[{"data":1,"prerenderedAt":800},["ShallowReactive",2],{"mdc--g76kow-key":3,"mdc-ycg4fx-key":25,"mdc-2ushj0-key":128,"mdc--4eddsf-key":140,"mdc-g35l8l-key":270,"mdc--i5j2ji-key":478,"mdc-jwr35r-key":491,"mdc--bl18h4-key":621,"mdc--cdyfb6-key":720,"mdc-dcy65p-key":785},{"data":4,"body":5},{},{"type":6,"children":7},"root",[8],{"type":9,"tag":10,"props":11,"children":12},"element","p",{},[13,16,23],{"type":14,"value":15},"text","\"Permission denied\" is the error every beginner hits and most people learn to route around by typing ",{"type":9,"tag":17,"props":18,"children":20},"code",{"className":19},[],[21],{"type":14,"value":22},"sudo",{"type":14,"value":24}," until it works. That habit will eventually cost you something. Permissions are a small, entirely learnable system — about fifteen minutes of theory that pays off forever.",{"data":26,"body":27},{},{"type":6,"children":28},[29,42,62,74,116],{"type":9,"tag":30,"props":31,"children":33},"h2",{"id":32},"reading-the-output-of-ls-l",[34,36],{"type":14,"value":35},"Reading the output of ",{"type":9,"tag":17,"props":37,"children":39},{"className":38},[],[40],{"type":14,"value":41},"ls -l",{"type":9,"tag":10,"props":43,"children":44},{},[45,47,52,54,60],{"type":14,"value":46},"Run ",{"type":9,"tag":17,"props":48,"children":50},{"className":49},[],[51],{"type":14,"value":41},{"type":14,"value":53}," and every line starts with something like ",{"type":9,"tag":17,"props":55,"children":57},{"className":56},[],[58],{"type":14,"value":59},"-rw-r--r--",{"type":14,"value":61},". That string is the whole permission model:",{"type":9,"tag":63,"props":64,"children":68},"pre",{"className":65,"code":67,"language":14},[66],"language-text","-rw-r--r--  1  nizar  staff  1024  Aug 19 09:14  notes.txt\n│└┬┘└┬┘└┬┘     │      │\n│ │  │  │      │      └── group that owns it\n│ │  │  │      └───────── user that owns it\n│ │  │  └── others: everyone else\n│ │  └───── group members\n│ └──────── owner\n└────────── type: - is a file, d is a directory, l is a link\n",[69],{"type":9,"tag":17,"props":70,"children":72},{"__ignoreMap":71},"",[73],{"type":14,"value":67},{"type":9,"tag":10,"props":75,"children":76},{},[77,79,85,87,93,95,100,102,107,109,114],{"type":14,"value":78},"After the type character, there are ",{"type":9,"tag":80,"props":81,"children":82},"strong",{},[83],{"type":14,"value":84},"three groups of three",{"type":14,"value":86},". Each group is read-write-execute (",{"type":9,"tag":17,"props":88,"children":90},{"className":89},[],[91],{"type":14,"value":92},"rwx",{"type":14,"value":94},") for one class of user: the ",{"type":9,"tag":80,"props":96,"children":97},{},[98],{"type":14,"value":99},"owner",{"type":14,"value":101},", the ",{"type":9,"tag":80,"props":103,"children":104},{},[105],{"type":14,"value":106},"group",{"type":14,"value":108},", and ",{"type":9,"tag":80,"props":110,"children":111},{},[112],{"type":14,"value":113},"everyone else",{"type":14,"value":115},". A dash means that permission is absent.",{"type":9,"tag":10,"props":117,"children":118},{},[119,121,126],{"type":14,"value":120},"So ",{"type":9,"tag":17,"props":122,"children":124},{"className":123},[],[125],{"type":14,"value":59},{"type":14,"value":127}," reads as: it's a regular file; the owner can read and write it; the group can only read it; everyone else can only read it. Nobody can execute it.",{"data":129,"body":130},{},{"type":6,"children":131},[132],{"type":9,"tag":133,"props":134,"children":139},"quiz",{":answer":135,":options":136,"explanation":137,"question":138},"0","[\"The owner and members of the group\",\"Only the owner\",\"Everyone\",\"Nobody, because there is no execute bit set\"]","Owner has rwx, group has r-x (read and execute, no write), and others have --- (nothing at all). So owner and group can run it; everyone else can't even read it.","A file shows `-rwxr-x---`. Who can execute it?",[],{"data":141,"body":142},{},{"type":6,"children":143},[144,150,162,232,251],{"type":9,"tag":30,"props":145,"children":147},{"id":146},"what-the-bits-mean-for-directories",[148],{"type":14,"value":149},"What the bits mean for directories",{"type":9,"tag":10,"props":151,"children":152},{},[153,155,160],{"type":14,"value":154},"This is where the model surprises people, because ",{"type":9,"tag":17,"props":156,"children":158},{"className":157},[],[159],{"type":14,"value":92},{"type":14,"value":161}," means something different on a directory:",{"type":9,"tag":163,"props":164,"children":165},"ul",{},[166,189,203],{"type":9,"tag":167,"props":168,"children":169},"li",{},[170,179,181,187],{"type":9,"tag":80,"props":171,"children":172},{},[173],{"type":9,"tag":17,"props":174,"children":176},{"className":175},[],[177],{"type":14,"value":178},"r",{"type":14,"value":180}," — you can list the contents (",{"type":9,"tag":17,"props":182,"children":184},{"className":183},[],[185],{"type":14,"value":186},"ls",{"type":14,"value":188}," works)",{"type":9,"tag":167,"props":190,"children":191},{},[192,201],{"type":9,"tag":80,"props":193,"children":194},{},[195],{"type":9,"tag":17,"props":196,"children":198},{"className":197},[],[199],{"type":14,"value":200},"w",{"type":14,"value":202}," — you can create and delete entries inside it",{"type":9,"tag":167,"props":204,"children":205},{},[206,215,217,223,225,231],{"type":9,"tag":80,"props":207,"children":208},{},[209],{"type":9,"tag":17,"props":210,"children":212},{"className":211},[],[213],{"type":14,"value":214},"x",{"type":14,"value":216}," — you can ",{"type":9,"tag":218,"props":219,"children":220},"em",{},[221],{"type":14,"value":222},"enter",{"type":14,"value":224}," it and access things through it (",{"type":9,"tag":17,"props":226,"children":228},{"className":227},[],[229],{"type":14,"value":230},"cd",{"type":14,"value":188},{"type":9,"tag":10,"props":233,"children":234},{},[235,237,242,244,249],{"type":14,"value":236},"The important consequence: ",{"type":9,"tag":17,"props":238,"children":240},{"className":239},[],[241],{"type":14,"value":200},{"type":14,"value":243}," on a directory lets you delete files inside it ",{"type":9,"tag":80,"props":245,"children":246},{},[247],{"type":14,"value":248},"even if you can't write to those files",{"type":14,"value":250},". Deleting a file is modifying its directory, not modifying the file. That's how a read-only file in a writable folder can still disappear.",{"type":9,"tag":10,"props":252,"children":253},{},[254,256,261,263,268],{"type":14,"value":255},"And a directory without ",{"type":9,"tag":17,"props":257,"children":259},{"className":258},[],[260],{"type":14,"value":214},{"type":14,"value":262}," is effectively sealed — you can't ",{"type":9,"tag":17,"props":264,"children":266},{"className":265},[],[267],{"type":14,"value":230},{"type":14,"value":269}," into it or reach anything inside, even if you know the exact path.",{"data":271,"body":272},{},{"type":6,"children":273},[274,280,308,341,346,430,435],{"type":9,"tag":30,"props":275,"children":277},{"id":276},"the-numbers",[278],{"type":14,"value":279},"The numbers",{"type":9,"tag":10,"props":281,"children":282},{},[283,285,291,293,299,300,306],{"type":14,"value":284},"You'll see permissions written as three digits: ",{"type":9,"tag":17,"props":286,"children":288},{"className":287},[],[289],{"type":14,"value":290},"644",{"type":14,"value":292},", ",{"type":9,"tag":17,"props":294,"children":296},{"className":295},[],[297],{"type":14,"value":298},"755",{"type":14,"value":292},{"type":9,"tag":17,"props":301,"children":303},{"className":302},[],[304],{"type":14,"value":305},"600",{"type":14,"value":307},". Each digit is one class (owner, group, others), and each is a sum:",{"type":9,"tag":163,"props":309,"children":310},{},[311,321,331],{"type":9,"tag":167,"props":312,"children":313},{},[314,316],{"type":14,"value":315},"read = ",{"type":9,"tag":80,"props":317,"children":318},{},[319],{"type":14,"value":320},"4",{"type":9,"tag":167,"props":322,"children":323},{},[324,326],{"type":14,"value":325},"write = ",{"type":9,"tag":80,"props":327,"children":328},{},[329],{"type":14,"value":330},"2",{"type":9,"tag":167,"props":332,"children":333},{},[334,336],{"type":14,"value":335},"execute = ",{"type":9,"tag":80,"props":337,"children":338},{},[339],{"type":14,"value":340},"1",{"type":9,"tag":10,"props":342,"children":343},{},[344],{"type":14,"value":345},"Add them for each class:",{"type":9,"tag":163,"props":347,"children":348},{},[349,365,382,399,415],{"type":9,"tag":167,"props":350,"children":351},{},[352,358,360],{"type":9,"tag":17,"props":353,"children":355},{"className":354},[],[356],{"type":14,"value":357},"7",{"type":14,"value":359}," = 4+2+1 = ",{"type":9,"tag":17,"props":361,"children":363},{"className":362},[],[364],{"type":14,"value":92},{"type":9,"tag":167,"props":366,"children":367},{},[368,374,376],{"type":9,"tag":17,"props":369,"children":371},{"className":370},[],[372],{"type":14,"value":373},"6",{"type":14,"value":375}," = 4+2 = ",{"type":9,"tag":17,"props":377,"children":379},{"className":378},[],[380],{"type":14,"value":381},"rw-",{"type":9,"tag":167,"props":383,"children":384},{},[385,391,393],{"type":9,"tag":17,"props":386,"children":388},{"className":387},[],[389],{"type":14,"value":390},"5",{"type":14,"value":392}," = 4+1 = ",{"type":9,"tag":17,"props":394,"children":396},{"className":395},[],[397],{"type":14,"value":398},"r-x",{"type":9,"tag":167,"props":400,"children":401},{},[402,407,409],{"type":9,"tag":17,"props":403,"children":405},{"className":404},[],[406],{"type":14,"value":320},{"type":14,"value":408}," = ",{"type":9,"tag":17,"props":410,"children":412},{"className":411},[],[413],{"type":14,"value":414},"r--",{"type":9,"tag":167,"props":416,"children":417},{},[418,423,424],{"type":9,"tag":17,"props":419,"children":421},{"className":420},[],[422],{"type":14,"value":135},{"type":14,"value":408},{"type":9,"tag":17,"props":425,"children":427},{"className":426},[],[428],{"type":14,"value":429},"---",{"type":9,"tag":10,"props":431,"children":432},{},[433],{"type":14,"value":434},"Which makes the two you'll see constantly decode cleanly:",{"type":9,"tag":163,"props":436,"children":437},{},[438,458],{"type":9,"tag":167,"props":439,"children":440},{},[441,449,450,456],{"type":9,"tag":80,"props":442,"children":443},{},[444],{"type":9,"tag":17,"props":445,"children":447},{"className":446},[],[448],{"type":14,"value":290},{"type":14,"value":408},{"type":9,"tag":17,"props":451,"children":453},{"className":452},[],[454],{"type":14,"value":455},"rw-r--r--",{"type":14,"value":457}," — owner edits, everyone reads. The normal state of a document or config file.",{"type":9,"tag":167,"props":459,"children":460},{},[461,469,470,476],{"type":9,"tag":80,"props":462,"children":463},{},[464],{"type":9,"tag":17,"props":465,"children":467},{"className":466},[],[468],{"type":14,"value":298},{"type":14,"value":408},{"type":9,"tag":17,"props":471,"children":473},{"className":472},[],[474],{"type":14,"value":475},"rwxr-xr-x",{"type":14,"value":477}," — owner edits, everyone reads and runs. The normal state of a program or a directory.",{"data":479,"body":480},{},{"type":6,"children":481},[482],{"type":9,"tag":483,"props":484,"children":490},"fill-blank",{":answer":485,"explanation":486,"hint":487,"placeholder":488,"prompt":489},"[600,\"600\"]","600 is `rw-------`. It's what you want on private keys and files holding secrets — and ssh will actually refuse to use a key that's more permissive than this.","Read is 4 and write is 2, and the other two classes get nothing.","e.g. 644","What three-digit number means \"owner can read and write, nobody else can do anything\"?",[],{"data":492,"body":493},{},{"type":6,"children":494},[495,501,512,521,526,535,594,612],{"type":9,"tag":30,"props":496,"children":498},{"id":497},"changing-them",[499],{"type":14,"value":500},"Changing them",{"type":9,"tag":10,"props":502,"children":503},{},[504,510],{"type":9,"tag":17,"props":505,"children":507},{"className":506},[],[508],{"type":14,"value":509},"chmod",{"type":14,"value":511}," changes permissions. It takes numbers:",{"type":9,"tag":63,"props":513,"children":516},{"className":514,"code":515,"language":14},[66],"chmod 644 notes.txt\nchmod 755 deploy.sh\n",[517],{"type":9,"tag":17,"props":518,"children":519},{"__ignoreMap":71},[520],{"type":14,"value":515},{"type":9,"tag":10,"props":522,"children":523},{},[524],{"type":14,"value":525},"…or symbols, which are easier when you want to change one thing without recalculating the whole set:",{"type":9,"tag":63,"props":527,"children":530},{"className":528,"code":529,"language":14},[66],"chmod +x deploy.sh      # add execute for everyone\nchmod u+x deploy.sh     # add execute for the user (owner) only\nchmod go-w notes.txt    # remove write from group and others\n",[531],{"type":9,"tag":17,"props":532,"children":533},{"__ignoreMap":71},[534],{"type":14,"value":529},{"type":9,"tag":10,"props":536,"children":537},{},[538,544,546,552,554,560,562,568,570,576,578,584,586,592],{"type":9,"tag":17,"props":539,"children":541},{"className":540},[],[542],{"type":14,"value":543},"u",{"type":14,"value":545}," is user/owner, ",{"type":9,"tag":17,"props":547,"children":549},{"className":548},[],[550],{"type":14,"value":551},"g",{"type":14,"value":553}," is group, ",{"type":9,"tag":17,"props":555,"children":557},{"className":556},[],[558],{"type":14,"value":559},"o",{"type":14,"value":561}," is others, ",{"type":9,"tag":17,"props":563,"children":565},{"className":564},[],[566],{"type":14,"value":567},"a",{"type":14,"value":569}," is all. ",{"type":9,"tag":17,"props":571,"children":573},{"className":572},[],[574],{"type":14,"value":575},"+",{"type":14,"value":577}," adds, ",{"type":9,"tag":17,"props":579,"children":581},{"className":580},[],[582],{"type":14,"value":583},"-",{"type":14,"value":585}," removes, ",{"type":9,"tag":17,"props":587,"children":589},{"className":588},[],[590],{"type":14,"value":591},"=",{"type":14,"value":593}," sets exactly.",{"type":9,"tag":10,"props":595,"children":596},{},[597,603,605,610],{"type":9,"tag":17,"props":598,"children":600},{"className":599},[],[601],{"type":14,"value":602},"chown",{"type":14,"value":604}," changes ownership, and generally needs ",{"type":9,"tag":17,"props":606,"children":608},{"className":607},[],[609],{"type":14,"value":22},{"type":14,"value":611}," because giving your files away (or taking someone else's) is a privileged act:",{"type":9,"tag":63,"props":613,"children":616},{"className":614,"code":615,"language":14},[66],"sudo chown nizar:staff notes.txt\n",[617],{"type":9,"tag":17,"props":618,"children":619},{"__ignoreMap":71},[620],{"type":14,"value":615},{"data":622,"body":623},{},{"type":6,"children":624},[625],{"type":9,"tag":626,"props":627,"children":629},"deep-dive",{"title":628},"Why a script you just wrote won't run",[630,651,670,679,692],{"type":9,"tag":10,"props":631,"children":632},{},[633,635,641,643,649],{"type":14,"value":634},"You write ",{"type":9,"tag":17,"props":636,"children":638},{"className":637},[],[639],{"type":14,"value":640},"deploy.sh",{"type":14,"value":642},", type ",{"type":9,"tag":17,"props":644,"children":646},{"className":645},[],[647],{"type":14,"value":648},"./deploy.sh",{"type":14,"value":650},", and get \"Permission denied\".",{"type":9,"tag":10,"props":652,"children":653},{},[654,656,661,663,668],{"type":14,"value":655},"Nothing is broken. Files are created without the execute bit — a sensible default, since most files aren't programs and you don't want anything that lands on your disk to be runnable. Your script is currently ",{"type":9,"tag":17,"props":657,"children":659},{"className":658},[],[660],{"type":14,"value":290},{"type":14,"value":662},", and running it requires ",{"type":9,"tag":17,"props":664,"children":666},{"className":665},[],[667],{"type":14,"value":214},{"type":14,"value":669},".",{"type":9,"tag":63,"props":671,"children":674},{"className":672,"code":673,"language":14},[66],"chmod +x deploy.sh\n./deploy.sh\n",[675],{"type":9,"tag":17,"props":676,"children":677},{"__ignoreMap":71},[678],{"type":14,"value":673},{"type":9,"tag":10,"props":680,"children":681},{},[682,684,690],{"type":14,"value":683},"This is also why downloaded binaries and installers so often come with a ",{"type":9,"tag":17,"props":685,"children":687},{"className":686},[],[688],{"type":14,"value":689},"chmod +x",{"type":14,"value":691}," step in their instructions.",{"type":9,"tag":10,"props":693,"children":694},{},[695,697,703,705,711,713,718],{"type":14,"value":696},"Note the ",{"type":9,"tag":17,"props":698,"children":700},{"className":699},[],[701],{"type":14,"value":702},"./",{"type":14,"value":704}," as well. Remember ",{"type":9,"tag":17,"props":706,"children":708},{"className":707},[],[709],{"type":14,"value":710},"PATH",{"type":14,"value":712}," from the first lesson — the shell only searches those directories, and your current directory isn't one of them. ",{"type":9,"tag":17,"props":714,"children":716},{"className":715},[],[717],{"type":14,"value":648},{"type":14,"value":719}," is you giving an explicit path instead of asking for a search.",{"data":721,"body":722},{},{"type":6,"children":723},[724,735,753,773],{"type":9,"tag":30,"props":725,"children":727},{"id":726},"on-sudo",[728,730],{"type":14,"value":729},"On ",{"type":9,"tag":17,"props":731,"children":733},{"className":732},[],[734],{"type":14,"value":22},{"type":9,"tag":10,"props":736,"children":737},{},[738,743,745,751],{"type":9,"tag":17,"props":739,"children":741},{"className":740},[],[742],{"type":14,"value":22},{"type":14,"value":744}," runs a single command as the superuser, which bypasses permission checks entirely. It exists for the cases that genuinely need it — installing packages, editing ",{"type":9,"tag":17,"props":746,"children":748},{"className":747},[],[749],{"type":14,"value":750},"/etc",{"type":14,"value":752},", managing services.",{"type":9,"tag":10,"props":754,"children":755},{},[756,758,764,766,771],{"type":14,"value":757},"Reaching for it whenever something is denied is a bad trade. It hides the actual problem (often a file owned by the wrong user, which stays wrong), and it turns small mistakes into system-wide ones — ",{"type":9,"tag":17,"props":759,"children":761},{"className":760},[],[762],{"type":14,"value":763},"rm -rf",{"type":14,"value":765}," as your own user can only destroy your own files, and the same command under ",{"type":9,"tag":17,"props":767,"children":769},{"className":768},[],[770],{"type":14,"value":22},{"type":14,"value":772}," has no such limit.",{"type":9,"tag":10,"props":774,"children":775},{},[776,778,783],{"type":14,"value":777},"When you hit \"Permission denied\", the useful first move is ",{"type":9,"tag":17,"props":779,"children":781},{"className":780},[],[782],{"type":14,"value":41},{"type":14,"value":784}," on the thing in question. Nine times out of ten the answer is visible immediately.",{"data":786,"body":787},{},{"type":6,"children":788},[789,795],{"type":9,"tag":133,"props":790,"children":794},{":answer":135,":options":791,"explanation":792,"question":793},"[\"Because deleting is controlled by write permission on the containing directory, not the file\",\"Because the owner always keeps delete rights\",\"Because read permission implies delete\"]","Deleting removes the file's entry from its directory — that's a modification of the directory. If you can write to the directory, you can remove entries from it regardless of the files' own permissions.","Why can you sometimes delete a file you have no write permission on?",[],{"type":9,"tag":10,"props":796,"children":797},{},[798],{"type":14,"value":799},"Next: processes — finding, watching, and stopping the things that are running.",1787908866327]