First off, it's important you understand that when looking at a directory or file, traditional Unix permissions only know to differentiate between:
- The user
- The user's group
- Anybody else
These permissions are reflected in the
rwxrwxrwx notation, called modes.
r stands for read,
w for write and
x for execute. Their meaning is pretty much what they're named after, only that the execute permission allows you to recurse a directory tree.
So, /home/testser belongs to user testuser, and it can change things in its directory but nothing else. What does that root indicate for the home directory?
root here is the group the directory belongs to. That means that any user in the
root group will have the permissions as indicated by the second
rwx part of the permissions notation. For example,
drwxr-xr-x would mean that anybody in the
root group can only read and list that directory, but not write to it.*
In this example with testuser, let's say that it belongs to the group root. Does that mean it has the union of the privileges of testuser and root apply to this user?
The user's privileges apply to this directory because it belongs to them. If the
testuser also happens to be in the group
root, then the privileges in that group would also apply. If neither is the case, only the permissions from the third part would apply.
Let's say you're on a computer science class and there's a computer where both
bob belong to the group
students. Everyone of them has a home directory with
rwxr-x--- permissions, with ownership of
bob:students. That would mean any student can list and read the contents of every other student, but they cannot modify the files of their colleagues.
Also, I noticed that for a new user I create, there's a new group that gets created, named the same as the name of the user. What's the purpose of this?
This allows you to give more flexible control over permissions. Sometimes you don't want to have a group that's shared amongst users. Especially for home folders, you don't want anybody else to even read them. This is why it's a good idea to
chown -R testuser:testuser /home/testuser, because no group permission setting (even a
rwx one) would be a security concern.
* Well, not exactly, since any root user can do anything, but if the group were something else, then the above would hold true.