Permissions Management in Linux

Permissions management is one of the most fundamental and important topics in Linux system administration and security. In Linux, every file and directory has an owner, a group, and a set of permissions that determine who can read, modify, or execute it. This article walks you step by step through the concepts and commands of permissions management in simple language.

1. Basic Concepts: User, Group, and Others

In Linux, file access is defined on three levels:

• User / Owner: The user who created the file. Typically, the owner has the most permissions.
• Group: A collection of users who belong to the same group. Group members can have specific access privileges.
• Others: All other users who are neither the owner nor members of the group.

For each of these three levels, three types of permissions are defined: Read (r), Write (w), and Execute (x).

2. Viewing Permissions with ls -l

Use ls -l to view the permissions of files and directories:

ls -l

The output looks like this:

-rwxr-xr-- 1 user group 1024 May 20 10:00 file.txt

Here, the string -rwxr-xr-- represents the permissions. This string is divided into the following parts:

• The first character: indicates the file type (- for a regular file, d for a directory).
• The next three characters: permissions for the owner (rwx means read, write, and execute).
• The next three characters: permissions for the group (r-x means read and execute, but not write).
• The last three characters: permissions for others (r-- means only read).

3. Changing Permissions with chmod

chmod (Change Mode) is the command for changing file and directory permissions. There are two main ways to use chmod: numeric (octal) mode and symbolic mode.

Numeric (Octal) Method

In this method, each permission is represented by a number:

• 4 = read (r)
• 2 = write (w)
• 1 = execute (x)

The numbers for each level (owner, group, others) are added together. For example, permission rwx equals 4+2+1=7. Permission r-x equals 4+0+1=5.

Usage examples:

chmod 755 script.sh
# Owner: 7 (rwx), Group: 5 (r-x), Others: 5 (r-x)

chmod 644 file.txt
# Owner: 6 (rw-), Group: 4 (r--), Others: 4 (r--)

Symbolic Method

In this method, letters and operators are used to change permissions.

• u = user (owner)
• g = group
• o = others
• a = all (ugo)
• + = add permission
• - = remove permission
• = = set exact permission

chmod u+x script.sh
# Add execute permission for the owner

chmod go-w file.txt
# Remove write permission for group and others

chmod a=r file.txt
# Set read-only permission for everyone

4. Changing Owner with chown

chown (Change Owner) is used to change the owner of a file or directory. Running this command requires root privileges or sudo.

sudo chown new_owner file.txt
# Change file owner to new_owner

sudo chown new_owner:new_group file.txt
# Change both owner and group

5. Changing Group with chgrp

chgrp (Change Group) is used to change the group of a file or directory.

chgrp new_group file.txt
# Change file group to new_group

6. Special Permissions: SUID, SGID, and Sticky Bit

In addition to standard permissions, Linux has three special permissions that affect behavior in specific ways.

SUID (Set User ID)

When SUID is set on an executable file, the program runs with the permissions of the file's owner, not the user who executed it. This permission is shown as s in the owner's execute position.

chmod u+s executable_file

SGID (Set Group ID)

On executable files, SGID causes the program to run with the permissions of the file's group. On directories, it ensures that new files created inside inherit the directory's group.

chmod g+s directory_name

Sticky Bit

The Sticky Bit is typically set on shared directories like /tmp. When active, only the file's owner can delete or rename it, even if others have write permissions.

chmod +t directory_name

How these appear in ls -l:

• SUID: -rwsr-xr-x
• SGID: -rwxr-sr-x
• Sticky Bit: -rwxr-xr-t

7. Default Permission Mask (umask)

umask (User file-creation mask) determines the default permissions for newly created files and directories. The umask value is subtracted from the full permissions (666 for files, 777 for directories).

umask
# Display current value (e.g., 0022)

umask 0022
# Set umask to 0022

With umask=0022, default file permissions are 644 (666-022) and directories are 755 (777-022).

8. Practical Examples

Example 1: Making a Script Executable

Suppose you've written a script file called backup.sh. To make it executable for the owner:

chmod u+x backup.sh
# or
chmod 755 backup.sh

Example 2: Protecting a Personal Folder

To restrict access to a Private folder to only the owner:

chmod 700 Private

Example 3: Setting Permissions for a Web Server Folder

In the /var/www/html folder, the web server (which runs as user www-data) needs to read files.

sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html

Example 4: Changing File Owner to Another User

sudo chown john file.txt

Conclusion and Next Steps

In this article, you learned the core concepts and commands of permissions management in Linux. You can now manage file and directory access as you wish. To go further:

• Learn the id command to view your user groups.
• Study ACL (Access Control Lists) for more advanced permissions.
• Work with umask in configuration files like ~/.bashrc.
• Read «The Linux Command Line» (available at Linux Library) for deeper learning.