Skip to main content

Chapter 3.5 - File Permissions

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand the Linux permissions system
  • Read and interpret permissions
  • Modify permissions with chmod
  • Change owner and group with chown

What are Permissions?​

Linux permissions control who can read, write, or execute a file. It is a fundamental security system.

Three levels:

  • Owner: File creator
  • Group: Owning group
  • Other: All other users

Types of Permissions​

r (Read)​

For files:

  • Read the content
  • Display with cat, less, etc.

For directories:

  • List the content (ls)

w (Write)​

For files:

  • Modify the content
  • Overwrite the file

For directories:

  • Create files
  • Delete files

x (Execute)​

For files:

  • Execute as a program
  • Scripts, binaries

For directories:

  • Access the directory (cd)
  • Necessary for navigation

Reading Permissions​

Long Format (ls -l)​

$ ls -l file.txt
-rwxr-xr-- 1 user group 1024 Jan 1 12:00 file.txt

Breakdown:

- rwx r-x r-- 1 user group 1024 Jan 1 12:00 file.txt
│ ││  ││  ││  │ │    │     │    │
│ ││  ││  ││  │ │    │     │    └─ Name
│ ││  ││  ││  │ │    │     └────── Size
│ ││  ││  ││  │ │    └──────────── Group
│ ││  ││  ││  │ └───────────────── Owner
│ ││  ││  ││  └─────────────────── Links
│ ││  ││  │└────────────────────── Others: r--
│ ││  ││  └─────────────────────── Group: r-x
│ ││  │└────────────────────────── Owner: rwx
│ ││  └─────────────────────────── Type: - (file)
│ └─────────────────────────────── Type: d (directory), l (link)

Octal Format​

# rwx = 111 (binary) = 7 (decimal)
# r-x = 101 (binary) = 5 (decimal)
# r-- = 100 (binary) = 4 (decimal)

# Example: rwxr-xr-- = 754

Mapping:

  • r = 4
  • w = 2
  • x = 1
  • - = 0

Examples:

  • rwx = 4+2+1 = 7
  • r-x = 4+0+1 = 5
  • r-- = 4+0+0 = 4
  • --- = 0+0+0 = 0

Modifying Permissions (chmod)​

Symbolic Method​

# Add permissions
chmod u+x file.txt      # Owner: +x
chmod g+w file.txt      # Group: +w
chmod o+r file.txt      # Others: +r
chmod a+x file.txt      # All: +x

# Remove permissions
chmod u-x file.txt      # Owner: -x
chmod g-w file.txt      # Group: -w

# Set permissions
chmod u=rwx file.txt    # Owner: rwx
chmod g=rx file.txt     # Group: r-x
chmod o=r file.txt      # Others: r--

# Combinations
chmod u+x,g+w file.txt
chmod u=rwx,g=rx,o=r file.txt

Symbols:

  • u: User (owner)
  • g: Group
  • o: Other (others)
  • a: All

Operators:

  • +: Add
  • -: Remove
  • =: Set

Octal Method​

# Format: chmod ABC file
# A = Owner, B = Group, C = Others

chmod 755 file.txt      # rwxr-xr-x
chmod 644 file.txt      # rw-r--r--
chmod 600 file.txt      # rw------- (private)
chmod 777 file.txt      # rwxrwxrwx (all rights)

# Recursive
chmod -R 755 directory/

Common Permissions:

  • 755: Executable (scripts, programs)
  • 644: Normal files (read/write)
  • 600: Private files (owner only)
  • 700: Private directory

Changing Owner and Group (chown)​

chown​

# Change owner
chown user file.txt

# Change owner and group
chown user:group file.txt

# Change only the group
chown :group file.txt
chgrp group file.txt

# Recursive
chown -R user:group directory/

Examples:

# Give to user1
chown user1 file.txt

# Give to user1, group users
chown user1:users file.txt

# Recursive on a directory
chown -R www-data:www-data /var/www/

Special Permissions​

SUID (Set User ID)​

Execute with the owner's permissions:

chmod u+s file
# Example: /usr/bin/passwd (s instead of x)

SGID (Set Group ID)​

Execute with the group's permissions:

chmod g+s file

Sticky Bit​

Prevents deletion by others:

chmod +t directory/
# Example: /tmp (t instead of x)

Default Mask (umask)​

The umask determines the default permissions for new files:

# View current umask
umask

# Set umask
umask 022  # Files: 644, Directories: 755
umask 002  # Files: 664, Directories: 775

Calculation:

  • Files: 666 - umask
  • Directories: 777 - umask

Practical Examples​

Private File​

chmod 600 file.txt
# Only the owner can read/write

Executable Script​

chmod 755 script.sh
# Everyone can execute, owner can modify

Shared Directory​

mkdir shared
chmod 775 shared
chgrp developers shared
# Group developers can read/write

Web Files​

chown -R www-data:www-data /var/www/html
chmod -R 755 /var/www/html
find /var/www/html -type f -exec chmod 644 {} \;
find /var/www/html -type d -exec chmod 755 {} \;

Summary​

In this chapter, you learned:

Permissions: r (read), w (write), x (execute)
Levels: Owner, Group, Others
Reading: ls -l, symbolic and octal format
chmod: Modify permissions (symbolic or octal)
chown: Change owner and group
Specials: SUID, SGID, Sticky Bit
umask: Default permissions

Next Steps​

Chapter 3.6: File Search
Chapter 3.7: Symbolic and Hard Links

Chapter created on: December 2024