Now that we understand the different flags we can use when opening a file in Go, let's examine the other side of the equation: the file's mode, also known as file permissions. In this lesson, we'll focus on Unix file permissions (Linux, macOS, FreeBSD), as Windows has a very different concept known as Access Control Lists (ACLs).

Note: If you're interested in Windows-specific permissions, check out the Go ACL package, which provides functionality for manipulating ACLs on Windows.

File Ownership in Unix Systems

In Unix systems, every file has an owner and belongs to a group. When we run ls -lah, we can see:

-rw-r--r--  1 eliot  users  0 Apr 28 15:30 myfile.txt

The columns represent:

1. File permissions
2. Number of links
3. File owner (user)
4. File group
5. File size
6. Last modification date
7. Filename

A file can only have one owner, but it has three permission sets:

1. User permissions (the file's owner)
2. Group permissions (users in the file's group)
3. Other permissions (everyone else)

Understanding Permission Notation

The first column in ls -lah output shows file permissions:

• First character: File type (- for regular file, d for directory)
• Next three characters: Owner permissions
• Next three characters: Group permissions
• Last three characters: Other permissions

Each set of three characters represents:

• r: Read permission
• w: Write permission
• x: Execute permission
• -: No permission

Changing Permissions with chmod

The chmod command (Change Mode) is used to change file permissions in Unix:

# Add write permission to group
chmod g+w myfile.txt

# Remove write permission from group
chmod g-w myfile.txt

Numeric Permission Notation (Octal)

A more common way to express permissions, especially in programming, is using octal numbers:

0644
↑↑↑↑
││││
│││└── Others: read (4)
││└─── Group: read (4)
│└──── Owner: read (4) + write (2) = 6
└───── File type (0 for regular file)

Each permission is assigned a value:

• Read: 4
• Write: 2
• Execute: 1

You add these values to define the permission for each category:

• 7 = read (4) + write (2) + execute (1)
• 6 = read (4) + write (2)
• 5 = read (4) + execute (1)
• 4 = read (4)
• 0 = no permissions

Setting Permissions in Go

In Go, we can set permissions when creating a file using the third parameter of os.OpenFile:

file, err := os.OpenFile("myfile.txt", os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0644)
if err != nil {
    log.Fatal("Failed to open file:", err)
}

For existing files, we can use the os.Chmod function:

err := os.Chmod("myfile.txt", 0644)
if err != nil {
    log.Fatal("Failed to change permissions:", err)
}

Understanding umask

When creating files, the system applies a bitmask called umask to the permissions you specify:

$ umask
0022

This means:

• User permissions: unchanged (0)
• Group permissions: write permission removed (2)
• Other permissions: write permission removed (2)

So if you specify 0666 when creating a file, the actual permissions will be 0644 (with a umask of 0022).

You can temporarily change the umask:

# Set umask to 0 (no restrictions)
umask 0000

Changing File Ownership with chown

The chown command (Change Owner) changes the owner or group of a file:

# Change owner to root and group to root
sudo chown root:root myfile.txt

# Change just the owner
sudo chown root myfile.txt

# Change just the group
sudo chown :users myfile.txt

In Go, this can be done with os.Chown:

err := os.Chown("myfile.txt", 0, 0)  // Change to root:root (UID 0, GID 0)
if err != nil {
    log.Fatal("Failed to change owner:", err)
}

Common Permission Patterns

Typical default permissions:

• Regular files: 0644 (rw-r--r--)
• Directories: 0755 (rwxr-xr-x)
• Private files (like SSH keys): 0600 (rw-------)
• Executables: 0755 (rwxr-xr-x)

Why Permissions Matter

File permissions are crucial for security:

1. Preventing unauthorized users from reading sensitive files
2. Controlling who can modify important files
3. Restricting execution of potentially dangerous files
4. Implementing the principle of least privilege

For example, if you're running a web application, you might:

• Store configuration with sensitive data as 0600 (only readable by the owner)
• Make web content readable by everyone but writable only by specific users
• Ensure executable files have the right permissions

Summary

Understanding file permissions is essential when working with files in Go on Unix-like systems:

1. Files have three permission sets (owner, group, others)
2. Each set can have read, write, and execute permissions
3. Permissions can be specified numerically (octal) or symbolically
4. The system's umask affects the actual permissions of newly created files
5. Proper permissions are crucial for security

When in doubt, use:

• 0644 for regular files
• 0755 for directories and executables
• 0600 for sensitive files