5.3 Managing File Permissions and Ownership
Key Takeaways
- ls -l shows type, mode bits, owner, group, size, and name; ls -a also reveals hidden names starting with a dot
- Permission bits are read (r), write (w), and execute (x) for user (u), group (g), and others (o)
- chmod changes mode bits with symbolic forms (u+x) or octal forms (755); chown changes owner and optionally group
- Common modes: 755 for executable programs/directories, 644 for ordinary shared files, 600 for private files
- Execute permission on a directory means you may traverse/enter it; read lets you list names when listing is allowed
5.3 Managing File Permissions and Ownership
File permissions are the everyday security mechanism every Linux user touches. Topic 5.3 expects you to read a long listing, decode rwx triplets, and change modes and ownership with chmod and chown.
Reading ls -l and ls -a
ls -l
ls -a
ls -la
| Command | What you gain |
|---|---|
ls -l | Long format: mode, links, owner, group, size, timestamp, name |
ls -a | Includes hidden entries (names starting with .) |
ls -la | Both: long listing including hidden files |
A long line looks like:
-rw-r--r-- 1 alice developers 1200 Jul 23 09:15 report.txt
Break down the mode field -rw-r--r--:
| Characters | Meaning |
|---|---|
1st (-) | File type: - regular file, d directory, l symlink |
2–4 (rw-) | User/owner permissions |
5–7 (r--) | Group permissions |
8–10 (r--) | Others permissions |
So report.txt is a regular file: owner can read/write; group and others can read only.
Meaning of r, w, and x
| Bit | On a regular file | On a directory |
|---|---|---|
| r (read) | Read file contents | List directory entries |
| w (write) | Modify/truncate file | Create/delete/rename entries inside (sticky bit in 5.4 can restrict deletes) |
| x (execute) | Run as a program/script | Traverse/enter the directory (cd through it) |
For directories: x = enter/traverse, w = change contents, r = list names. Missing execute on a directory blocks cd even if file modes inside look open.
Classes: user, group, others
| Shorthand | Class | Who it matches |
|---|---|---|
u | User (owner) | The file’s owner UID |
g | Group | Users in the file’s group GID |
o | Others | Everyone else |
a | All | u+g+o in symbolic mode |
Linux checks owner first, then group, then others. If you are the owner, your access comes from the owner bits—even if you are also in the group.
chmod: symbolic mode
chmod u+x script.sh # add execute for owner
chmod go-w notes.txt # remove write from group and others
chmod a+r readme.md # everyone may read
chmod u=rwx,go=rx appdir # set exact bits for a directory
| Operator | Effect |
|---|---|
+ | Add permissions |
- | Remove permissions |
= | Set exactly (replaces that class’s bits) |
chmod: octal mode (essentials)
Octal uses three digits for u, g, and o. Each digit is 4 (r) + 2 (w) + 1 (x).
| Value | Bits | Meaning |
|---|---|---|
| 7 | rwx | read + write + execute |
| 6 | rw- | read + write |
| 5 | r-x | read + execute |
| 4 | r-- | read only |
| 0 | --- | none |
Memorize these common modes:
| Mode | Bits (approx.) | Typical use |
|---|---|---|
| 755 | rwxr-xr-x | Programs and many directories |
| 644 | rw-r--r-- | Ordinary data files others may read |
| 600 | rw------- | Private files (SSH keys, secrets) |
chmod 644 report.txt
chmod 600 secret.env
chmod 755 backup.sh
Worked chmod sequences (symbolic ↔ octal)
touch notes.txt script.sh secret.key
chmod 644 notes.txt # rw-r--r--
chmod u+x script.sh # add owner execute
chmod 755 script.sh # same end state in one octal step
chmod go-rwx secret.key # strip group/other
chmod 600 secret.key # equivalent → rw-------
ls -l notes.txt script.sh secret.key
| Goal | Symbolic | Octal |
|---|---|---|
| Readable doc | chmod a+r (drop go write if needed) | 644 |
| Private credential | chmod go-rwx | 600 |
| Runnable script | chmod u+x then go=rx | 755 |
| Group-writable data | chmod g+w | 664 |
Directory example:
chmod 755 ~/public_htmllets other accounts traverse (x) into the tree; files inside often stay644.chmod 700on that directory blockscdfor others even when file modes look open.
Changing ownership with chown
sudo chown alice report.txt
sudo chown alice:developers project/
sudo chown :developers shared.txt
| Form | Effect |
|---|---|
chown user file | Set owner |
chown user:group file | Set owner and group |
chown :group file | Set group only (common syntax) |
chown usually requires root (via sudo). The file owner may run chmod. Wrong mode → chmod; wrong owner/group → chown.
Worked scenario:
samcreatesdata.csvat644. Root runschown sam:analysts data.csvandchmod 664 data.csvso group members can write.
Worked
chownpath:sudo mkdir -p /srv/team/inbox sudo chown sam:analysts /srv/team/inbox sudo chmod 775 /srv/team/inbox echo "hello" | sudo tee /srv/team/inbox/readme.txt >/dev/null sudo chown sam:analysts /srv/team/inbox/readme.txt sudo chmod 664 /srv/team/inbox/readme.txt ls -l /srv/team/inbox/readme.txtExpect owner
sam, groupanalysts, mode-rw-rw-r--. Analysts can edit; outsiders can only read. Ifls -lstill showsroot:root,chownwas skipped—chmodnever renames the owner.
Putting it together
- Use
ls -lato see hidden files and mode bits. - Decide file vs directory—x means different things.
- Prefer 600 for secrets, 644 for ordinary readable files, 755 for executables/directories others must traverse.
- Fix ownership with
chownwhen the wrong user/group owns the object.
Permissions are the heart of Topic 5. Sticky directories and symlinks in 5.4 build on this rwx foundation.
What does execute (x) permission primarily allow on a directory?
Which octal mode is commonly used for a private file that only the owner should read and write?
In the listing -rw-r--r-- 1 alice staff 100 Jul 1 notes.txt, what can users who are not alice and not in staff do?
Which command changes a file’s owner (and often requires elevated privileges)?