Linux file permissions and ownership form the foundation of system security. Understanding how to properly manage who can read, write, and execute files is crucial for system administration, security, and multi-user environments. This guide covers chmod, chown, and umask with practical examples.
Understanding Linux File Permissions
When you run ls -l, you see permission information like this:
Permission Types Explained
| Symbol | Permission | File | Directory | Octal |
|---|---|---|---|---|
| r | Read | View file content | List directory contents | 4 |
| w | Write | Modify file content | Create/delete files in directory | 2 |
| x | Execute | Run as program | Access directory (cd into it) | 1 |
| - | No permission | Cannot access | Cannot access | 0 |
Octal Notation System
Permissions are often represented using octal (base-8) numbers:
• 755 - Owner: rwx, Group: r-x, Others: r-x (executables, directories)
• 644 - Owner: rw-, Group: r--, Others: r-- (regular files)
• 700 - Owner: rwx, Group: ---, Others: --- (private files)
• 777 - Everyone: rwx (dangerous - avoid in production)
chmod: Change File Permissions
Symbolic Method
Use letters to specify permissions for u(ser), g(roup), o(thers), a(ll)
Examples:
chmod u+x script.sh- Add execute for ownerchmod go-w file.txt- Remove write for group & otherschmod a+r document.pdf- Add read for everyonechmod u=rw,g=r,o= config.txt- Set specific permissions
Octal Method
Use numbers to represent permission sets (0-7)
Examples:
chmod 755 script.sh- rwxr-xr-xchmod 644 file.txt- rw-r--r--chmod 600 secret.txt- rw------- (private)chmod 750 directory/- rwxr-x--- (shared with group)
Recursive Changes
Apply permissions to directories and their contents recursively
Examples:
chmod -R 755 /var/www/- Recursive 755chmod -R u+w ~/projects/- Add write for ownerchmod -R go-rwx ~/private/- Remove all group/other perms
chown: Change File Ownership
Change Owner
Transfer file ownership to another user
Examples:
chown john file.txt- Change owner to johnchown john:staff document.pdf- Change owner and groupsudo chown root /etc/config- Change to root (requires sudo)
Change Group
Change the group association of files
Examples:
chown :developers script.sh- Change group to developerschown john:developers app.py- Change both owner and groupchgrp www-data /var/www/- Alternative group change command
Recursive Ownership
Change ownership recursively for directories
Examples:
chown -R john:developers ~/project/- Recursive ownershipsudo chown -R www-data:www-data /var/www/- Web server ownershipchown -R :staff /shared/data/- Recursive group change
sudo when changing ownership of system files or files owned by other users. Be cautious with recursive ownership changes as they can affect many files.
umask: Default File Permissions
The umask (user mask) determines default permissions for newly created files and directories.
Understanding Umask
Umask is subtracted from maximum permissions to get default permissions
Calculation:
- Files max: 666 (rw-rw-rw-)
- Directories max: 777 (rwxrwxrwx)
- With umask 022: Files: 644, Directories: 755
Common Umask Values
Typical umask settings for different security needs
Values:
- 022 - Files: 644, Directories: 755 (standard)
- 002 - Files: 664, Directories: 775 (group-writable)
- 077 - Files: 600, Directories: 700 (private)
- 027 - Files: 640, Directories: 750 (secure)
Setting Umask
Configure umask for current session or permanently
Permanent Setup:
- Add to
~/.bashrc:umask 002 - System-wide:
/etc/profileor/etc/bash.bashrc - Check current:
umask
Special Permissions
Security Best Practices
- Principle of Least Privilege: Grant only necessary permissions
- Avoid 777: Never use 777 permissions in production
- Secure Home Directories: Use 700 for user home directories
- Web Files: Use 644 for files, 755 for directories in web roots
- Scripts: Use 755 for executable scripts
- Configuration Files: Use 600 for sensitive config files
- Regular Audits: Periodically check permissions with
find / -perm /o=w
Practical Examples and Exercises
Hands-On Practice
# 1. Create test files and check permissions
touch file1.txt file2.txt
mkdir test_dir
ls -l
# 2. Change permissions using symbolic notation
chmod u+x file1.txt
chmod go-w file2.txt
chmod a+r test_dir/
ls -l
# 3. Change permissions using octal notation
chmod 755 file1.txt
chmod 600 file2.txt
chmod 750 test_dir/
ls -l
# 4. Change ownership (requires sudo for system users)
sudo chown root file1.txt
sudo chown :sudo file2.txt
ls -l
# 5. Work with umask
umask
touch newfile.txt
mkdir newdir
ls -l newfile.txt newdir
# 6. Check special permissions
ls -l /usr/bin/passwd # Notice SetUID bit
ls -ld /tmp # Notice Sticky bitUseful Permission Commands
ls -l filename - View permissionsstat filename - Detailed file informationgetfacl filename - View Access Control Listsid - Check your user and group IDsPermission Management:
find /path -perm 644 - Find files with specific permissionsfind /path -user username - Find files owned by userfind /path -group groupname - Find files by groupchmod --reference=file1 file2 - Copy permissions from one file to another
Key Takeaways
File permissions and ownership are fundamental to Linux security. Master chmod for permission management, chown for ownership control, and umask for setting default permissions. Always follow the principle of least privilege, regularly audit permissions, and understand the security implications of special permissions like SetUID and Sticky Bit.
Next Step: Explore Access Control Lists (ACL) for more granular permission control beyond the standard user-group-other model.