BeginnerLinux

Linux File Permissions: Complete Guide to chmod, chown, and Security

A thorough guide to Linux file permissions covering numeric and symbolic modes, ownership, special permissions, umask, directory permissions, and ACLs.

#Linux permissions#chmod#chown#security#Linux administration

Why Linux Permissions Matter

Linux file permissions are the foundation of system security. Every file, directory, and process in Linux is owned by a user and a group, and access is controlled by permission rules. Misconfigured permissions are one of the most common security vulnerabilities on Linux systems — they can allow unauthorized users to read sensitive files, execute malicious code, or modify critical system configurations.

Understanding permissions thoroughly is essential for system administrators, security professionals, and anyone serious about using Linux effectively.

Understanding Permission Types

Every Linux file has three permission categories:

**Owner (user)** — The user who owns the file

**Group** — The group associated with the file

**Others** — Everyone else on the system

Each category can have three permissions:

|------------|--------|---------|-------------|

| Read | r | 4 | View file contents / list directory |

| Write | w | 2 | Modify file / create or delete files in directory |

| Execute | x | 1 | Run file as program / enter directory |

Viewing Permissions

Use ls -l to view file permissions. The output looks like:

-rwxr-xr-- 1 user group  1024 Mar 1 10:00 script.sh
drwxr-x--- 2 user group  4096 Mar 1 10:00 documents/

The first character indicates the file type: - for regular files, d for directories, l for symbolic links. The next nine characters represent permissions, grouped into three sets of three: owner, group, others.

In the example above, -rwxr-xr-- means:

Owner has read, write, and execute (rwx)

Group has read and execute (r-x)

Others have read only (r--)

Numeric (Octal) Mode

Numeric mode represents permissions as octal numbers. Each digit sums the permission values for a category:

rwx = 4+2+1 = 7

rw- = 4+2+0 = 6

r-x = 4+0+1 = 5

r-- = 4+0+0 = 4

-wx = 0+2+1 = 3

-w- = 0+2+0 = 2

--x = 0+0+1 = 1

--- = 0+0+0 = 0

Common Permission Combinations

| Mode | Meaning |

|------|---------|

| 755 | Owner can read/write/execute; group and others can read/execute |

| 644 | Owner can read/write; group and others can read |

| 700 | Owner has full access; everyone else has none |

| 600 | Owner can read/write; everyone else has none |

| 777 | Everyone has full access (dangerous — avoid) |

| 444 | Everyone can read; no one can write |

Using chmod with Numeric Mode

chmod 755 script.sh   # Set rwxr-xr-x
chmod 644 document.txt  # Set rw-r--r--
chmod 700 private/     # Set rwx------

Symbolic Mode

Symbolic mode modifies permissions using letters and operators:

**Target**: u (owner), g (group), o (others), a (all)

**Operator**: + (add), - (remove), = (set exactly)

**Permission**: r, w, x

Examples

chmod u+x script.sh    # Add execute for owner
chmod g-w file.txt     # Remove write for group
chmod o=r file.txt     # Set others to read-only
chmod a+rx script.sh   # Add read and execute for everyone
chmod u=rwx,g=rx,o=    # Set owner rwx, group rx, others none

Changing File Ownership

chown (Change Owner)

chown user file.txt           # Change owner to "user"
chown user:group file.txt     # Change owner and group
chown :group file.txt         # Change group only
chown -R user:group dir/      # Recursively change ownership

Only root can change file ownership. Regular users cannot give away their files.

chgrp (Change Group)

chgrp developers file.txt     # Change group to "developers"

Special Permissions

Beyond the standard rwx permissions, Linux has three special permission bits.

SUID (Set User ID) — 4xxx

When set on an executable file, the process runs with the file owner's privileges rather than the user who executed it. SUID binaries are common for tasks requiring elevated permissions (like passwd modifying /etc/shadow).

chmod u+s executable     # Set SUID (symbolic)
chmod 4755 executable    # Set SUID (numeric — 4 prefix)

SUID introduces security risks if misused. Never set SUID on custom scripts or programs that are not carefully secured.

SGID (Set Group ID) — 2xxx

On files, SGID makes the process run with the file group's privileges. On directories, new files inherit the directory's group instead of the creating user's primary group — useful for shared project directories.

chmod g+s directory      # Set SGID (symbolic)
chmod 2755 directory     # Set SGID (numeric — 2 prefix)

Sticky Bit — 1xxx

The sticky bit (t) on directories restricts file deletion to file owners only. It is most famously used on /tmp,where anyone can create files but cannot delete other users' files.

chmod +t /tmp            # Set sticky bit (symbolic)
chmod 1777 /tmp          # Set sticky bit (numeric — 1 prefix)

A directory with sticky bit appears with a t in the execute position for others: drwxrwxrwt.

umask

The umask specifies which permissions are removed by default when creating new files or directories. It acts as a permission filter.

umask 022    # Default for many systems — files get 644, directories get 755
umask 077    # Restrictive — files get 600, directories get 700

Calculation: default base permissions (666 for files, 777 for directories) minus umask value equals resulting permissions. A umask of 022 means: 666 - 022 = 644 for files, 777 - 022 = 755 for directories.

Directory Permissions

Directory permissions work differently from file permissions:

**Read** on a directory lets you list its contents

**Write** on a directory lets you create, delete, or rename files within it

**Execute** on a directory lets you access files within it and traverse the directory tree

You need execute permission on a directory to access any files inside it, even if you know the exact file path. This is why directories commonly have execute permission for the owner (chmod 755 dir).

Security Best Practices

**Principle of least privilege** — Grant only the minimum permissions needed for a task

**Avoid 777 permissions** — Never make files or directories world-writable unless absolutely necessary

**Be careful with SUID** — Minimize SUID binaries; audit existing ones with `find / -perm -4000`

**Use groups effectively** — Grant team access through group membership rather than world permissions

**Secure sensitive files** — Config files containing passwords should be 600 or 640

**Review permissions regularly** — Audit critical files and directories with `find`

Access Control Lists (ACLs)

For more granular control than traditional permissions provide, Linux supports ACLs that allow setting permissions for specific users or groups beyond the single owner, group, and others.

setfacl -m u:alice:rwx file.txt     # Give alice read/write/execute
setfacl -m g:developers:rx file.txt # Give developers group read/execute
getfacl file.txt                     # View ACLs
setfacl -b file.txt                  # Remove all ACLs

ACLs add complexity but are essential for shared environments with multiple users requiring different access levels.

Mastering Linux permissions takes practice. The key is understanding the underlying model: owner/group/others, read/write/execute, and the special bits. With this foundation, you can secure any Linux system effectively.

Frequently Asked Questions

What do the numbers in chmod 755 mean?

Each digit represents permissions for owner, group, and others. 7 = rwx (read+write+execute), 5 = r-x (read+execute), 5 = r-x. So chmod 755 means the owner can read, write, and execute, while group and others can read and execute.

What is the difference between chmod and chown?

chmod changes file permissions (who can read, write, execute), while chown changes file ownership (who owns the file). Only root can use chown. You need both to properly secure files — set ownership first, then permissions.

What does the sticky bit do?

The sticky bit on directories restricts file deletion to file owners only. It is most famously used on `/tmp`, where anyone can create files but cannot delete other users' files. Set it with `chmod +t directory` or `chmod 1777 directory`.

What is SUID and why is it dangerous?

SUID (Set User ID) makes an executable run with the file owner's privileges rather than the user who ran it. Common for system tools like `passwd`, but dangerous if set on custom programs. Audit SUID binaries with `find / -perm -4000`.

How do I give a user access to a file without making it world-readable?

Use [Access Control Lists (ACLs)](/learn/linux-file-permissions): `setfacl -m u:username:rwx file.txt`. ACLs allow setting permissions for specific users beyond the traditional owner/group/others model. View ACLs with `getfacl file.txt`.

What is umask and how does it work?

Umask specifies which permissions are removed by default when creating files. A umask of 022 means files get 644 (rw-r--r--) and directories get 755 (rwxr-xr-x). Calculate: default base (666 for files, 777 for directories) minus umask equals resulting permissions.

Why do directory permissions differ from file permissions?

For directories: read lists contents, write allows creating/deleting files, and execute allows entering and traversing. You need execute permission to access files inside a directory, even if you know the exact path. This is why directories commonly have 755.

How do I recursively change permissions on a directory?

Use `chmod -R 755 directory/` to recursively set permissions on all files and subdirectories. Be careful with recursive chmod on system directories. For ownership, use `chown -R user:group directory/`.

What does chmod 777 mean and why should I avoid it?

chmod 777 gives everyone full read, write, and execute permissions on a file or directory. This is dangerous because any user can modify or delete the content. Never use 777 on production systems — it is a common security misconfiguration.

How do I find files with dangerous permissions?

Use `find / -perm -4000` to find SUID files, `find / -perm -2000` for SGID files, and `find / -perm -o+w` for world-writable files. Regularly auditing these helps identify potential privilege escalation risks.