Terminal Mastery-Users, Permissions and Administrative Privileges

05/10 Terminal Mastery
Have you ever tried to modify a file and received a message like this?

Permission denied

Or perhaps you've run a command and received:

Access is denied.

These messages aren't random errors. They're part of an important security mechanism used by operating systems to control who can access files, modify data, and execute programs.

Every modern operating system has an access control system.

Whether you're using Linux, macOS, or Windows, understanding users and permissions is essential for working confidently in the terminal.

In this article, we'll explore:

• Users and groups
• File ownership
• Read, write, and execute permissions
• chmod, chown, and chgrp
• sudo and root privileges
• Windows Administrator privileges
• PowerShell access control commands
• Practical security examples

Let's begin.

1. Understanding Users and Groups

Operating systems use user accounts to identify who is performing an action.

For example, a typical Linux or macOS system might have:

• A regular user account
• An administrator account
• A system account
• A root account

Windows has a similar concept, although its permission model is different.

Find Your Current User

First, let's identify which user is currently running our terminal.

Linux and macOS:

whoami

Windows PowerShell:

whoami

Windows CMD:

whoami

All three environments support whoami.

You might see something like:

hamed

On Windows, the output may include the computer name or domain:

DESKTOP-123\hamed

Find Your Groups

Users can belong to one or more groups.

Groups make permission management easier because administrators can assign access to a group instead of configuring every user individually.

Linux:

groups

To see more detailed identity information:

id

macOS:

groups

Or:

id

PowerShell:

whoami /groups

CMD:

whoami /groups

These commands help you understand which groups your current account belongs to.

2. Understanding Linux and macOS File Permissions

Linux and macOS use a permission model based on three primary permission categories:

Each category can have three basic permissions:

Let's inspect a file.

ls -l

You might see:

-rwxr-xr-- 1 hamed developers 1024 Nov 15 script.sh

Let's break down the permission string:

-rwxr-xr--

The first character represents the file type.

The remaining nine characters are divided into three groups:

- rwx r-x r--
  |   |   |
  |   |   └── Others
  |   └────── Group
  └────────── Owner

In this example:

• Owner: read, write, execute
• Group: read, execute
• Others: read only

This means the owner can modify and execute the file, group members can read and execute it, and other users can only read it.

File Permissions vs. Directory Permissions

An important detail:

Permissions have slightly different meanings for files and directories.

For files:

• r: Read the file.
• w: Modify the file.
• x: Execute the file.

For directories:

• r: List directory entries.
• w: Create, delete, or rename entries, subject to other access controls.
• x: Traverse the directory and access entries when other permissions allow it.

This distinction is especially important when troubleshooting permission problems.

3. Changing Permissions with chmod

The chmod command changes file and directory permissions on Linux and macOS.

There are two common ways to use it:

• Symbolic mode
• Numeric mode

Symbolic Mode

Let's start with a simple example.

chmod u+x script.sh

This adds execute permission for the file owner.

Here are some useful examples:

chmod u+w file.txt

Add write permission for the owner.

chmod g-r file.txt

Remove read permission from the group.

chmod o+x script.sh

Add execute permission for others.

chmod a+r file.txt

Add read permission for everyone.

The symbols are straightforward:

Numeric Mode

You can also represent permissions using numbers.

Each permission has a numeric value:

Add the values to calculate each permission group.

For example:

chmod 755 script.sh

This means:

• Owner: 7 = 4 + 2 + 1 = read, write, execute
• Group: 5 = 4 + 1 = read, execute
• Others: 5 = 4 + 1 = read, execute

Another common example:

chmod 644 file.txt

This gives:

• Owner: read and write
• Group: read only
• Others: read only

A few common permission patterns:

Security tip: Avoid using chmod 777 as a quick fix for permission problems. It grants read, write, and execute permissions to everyone, which can create serious security risks.

4. Changing File Ownership

Sometimes you need to change who owns a file or directory.

On Linux and macOS, use chown.

For example:

sudo chown hamed file.txt

This changes the owner of file.txt to hamed.

To change both the owner and group:

sudo chown hamed:developers file.txt

To apply ownership changes recursively:

sudo chown -R hamed:developers project/

The -R option applies the change to the directory and its contents.

Be careful with recursive ownership changes. Applying them to the wrong directory can break system services or applications.

Changing the Group

Use chgrp:

sudo chgrp developers file.txt

This changes the file's group to developers.

You can also use chown to change only the group:

sudo chown :developers file.txt

5. Understanding sudo and the Root User

On Linux and macOS, root is the superuser account.

Root has extensive privileges over the system.

Regular users usually don't have permission to perform every administrative operation.

That's where sudo comes in.

sudo allows an authorized user to execute a command with elevated privileges.

For example:

sudo apt update

On Ubuntu and Debian-based Linux distributions, this runs the package update command with administrative privileges.

Another example:

sudo systemctl restart nginx

This restarts the Nginx service.

You might be asked to enter your password.

Important: When typing a password in many Unix-like terminals, the terminal doesn't display characters or asterisks. This is normal behavior.

Running a Shell with Elevated Privileges

You may also encounter:

sudo -i

This starts an interactive root login shell on systems using sudo.

You can leave it with:

exit

However, it's generally safer to use sudo for individual commands rather than staying in a privileged shell unnecessarily.

The Difference Between sudo and su

Another command worth knowing is su.

su -

This attempts to switch to another user, usually root.

The difference:

• sudo: Runs a command with elevated privileges according to the system's sudo configuration.
• su: Switches to another user account.

Not every Linux distribution configures these commands in the same way.

6. Windows Administrator Privileges

Windows uses a different security model.

Instead of relying on Unix-style root permissions, Windows uses user accounts, security groups, access control lists (ACLs), and User Account Control (UAC).

A standard user may be unable to perform certain administrative operations.

For example, modifying protected system directories may require an elevated PowerShell or CMD session.

Check Whether PowerShell Is Running as Administrator

Run:

$currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()

$principal = New-Object Security.Principal.WindowsPrincipal($currentIdentity)

$principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

The result will be:

True

or:

False

True means the current PowerShell process has an elevated Administrator token.

Simply belonging to the Administrators group doesn't necessarily mean the current terminal is elevated. UAC can run an administrator account with a filtered token until elevation is requested.

Open PowerShell as Administrator

You can open an elevated PowerShell window using:

1. Open the Start menu.
2. Search for PowerShell.
3. Right-click it.
4. Select Run as administrator.
5. Approve the UAC prompt.

You can also request an elevated PowerShell process from an existing PowerShell session:

Start-Process powershell -Verb RunAs

For PowerShell 7:

Start-Process pwsh -Verb RunAs

A new elevated window will open after UAC approval.

7. Managing Windows File Permissions with icacls

Windows uses Access Control Lists (ACLs) to determine who can access files and directories.

One important command-line utility is:

icacls

Let's explore some examples.

View Permissions

icacls file.txt

This displays the file's access control entries.

Grant Read Access

icacls file.txt /grant username:R

This grants the specified user read access.

Grant Modify Access

icacls file.txt /grant username:M

This grants modify access.

Remove an Explicit Permission

icacls file.txt /remove username

This removes matching explicit access control entries for that user.

It does not necessarily remove access inherited from parent directories.

Understanding Common Permission Codes

You can inspect permissions before changing them.

Important: Be careful when modifying ACLs on Windows system directories. Incorrect permissions can prevent applications or Windows components from working correctly.

8. Managing Permissions in PowerShell

PowerShell also provides access to Windows security information.

Get File Permissions

Get-Acl file.txt

This returns an ACL object.

Store the ACL in a Variable

$acl = Get-Acl file.txt

You can inspect its access rules:

$acl.Access

View the File Owner

$acl.Owner

Understanding the Difference

Get-Acl retrieves security information.

Set-Acl applies security information.

For example, after making a deliberate change to an ACL object, you can apply it with:

Set-Acl -Path file.txt -AclObject $acl

Don't run this blindly without modifying or understanding the ACL object first.

For many everyday permission-management tasks, icacls is more direct.

9. Understanding Hidden Files and Permissions

Hidden files and file permissions are two different concepts.

A hidden file is not necessarily protected.

On Linux and macOS, filenames beginning with a dot are conventionally treated as hidden:

ls -la

On Windows, hidden files have a file attribute.

To show hidden files in PowerShell:

Get-ChildItem -Force

To inspect file attributes:

Get-Item file.txt -Force | Format-List Name, Attributes

A file can be hidden and still readable by users who have permission to access it.

Remember: Hiding a file is not a security mechanism.

10. Real-World Permission Scenarios

Let's apply these concepts to common development situations.

Scenario 1: A Shell Script Won't Execute

You try to run:

./deploy.sh

But receive:

Permission denied

Inspect the permissions:

ls -l deploy.sh

If the file doesn't have execute permission for you, add it:

chmod u+x deploy.sh

Then run it again:

./deploy.sh

Scenario 2: You Cannot Modify a File

On Linux or macOS, inspect ownership and permissions:

ls -l config.txt

If you own the file but lack write permission:

chmod u+w config.txt

If another account owns it, you may need an administrator to change its ownership or permissions.

Don't automatically use sudo to edit every file that produces a permission error. First understand why access is restricted.

Scenario 3: A Windows Directory Rejects Your Changes

You try to modify a protected Windows directory and receive an access-denied error.

First, determine whether the terminal is elevated.

Then inspect the file's ACL:

Get-Acl "C:\SomeFolder\config.txt"

If you have a legitimate reason to modify the file, use the appropriate administrative permissions.

Don't take ownership of system directories or grant broad access just to bypass an error.

11. Security Best Practices

Understanding permissions isn't just about making commands work.

It's about keeping your system secure.

Here are some important habits:

1. Use the least privilege principle. Give users only the permissions they actually need.
2. Avoid unnecessary administrator sessions. Use elevated privileges only when required.
3. Be careful with recursive changes. Commands like chmod -R and chown -R can affect thousands of files.
4. Avoid chmod 777. It gives everyone extensive access.
5. Inspect before modifying. Use ls -l, Get-Acl, or icacls before changing permissions.
6. Don't blindly copy commands using sudo. Understand what a privileged command will do.
7. Protect sensitive files. Configuration files, private keys, and credentials should have appropriately restricted access.

12. Practice Exercises

Try these exercises in your own environment.

Linux / macOS

1. Create a file called script.sh.
2. Inspect its permissions using ls -l.
3. Add execute permission for the owner.
4. Change its permissions to 644.
5. Change them again to 755.
6. Use whoami and groups to inspect your current identity.

Windows PowerShell

1. Create a file named permissions.txt.
2. Inspect its security information using Get-Acl.
3. Display its owner.
4. Display its access rules.
5. Check whether PowerShell is running with elevated privileges.
6. Inspect the file's permissions using icacls.

Try to understand what each command changes rather than simply copying it.

Quick Reference