File permissions
Every file carries permissions for its owner, its group, and everyone else. Reading and setting them correctly is fundamental to Linux security.
Owner, group, others
Each file has an owning user and an owning group. Permissions are given in three sets: for the owner (user, u), members of the file's group (g), and everyone else (others, o). When a process accesses a file, the kernel checks whether the process's user is the owner, then whether it is in the group, and applies the first matching set only.
Read, write, execute
Each set has three bits: read (r), write (w), and execute (x). ls -l shows them after the file type, as in -rw-r--r--: the owner can read and write, group and others can only read. For regular files, x allows running the file as a program. For directories, r allows listing names, w allows creating, deleting, and renaming entries, and x allows entering the directory and accessing entries by name.
Octal notation
Each set can be written as a digit, adding 4 for read, 2 for write, and 1 for execute. rwx is 7, rw- is 6, r-x is 5, r-- is 4. So 644 means rw-r--r--, typical for documents; 755 means rwxr-xr-x, typical for programs and directories; 600 means rw-------, appropriate for private keys; and 700 suits private directories.
chmod, chown, chgrp
chmod changes permissions, numerically (chmod 640 report.txt) or symbolically (chmod u+x script.sh, chmod g-w,o-r data.csv, chmod -R for directories recursively). chown changes the owner and optionally the group (chown ana:developers file); chgrp changes only the group. Only root can give files away to other users.
umask
New files get default permissions masked by the umask, which removes bits. Programs typically request 666 for files and 777 for directories; with the common umask 022, files become 644 and directories 755; with umask 077, they become 600 and 700, private to the owner. The umask command shows or sets the current value.
Special bits
The setuid bit on an executable makes it run with the file owner's privileges: /usr/bin/passwd is setuid root so users can update /etc/shadow. Setgid on executables runs them with the file's group; on directories, it makes new files inherit the directory's group, useful for shared project folders. The sticky bit on a directory, as on /tmp, lets users delete only their own files. ls shows these as s and t.
Access control lists
Standard permissions allow only one owner and one group. Access control lists (ACLs) grant permissions to additional specific users and groups: setfacl -m u:ben:rw report.txt gives Ben read and write access, and getfacl report.txt displays the full list. A + after the permission string in ls -l signals that an ACL is present.
Worked example
A team folder /srv/project should be shared by the developers group, with new files automatically belonging to that group, and closed to others. sudo chgrp developers /srv/project; sudo chmod 2770 /srv/project. The 2 sets setgid, so new files get group developers; 770 gives owner and group full access and others none. Members should use a umask of 002 so new files are group-writable.
Key takeaways
Files have an owner, a group, and permission sets for user, group, and others; the first matching set applies. Read, write, and execute mean different things for files and directories: x on a directory allows entering it. Octal digits add 4, 2, and 1: 644, 755, 600, and 700 are common. chmod, chown, and chgrp change permissions and ownership. The umask, often 022 or 077, removes default bits. Setuid runs programs as their owner, setgid shares group ownership, and the sticky bit protects files in shared directories like /tmp. ACLs, managed with setfacl and getfacl, grant extra users or groups access.
Flashcard
User, group, others
Check your understanding
A directory has permissions rw-r--r-- (644). Why can't even its owner cd into it?