questions whenever a process attempts to access it: Who is asking? (User, Group, or World), and What are they trying to do? (Read, Write, or Execute).
The kernel represents these permissions using a 9-bit bitmask, often visualized as three sets of three bits (rwx):
- Owner (
u): The user who owns the file. - Group (
g): Members of the specific group assigned to the file. - Others (
o): Anyone else on the system ("the world").
Each position represents a specific capability. If the bit is set (represented by r, w, or x), the action is allowed. If it is a dash (-), the action is forbidden. For example, a file with the permission rw-r--r-- means:
- Owner: Can read and write.
- Group: Can only read.
- Others: Can only read.
You can inspect these masks using ls -l. When you see a string like -rwxr-xr--, the leading character denotes the file type, followed by the three sets of permissions:
# Example: Owner(rwx), Group(r-x), Others(r--)
-rwxr-xr-- 1 user group 4096 Jan 1 10:00 filename
The kernel checks these bits against the process's UID (User ID) and GID (Group ID). If your process's identity matches the file's owner bits, the kernel grants access accordingly. If you don't match the owner or group, it defaults to the "Others" bitmask. By carefully configuring these bits, you ensure that sensitive data remains isolated from unauthorized users while still allowing legitimate services to function. This is the fundamental mechanism that prevents one user from accidentally or maliciously modifying another user’s private files or system binaries.
Key Takeaway: POSIX permissions use a 9-bit mask to strictly enforce security by granting Read, Write, and Execute rights separately to the owner, the assigned group, and all other users.