Linux File Permissions Explained: chmod and chown

Linux is a multi-user system, so every file has an owner and a set of permissions. "Permission denied" is one of the first errors everyone meets.

Reading permissions#

echo "hello" > notes.txt
mkdir reports
ls -ld notes.txt reports

-rw-rw-r-- 1 asha asha    6 Nov  5 06:26 notes.txt
drwxrwxr-x 2 asha asha 4096 Nov  5 06:26 reports

The first column is broken down like this:

-  rw-  rw-  r--
|   |    |    |
|   |    |    +-- others: everyone else
|   |    +------- group
|   +------------ user: the owner
+---------------- type: - file, d directory, l link

chmod with letters#

chmod changes permissions. Choose who (u, g, o, or a for all), + or -, and the permission:

echo 'echo "It runs"' > run.sh
./run.sh
chmod u+x run.sh
./run.sh
ls -l run.sh

bash: ./run.sh: Permission denied
It runs
-rwxrw-r-- 1 asha asha 15 Nov  5 06:26 run.sh

The first attempt failed because the script was not executable.

chmod o-r notes.txt
chmod g-w notes.txt
ls -l notes.txt

-rw-r----- 1 asha asha 6 Nov  5 06:26 notes.txt

chmod with numbers#

Each permission has a value, and you add them up for each of user, group and others.

So rw- is 6, r-x is 5, and rwx is 7.

chmod 755 run.sh
chmod 600 notes.txt
stat -c '%a %A %n' run.sh notes.txt

755 -rwxr-xr-x run.sh
600 -rw------- notes.txt

stat -c '%a' prints the number form, which is handy in scripts.

Changing a whole folder#

-R is recursive, but files and folders usually need different permissions. This is the safe pattern:

mkdir -p site/css
touch site/index.html site/css/main.css
find site -type d -exec chmod 755 {} +
find site -type f -exec chmod 644 {} +
ls -lR site | grep -E '^[d-]'

drwxr-xr-x 2 asha asha 4096 Nov  5 06:26 css
-rw-r--r-- 1 asha asha    0 Nov  5 06:26 index.html
-rw-r--r-- 1 asha asha 0 Nov  5 06:26 main.css

Changing the owner#

chown changes the owner and group, and it needs sudo:

sudo chown root:root notes.txt
ls -l notes.txt
cat notes.txt

-rw------- 1 root root 6 Nov  5 06:26 notes.txt
cat: notes.txt: Permission denied

Now asha cannot read it, because it belongs to root, with mode 600.

sudo chown asha:asha notes.txt
cat notes.txt

hello

chgrp changes only the group, and chown -R changes a whole folder.

umask#

New files get default permissions, set by the umask. It lists the permissions to remove from 666 for files and from 777 for folders:

umask

0002

With a umask of 0002, files start as 664 and folders as 775. Many servers use 0022, which gives 644 and 755.

Special permissions#

These are mainly useful to know for interviews:

ls -ld /tmp
ls -l /usr/bin/passwd

drwxrwxrwt 13 root root 4096 Nov  5 06:26 /tmp
-rwsr-xr-x 1 root root 64152 May 30  2024 /usr/bin/passwd

The t shows the sticky bit, and the s shows setuid.

Common mistakes#

Practice#

chmod 600 secret.txt
chmod 755 app.sh
stat -c '%a %n' secret.txt app.sh

600 secret.txt
755 app.sh

Key takeaway#

Next: Users, Groups and sudo.