Chapter 5: Linux Permissions and Ownership

Linux’s permission system controls file security by defining who can read, write, or execute files. This chapter explains how to view and modify these permissions. Linux permissions enforce security boundaries, preventing unauthorized access to sensitive files (like configs, SSH keys, or databases) while enabling controlled sharing in multi-user environments. They protect against accidental deletions, malicious tampering, and privilege escalation—ensuring only authorized users and processes can read, modify, or execute files.

1. Understanding File Permissions

Every file/directory has permissions for three entities:

View permissions with ls -l:

-rwxr-xr-- 1 user group 1024 Jan 1 10:00 file.txt

-rwxr-xr-- 1 user group 1024 Jan 1 10:00 file.txt

• -rwxr-xr-- = Permission string
• user = Owner
• group = Group owner

2. Permission Types (rwx)

Each entity gets three permissions:

Example Breakdown:
-rwxr-xr--

• Owner (u): rwx → Read, Write, Execute
• Group (g): r-x → Read, Execute
• Others (o): r-- → Read only

3. Changing Permissions (chmod)

A. Numeric Mode (Octal)

Permissions are represented as numbers:

• 4 = Read (r)
• 2 = Write (w)
• 1 = Execute (x)

Add them for combined permissions:

• 7 (4+2+1) = rwx
• 6 (4+2) = rw-
• 5 (4+1) = r-x

Common Examples:

chmod 755 file.txt    # rwxr-xr-x (Owner: full, Group/Others: read+execute)
chmod 644 file.txt    # rw-r--r-- (Owner: read+write, Others: read)
chmod 700 script.sh   # rwx------ (Only owner can access)

chmod 755 file.txt    # rwxr-xr-x (Owner: full, Group/Others: read+execute)
chmod 644 file.txt    # rw-r--r-- (Owner: read+write, Others: read)
chmod 700 script.sh   # rwx------ (Only owner can access)

B. Symbolic Mode (Letters)

Modify permissions for specific entities:

• u = User
• g = Group
• o = Others
• a = All (default)

Operators:

• + Add permission
• - Remove permission
• = Set exact permission

Examples:

chmod u+x script.sh    # Add execute for owner
chmod go-w file.txt    # Remove write from group & others
chmod a=rw shared.txt  # Set read+write for everyone

chmod u+x script.sh    # Add execute for owner
chmod go-w file.txt    # Remove write from group & others
chmod a=rw shared.txt  # Set read+write for everyone

4. Changing Ownership (chown)

Transfer file ownership to another user.

chown newuser file.txt          # Change owner
chown newuser:newgroup file.txt # Change owner & group
chown -R user:group /dir/       # Recursively change (for directories)

chown newuser file.txt          # Change owner
chown newuser:newgroup file.txt # Change owner & group
chown -R user:group /dir/       # Recursively change (for directories)

5. Changing Group (chgrp)

Modify group ownership (alternative to chown):

chgrp developers file.txt
chgrp -R staff /project/      # Recursive change

chgrp developers file.txt
chgrp -R staff /project/      # Recursive change

Cheat Sheet

Practical Scenarios

1. Make a script executable:
   • chmod +x install.sh
2. Secure private files:
   • chmod 600 ~/.ssh/id_rsa # Only owner can read/write
3. Share files with a group:
   • chmod 775 /team/docs/ # Group members can edit chgrp team /team/docs/