File Permissions
File permissions decide who can do what with a file. On Linux, every file has an owner and a group, and three sets of rules: what the owner can do, what the group can do, and what everyone else can do. Each set allows or blocks reading, changing, and running the file. Most “Permission denied” errors come down to these rules.
Each file’s inode stores an owner (UID), a group (GID), and a mode: three permission triplets plus special bits.
Reading ls -l: -rwxr-x--- means file type -, owner rwx, group r-x, others ---.
What r, w, x mean:
| File | Directory | |
|---|---|---|
| r (4) | read contents | list names |
| w (2) | modify contents | create, delete, rename entries |
| x (1) | run as a program | enter it (cd) and access files inside |
Octal: add the values per triplet. 755 = rwxr-xr-x (programs, directories), 644 = rw-r--r-- (normal files), 600 = rw------- (private keys), 700 (private directories).
Changing them:
chmod 640 fileorchmod u+x,go-w filechown user:group file(requires root to give away files)umasksets defaults for new files (Ubuntu:0002for users, so files are664)
Special bits: setuid (4xxx, runs as the file’s owner; passwd uses it), setgid (2xxx, on directories new files inherit the group), sticky (1xxx, on /tmp users can only delete their own files).
Beyond the basics: ACLs (setfacl) for per-user rules, and AppArmor or SELinux for mandatory access control.
Source: chmod(1) Linux manual page
Reading and fixing permissions
$ ls -l
-rw-r--r-- 1 george george 220 Nov 1 09:30 notes.md
-rwxr-xr-x 1 george george 84 Nov 1 09:31 backup.sh
drwx------ 2 george george 4096 Nov 1 09:32 private
# Make a script runnable
$ chmod +x backup.sh
# SSH refuses keys that others can read
$ chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519
# Numeric and symbolic mode together
$ stat -c "%a %A %U:%G %n" notes.md
644 -rw-r--r-- george:george notes.md
# Hand a web directory to the service user
$ sudo chown -R www-data:www-data /srv/sitePermissions are behind a large share of Linux support tickets: a script that will not run (missing x), a web server that cannot read its files (wrong owner), SSH ignoring a key (too open). The fix is to understand the specific need and grant just that. Never reach for chmod -R 777; it hides the real problem and makes files writable by anyone. Security audits look specifically for world-writable files and unexpected setuid binaries.