Permissions: who is allowed to do what

1. The promise

You'll be able to read a file's permissions on macOS, Linux, and Windows. You'll predict whether you can open, edit, or run a given file before you double-click it.

2. The mental model

Every file has three locks. Each lock has three sets of keys.

• The three locks are the three actions: read the file, write to the file, run the file.
• The three key sets are the three audiences: you (the owner), your group, everyone else.

The OS checks the right key against the right lock before letting any action happen. No matching key, no action.

The vocabulary, said properly:

• Permissions are the rules deciding who can read, write, or run a file.
• Owner is the user account that owns the file. Usually you, for files in your home folder.
• Group is a named collection of users.
• Other is everyone else on this machine.
• Read means seeing the contents.
• Write means changing the contents.
• Execute (also called run) means the OS is allowed to treat this as a program.
• The quarantine flag is a marker macOS adds to downloaded files until you confirm you trust the source.

(DIAGRAM: read/write/execute x owner/group/other grid — annotated SVG — 3x3 grid with rows owner/group/other and columns r/w/x; example permission rwxr-xr-- shown mapped onto the grid with green for permitted and grey for blocked)

The classic Unix notation packs all nine bits into nine characters: rwxr-xr--. Read left to right in groups of three: owner can read, write, execute; group can read, execute; other can only read. You'll see this notation properly in Ch 2.

3. You do it, with me

Step 1. Pick a file in your Documents folder. Any one will do.

Step 2. Open its permissions panel.

• macOS: right-click the file -> Get Info. Scroll to the bottom — Sharing & Permissions.
• Windows: right-click the file -> Properties -> Security tab.

(SCREENSHOT: macOS Get Info for a script file — Sharing & Permissions section expanded — full window — the user/group/other rows highlighted)

(SCREENSHOT: Windows Properties -> Security tab for a file — full window — the Group or user names box highlighted)

On macOS, you'll see rows like:

• your name — Read & Write
• staff — Read only
• everyone — Read only

That's the three audiences: owner (you), group (staff), other (everyone). Each one with the permission set.

On Windows, the model is richer (it's called ACLs, access control lists) but the read/write/execute idea is the same. You'll see entries for SYSTEM, Administrators, Users, your account — each with a column of allowed actions.

Step 3. Predict, then check. Look at the permissions on your file and predict:

1. Can you read it? (Almost certainly yes, if it's in your Documents folder.)
2. Can you edit it? (Yes, if the row for your user shows write.)
3. Can the OS run it as a program? (Almost certainly no, if it's a .docx or a .pdf.)

Now try each one. Open the file. Edit it. Try to "run" it by double-clicking (the OS will open it in the default program — not run it as a program).

Step 4. See quarantine in action. Download any installer from the web (don't run it — just download it). macOS attaches a quarantine flag automatically.

The first time you try to open it, you'll see:

(SCREENSHOT: macOS Gatekeeper dialog blocking a downloaded app — full window — the Cancel/Open buttons visible)

The same thing on Windows is called SmartScreen:

(SCREENSHOT: Windows SmartScreen "Windows protected your PC" dialog — full window — "More info" link highlighted)

Both are extra layers on top of plain read/write/execute. They ask: "this came from outside; are you sure?" You click through if you trust the source.

Step 5 (peek only). On the terminal, you'll change permissions with chmod (change mode) and ownership with chown (change owner). You'll meet both properly in Ch 2.

chmod +x my-script.sh   # add execute permission for everyone
chown alice:staff file  # set owner to alice, group to staff

4. What you should be seeing

The permissions panel on at least one file. You can name the owner, you can name the group (or see "Administrators" / "Users" on Windows), and you can read the row for "everyone" or "other".

You can predict whether you can read, write, and run the file — and you've checked your prediction.

5. Common stumbles

• "Why can't I edit this file?" You don't own it. The file might be owned by root or by another user. Look at the owner row. If your account isn't the owner and your account doesn't have write, you can't write. The fix is either to take ownership or to copy the file somewhere you do own.
• "I downloaded a script and double-clicking does nothing." Three things to check. The execute bit might be off — most downloaded .sh files arrive without it. Quarantine might be on — macOS won't run quarantined scripts. The OS might not know what to run it with — .sh files need a terminal. We unblock all three properly in Ch 2.
• Windows: administrator vs standard user. Some installers need administrator rights to write into C:\Program Files. If your user account is "Standard", the installer pops up a User Account Control dialog asking for an admin password. If you're a solo developer on your own machine, your account is probably already an administrator.
• You changed permissions and now nothing works. Permissions changes on system files can break the OS. Stay out of /System, C:\Windows, and /Library until you know what you're doing. For your own files in your home folder, you can't break much.

6. You should know