Every file has an owner and permissions: read, write and run, for the owner and for everyone else. ls -l shows them as letters like rw-r--r-- (644). The owner changes them with chmod; nobody else can. Hiding a file protects nothing; permissions do.
Everyone at school logs into the same server. Why can't you read your teacher's marks file?
On a shared computer, the operating system checks every request against the file's permissions before it opens anything. This is the same idea as Who are you, and what may you do? in Security and privacy, on a real kind of system.
Predict: Read the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Try: Try it on the board and compare the result with your prediction.
Investigate: Work out why it happens, one step at a time.
Modify: Change the problem on purpose and see what happens.
Practise: A few on your own, to check you have it.
Make: Make your own problem using what you have learned. Expect a few tries; that is normal.
Make your prediction first. Help opens once you've locked it in.
PredictRead the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Read-only
TryTry it on the board and compare the result with your prediction.
Try: Lee's files
Was your prediction right?
Try it yourselfYour edits are saved in this browser.
Look at Lee's files with ls -l /home/lee. Try to read both with cat. Which one can you read?
Use the board. This ticks when you get there.
InvestigateWork out why it happens, one step at a time.
Worked example: reading rw-r--r--
Worked exampleBefore each step, say what you think comes next.
-The first character: - for a file, d for a folder.
rw-r----- as three digits (read 4, write 2, run 1, for owner, group, everyone else)?
Sam hides a file. Click the line where it first goes wrong.
ModifyChange the problem on purpose and see what happens.
Vary: change who can do what
Try it yourselfYour edits are saved in this browser.
Make .plans.txt unreadable to everyone except you. Check with ls -la.
Use the board. This ticks when you get there.
Let yourself run projects/robot.py as a program (x for the owner).
Use the board. This ticks when you get there.
Try to make Lee's marks.txt readable with chmod 644. What happens?
Use the board. This ticks when you get there.
PractiseA few on your own, to check you have it.
Permissions
MakeMake your own problem using what you have learned. Expect a few tries; that is normal.
Lock your plans
Then: on a real Mac or Linux computer, run ls -l in your home folder. Which files are most private?
Try it yourselfYour edits are saved in this browser.
Need a hint?
Only you should read it and change it: rw for you, nothing for anyone else.
Another hint
rw------- in digits: 6, 0, 0.
Another hint
chmod 600 .plans.txt
Your .plans.txt should be readable and changeable by you, and nobody else should be able to do anything with it.
Use the board. This ticks when you get there.
For teachers
Students read permission strings with ls -l, are refused a file they may not read, turn permissions into digits, and set them with chmod on their own files but not someone else's (AC9TDI10K01 node 3, access control on a real kind of system). About 45 minutes.
I can protect a file with chmod, and explain why hiding it doesn't.
Before class
Try the boards yourself.
The one idea: the operating system checks permissions before every request, and only the owner (or an administrator) can change them. This is Security and privacy's access control (authorisation) on a real kind of system.
Simplification: the pretend computer has no groups, so the middle group of letters is shown but only "owner" and "everyone else" are checked. sudo is refused on purpose.
Running the lesson
Predict: students who said yes think reading gives control.
Try: ask what the operating system checked before refusing.
Worked example: build 640 on the board one group at a time.
Vary: after the refusal, ask why the system lets Lee but not Sam change it.
Make: ask why private keys and password files are usually 600.
The hard part (on purpose)
The digits are the hard part. Keep the 4-2-1 card visible and add up one group at a time.
When students get stuck
A student thinks hidden means private (Sam's mistake). Ask: Can you cat .plans.txt? Could someone else? Fix: Only permissions protect it: chmod 600.
A student's chmod gives an error. Ask: Whose file is it? (ls -l shows the owner.) Fix: You can only chmod your own files.
Stretch and support
Stretch: Find out what chmod 777 means and why people say never to use it.
Support: A 4-2-1 card: r = 4, w = 2, x = 1, added for owner, group, everyone else.
Where it leads
Links: Security and privacy › Who are you, and what may you do? (authentication and permissions); Cyber security (planned).
What each step is for
read-only: Committing to what r-- allows tests the new move: each letter is one permission.
Try: Lee's files: Trying to read two of the teacher's files settles the prediction: one is allowed, one is refused.
Worked example: reading rw-r--r--: Splitting a permission string into its two groups and turning it into digits models the new move. Sam trusts a hidden name, the misconception planted after the method.
Vary: change who can do what: Each task changes one permission: take read away from others, add run for the owner, then try to change a file you don't own.
permissions: Reading and choosing permissions without the board is the same move in mixed forms, plus a review of pipes.
lock your plans: Setting a file to exact permissions reverses the process: from who should be allowed to the digits or letters that say so.
Now you can
Read a permission string such as rw-r--r--.
Turn permissions into digits and back.
Protect a file with chmod, and explain why hiding it doesn't.