3: File Permissions, Ownership & Security
Chapter 3: File Permissions, Ownership & Security
High-throughput genomics laboratories operate in multi-user shared computing environments. Raw sequencing files frequently contain protected human genetic health information governed by HIPAA, GDPR, and institutional review boards (IRBs). A single misconfigured permission setting can expose confidential patient variants or allow another user to inadvertently overwrite months of pipeline results.
When running a newly authored bash script, you will often encounter bash: ./pipeline.sh: Permission denied. By default, Linux creates new text files with read and write permissions, but not execute permissions. Granting execution rights requires chmod +x pipeline.sh.
1. The User-Group-Others Triad
Every file and directory in Linux has an owner and a group. Permissions are assigned across three distinct scopes:
- User (
u): The individual user account who owns the file. - Group (
g): The lab group or project team sharing collective access. - Others (
o): All other user accounts on the system (the world).
2. Reading Permission Strings in ls -l
Executing ls -l outputs a 10-character permission string:
-rwxr-xr-- 1 alice genomics 24580 Oct 12 14:00 run_alignment.sh
drwxr-xr-x 2 alice genomics 4096 Oct 12 14:02 raw_fastq/- Character 1: File Type:
-for regular file,dfor directory,lfor symbolic link. - Characters 2-4: Owner Permissions:
rwx(Read, Write, Execute). - Characters 5-7: Group Permissions:
r-x(Read, Execute, No Write). - Characters 8-10: Others Permissions:
r--(Read-only).
3. Octal Mode vs. Symbolic Mode (chmod)
Permissions can be represented mathematically by summing octal values:
| Permission | Symbol | Binary | Octal Value |
|---|---|---|---|
| Read | r | 100 | 4 |
| Write | w | 010 | 2 |
| Execute | x | 001 | 1 |
| No Permission | - | 000 | 0 |
# Common Octal Permission Patterns:
# 755 (rwxr-xr-x): Standard executable script (Owner full, Group/Others read+execute)
chmod 755 pipeline.sh
# 644 (rw-r--r--): Standard data file (Owner read/write, Group/Others read-only)
chmod 644 sample1.fastq.gz
# 600 (rw-------): Strict private file (Owner read/write, no one else can view)
chmod 600 private_patient_variants.vcf
chmod 600 ~/.ssh/id_ed25519
# Symbolic Notation Examples:
chmod +x script.sh # Add execute to everyone
chmod u=rwx,g=rx,o= run.sh # Owner full, group read/exec, others denied
chmod -R g+w shared_data/ # Recursively grant group write access4. Changing Ownership with chown & chgrp
# Change file owner to alice (requires sudo / administrator privileges)
sudo chown alice alignment.bam
# Change owner and group simultaneously
sudo chown alice:genomics alignment.bam
# Change group ownership recursively for an entire lab folder
chgrp -R genomics_lab /scratch/project_data/5. Clinical Data Protection with umask
The umask command defines the default permission filter applied when creating new files. On shared clusters handling sensitive genomes, set umask 027 in your ~/.bashrc:
# Add to ~/.bashrc:
umask 027
# Explanation:
# Base file permissions: 666 (rw-rw-rw-)
# Subtract umask: - 027 (----w-rwx)
# Resulting new file: 640 (rw-r-----) -> Owner read/write, Lab group read-only, Others denied!Common Pitfalls & Troubleshooting Checklist
- Java Heap Exhaustion (GATK / Picard): If processes terminate with
java.lang.OutOfMemoryError, set your environment variable explicitly:export _JAVA_OPTIONS="-Xmx16g -Djava.io.tmpdir=/tmp". - Index Timestamp Mismatch: If tools complain that a BAM index is missing or out of date, regenerate with
samtools index -@ 4 sample.bam. - Conda Channel Conflicts: Avoid ABI incompatibilities between bioconda and conda-forge by setting strict priority:
conda config --set channel_priority strict. - Chromosome Naming Contamination: Always verify whether reference FASTA headers use
chr1or1; divergent naming causes silent alignment drops.