File permissions and ownership

Reading the mode

ls -l divides a mode into a file type followed by permissions for owner (u), group (g), and others (o). Within each set, r means read, w write, and x execute; on a directory, x permits traversal or cd.

- rwx r-x r--
│  │   │   └─ others
│  │   └───── group
│  └───────── owner
└──────────── file type

The first character is the type: - regular file, d directory, l symbolic link. On a directory, r lets you list names and w lets you create, rename, or delete entries inside it, even files you do not own.

flowchart LR
  P["Process<br/>runs as bob"] --> O{"Owner of<br/>the file?"}
  O -- "yes" --> U["user bits<br/>rwx"]
  O -- "no" --> G{"In the<br/>file's group?"}
  G -- "yes" --> GR["group bits<br/>r-x"]
  G -- "no" --> OT["other bits<br/>r--"]
  %% step P: Every access is checked against the user the process runs as.
  %% step O: If the user owns the file, only the owner bits apply.
  %% step U: rwx for the owner, for example 7 in chmod 750.
  %% step G: Otherwise Linux checks whether the user is in the file's group.
  %% step GR: Group members get the group bits, 5 (r-x) in 750.
  %% step OT: Everyone else gets the other bits, 0 in 750: no access.

Changing permissions

Octal adds r=4, w=2, and x=1: chmod 644 config.txt produces rw-r--r--, while 755 produces rwxr-xr-x. A symbolic mode such as chmod u+x script.sh changes only the named bit; chmod go-w file removes write from group and others.

chmod -R applies to a whole tree. Use it carefully: files and directories usually need different modes, and find . -type d -exec chmod 755 {} + lets you target only one kind.

Owners and groups

chown user:group file changes owner and group and usually needs root; chgrp changes only the group. id shows your user, primary group, and extra groups. Granting access through a shared group is safer than opening a file to everyone.

Defaults and special bits

New files get their mode from the umask: with the common 022, files start as 644 and directories as 755. Three special bits exist too. setuid (4) runs a program as its owner, as passwd does; setgid (2) on a directory makes new files inherit its group; the sticky bit (1) on /tmp lets users delete only their own files.

chmod 777 is rarely the right repair: it grants write and execute to everyone and hides the real permission problem.