8.3 Standard File Permissions: chmod, chown, chgrp & umask (104.5)

8.3 Standard File Permissions: chmod, chown, chgrp & umask

Quick Summary: Linux enforces security at the filesystem level using standard POSIX Discretionary Access Control (DAC). Every file and directory on disk is associated with an individual user owner and a group owner. Permissions are partitioned into three distinct classes: User (u), Group (g), and Others (o). Each class can be granted Read (r), Write (w), and Execute (x) privileges. Modifying access modes is performed using chmod (via octal numbers or symbolic syntax), changing file ownership is handled by chown and chgrp, and default permission filtering on new files is governed by umask. Understanding directory vs. regular file permission semantics is one of the most heavily tested areas on the LPIC-1 exam.

---

1. POSIX Discretionary Access Control (DAC) Model

When inspecting files using ls -l, the first column displays a 10-character mode string representing the file type and the 9 standard DAC permission bits:

-rwxr-xr-- 1 alice developers 4096 Aug 29 10:00 deploy.sh
│└─┬─┘└─┬─┘└─┬─┘
│  │    │    └── Others (o) Permissions: r-- (Read only)
│  │    └─────── Group (g) Permissions:  r-x (Read & Execute)
│  └──────────── User (u) Permissions:   rwx (Read, Write, & Execute)
└─────────────── File Type: '-' = Regular File ('d' = Directory, 'l' = Symlink)

The DAC Evaluation Hierarchy

When a process attempts to access a file, the Linux kernel evaluates permissions in a strict first-match-wins order:

1. If the executing user's UID matches the file's User Owner, only the User (u) permissions apply. Kernel evaluation stops immediately.
2. If the UID does not match, but the process belongs to the file's Group Owner (or one of its supplementary groups), only the Group (g) permissions apply. Kernel evaluation stops.
3. If neither UID nor GID match, the Others (o) permissions apply.

---

2. File vs. Directory Permission Semantics (Exam Critical)

The interpretation of r, w, and x bits differs fundamentally between regular files and directories.

Comparison of Permission Semantics

⚠️ LPIC-1 Trap — Deleting a Write-Protected File: A widespread exam misconception is that deleting a file requires write permission on the file itself. This is false. Deletion removes a directory entry (dentry) from the parent directory. Therefore, deleting or renaming a file requires Write (w) and Execute (x) permissions on the parent directory, regardless of what permissions exist on the file being deleted! A user with write access to a directory can delete a read-only file (chmod 400 file) owned by another user.

---

3. Modifying Permissions with chmod

The chmod (change mode) command modifies file and directory permission bits using either Octal (Numeric) or Symbolic notation.

1. Octal (Numeric) Mode

Permissions are represented as a 3-digit (or 4-digit when special bits are present) octal number calculated by summing the binary bit values for each entity:

$\text{Read} (r) = 4, \quad \text{Write} (w) = 2, \quad \text{Execute} (x) = 1, \quad \text{None} (-) = 0$

# Standard configurations:
$ chmod 755 script.sh     # u=rwx (7), g=r-x (5), o=r-x (5)
$ chmod 644 document.txt  # u=rw- (6), g=r-- (4), o=r-- (4)
$ chmod 700 private_dir/  # u=rwx (7), g=--- (0), o=--- (0)
$ chmod 600 id_rsa        # u=rw- (6), g=--- (0), o=--- (0)

2. Symbolic Mode

Symbolic syntax uses references, operators, and permission symbols:

chmod [references][operator][permissions] <file>

• References: u (User/Owner), g (Group), o (Others), a (All / ugo).
• Operators: + (adds permission), - (removes permission), = (sets exact permissions, removing unlisted ones).
• Permissions: r (read), w (write), x (execute), X (conditional execute).

# Add execute permission for the file owner only:
$ chmod u+x deploy.sh

# Remove write permission from group and others:
$ chmod go-w sensitive.log

# Set exact permissions: user gets read/write, group gets read, others get none:
$ chmod u=rw,g=r,o= config.ini

# Add read permission for all users:
$ chmod a+r readme.md

The Conditional Execute (X) Flag

The uppercase X permission is an exam favorite: it applies execute permission only if the target is a directory OR already has execute permission set for at least one user class.

# Recursively grant read and execute on directories and existing executables, 
# without turning regular text files into executables:
$ chmod -R a+rX /var/www/html

Useful chmod Command Flags

• -R (--recursive): Recursively applies permission changes across all subdirectories and files.
• -v (--verbose): Outputs a diagnostic message for every processed file.
• -c (--changes): Like verbose, but reports only files whose permissions were actually modified.

---

4. Managing Ownership: chown and chgrp

Only the root superuser can transfer file ownership to another user. Standard users cannot "give away" files to other users.

The chown Command Syntax Variants

# 1. Change user owner only:
$ sudo chown alice report.pdf

# 2. Change both user owner and group owner simultaneously (colon separator):
$ sudo chown alice:developers report.pdf

# 3. Change group owner only (leading colon):
$ sudo chown :developers report.pdf

# 4. Change user and set group to that user's primary login group (trailing colon):
$ sudo chown alice: report.pdf

# 5. Legacy dot syntax (accepted but discouraged due to usernames containing dots):
$ sudo chown alice.developers report.pdf

The chgrp Command

The chgrp command specifically alters the group ownership of files. Non-root users may use chgrp to change a file's group, provided they own the file and are a member of the target group:

$ chgrp developers project_notes.txt
$ chgrp -R finance /srv/finance_docs

Ownership Flags: -R and -h

• -R: Recursively changes ownership across all child files and subdirectories.
• -h (--no-dereference): Changes the ownership of a symbolic link itself, rather than changing the target file to which the symlink points.

---

5. File Creation Mask: umask Mechanics & Calculations

When a program creates a new file or directory, it requests maximum base permissions from the kernel:

• Base mode for regular files: 666 (rw-rw-rw- — executables are never created by default for security).
• Base mode for directories: 777 (rwxrwxrwx — directories require execute to permit traversal).

The umask (User Mask) is an environment setting that acts as a bitwise filter, stripping away specified permission bits before the file is written to disk.

Mathematical Calculation: Base AND NOT Umask

$\text{Effective Permissions} = \text{Base Permissions} \;\&\; (\sim\text{Umask})$

For standard octal values, umask operates like subtraction from the base:

⚠️ LPIC-1 Trap — The Odd Bit Umask Calculation: If a umask contains odd numbers (such as umask 033), simple arithmetic subtraction fails on regular files. 666 - 033 is not 633 because regular files never receive execute bits (1) in their base mode. In binary: Base 666 (110 110 110) AND NOT 033 (000 011 011) yields 110 100 100 = 644 (rw-r--r--).

Viewing and Setting umask

# Display current umask in octal format:
$ umask
0022

# Display current umask in symbolic format:
$ umask -S
u=rwx,g=rx,o=rx

# Set a new restrictive umask for the current shell session:
$ umask 027

Persistent default umasks are configured globally in /etc/profile, /etc/bash.bashrc, or /etc/login.defs, and per-user in ~/.bashrc.

💡 LPIC-1 Exam Fill-in-the-Blank Alert: If a system's current umask is set to 027, what numeric permission mode will be assigned to a newly created regular file? Answer: 640 (or 0640)