5.1 System executable files

Let us take a look at how most system executable files are configured. Most of these files are in the folder /usr/bin. You can view the permissions of the folder using the following command:

To learn more about the ls (list) command, use the man pages.

The result of this command should be similar to the following:

This means that both the user (the first root) and group (the second root) owners are the root user.

The permissions are indicated by the first part of the line, drwxr-xr-x. When you read this, it should be separated into four parts:

• d
  This is the directory flag. A regular file uses a dash (-) in the place of the letter ‘d’.
• rwx
  The next three letters indicate the permissions granted to the user owner. ‘r’ means read, ‘w’ means write and ‘x’ means execute.
• r-x
  The next three letters indicate the permissions granted to the group owner. Since the user owner is a member of the group owner, this part is not useful. (Reminder: do not add other users to the root group!)
• r-x
  The last three letters indicate the permissions granted to any users other than the user owner or members of the group owner. In this case, it means that everyone can list contents of this folder, as well as access files in this folder.

The most important part here is the last three letters. In essence, it means that everyone can see the files in the directory /usr/bin, as well as access those files according to the permissions of those files. This is important, as most (if not all) users need to use the executable files in this directory.

It is also important to take a look at the permissions of files inside the directory. As an example, just look at those of a single file using the following command:

The result should be similar to the following:

As you can see, the permissions granted to “others” is also r-x. Since this is a regular file (the lack of d as the first letter), this means the file is readable and executable by all users.

Other than the root user, no user can add or remove files to the directory, or to modify the files in the directory.