How do I list the effective file permission in Linux?

Question

i.e:

Suppose the directory permission is 700, and the file under the directory is 570

Then the effective permission of the file is 500

Is there such a command that lists the effective permission by recursively checking parent permissions?

Answer 1

There is no such command and no simple way to do it, especially as both the file and the directories might have ACLs set in addition to the traditional permissions making the effective file permissions more complex to compute and display. Moreover, your question assumes there is a single path to the file but symbolic links potentially presents in the path should be first resolved as their permissions do not matter, the file might also have multiple hard-links so might be reachable from another directory. The user might also be able to access it through a different path if either loopback/bind mounts are in place or the user is running in a chrooted environment.

In any case, what you can do is to impersonate a user and check if the file while accessed through a given path is readable, writable and/or executable by him/her.

Something like:

#!/bin/ksh
[[ $# != 2 ]] && { echo Usage $0 user file; exit ; }
dir=$(\cd $(dirname "$2");/bin/pwd)
file=$(basename "$2")
su $1 ksh -c '
cd $2 2>/dev/null || { echo "---" ; exit ; }
[[ -r "$3" ]] && p=r || p=-
[[ -w "$3" ]] && p=${p}w || p=${p}-
[[ -x "$3" ]] && p=${p}x || p=${p}-
printf "%s %s/%s\n" $p "$2" "$3"
' "$1" "$dir" "$file"

This will show the effective rights for the user on that particular file using the traditional rwx syntax. Note that this script might give false negative results if the user launching has not root privileges (or equivalent) and has no read access on the target directory.

Answer 2

This is not so very easy to solve. Especially, the "effective" file permissions (a concept which is in this context unknown to me) is not so easy to determine.

You can access a file if all the directories leading to it are "executable". If you know the file's names, you do not need read access.

(E. g., sometimes, I make home directories 710 in order to give x access to other members of the same group. So no one else sees what I have in my ~, but they can use it if I tell them what is there.)

If the question is about accessing an existing file, the answer is different from creating or removing a file. In the latter case, the parent directory of the file(-to-be) bust be writable.

OTOH, if I do not have the x of a directory in the file's path, I cannot even determine if the file exists, and thus also not which permissions the file has. You can argue that then the effective permission would be 0, but I don't find it sensible to tell something about file permissions when I don't even know if the file exists.

But if you want so, you take the mask of each directory, do & 0111, & the masks together, and if there is a 0 where a 1 should be, you put a 0 into the file's "effective permission".

For creating and removing, you determine the parent directory's effective permission and look if it is writable and executable.

So in a 700 directory, a 570 becomes 500.

Answer 3

The other answers are correct. However you can use a bash one-liner to list the permissions of the directory hierarchy. First change to the directory in question, and then run:

pushd .; while [ `pwd` != / ]; do ls -ld `pwd`; cd ..; done; popd

Answer 4

You can use namei with option -m or -l, and then do the calculation yourself.

$ namei -l /home/theuser/.ssh/authorized_keys
f: /home/theuser/.ssh/authorized_keys
dr-xr-xr-x root     root  /
drwxr-xr-x root     root  home
drwx------ theuser users theuser
drwxr-xr-x theuser users .ssh
-rw------- theuser users authorized_keys