5.1 List, Set, and Change Standard ugo/rwx Permissions

Standard ugo/rwx permissions are a daily RHCSA skill. On Red Hat Enterprise Linux, every file and directory has an owner user, an owner group, and a mode that grants or denies read (r), write (w), and execute (x) to the user (u), group (g), and other (o) classes. EX200 tasks may ask you to create shared directories, lock down configuration files, or fix “permission denied” after a copy as root. Modes and ownership you set on disk persist across reboot—there is no separate “enable” step for ordinary permissions.

Why Permissions Matter on the Exam

Performance scenarios commonly include:

• A project directory that only members of a named group may write
• A script that must be executable by its owner but not world-writable
• A config under /etc or an application tree that must be owned by a service account
• Diagnosing why a user can list a directory but not cd into it (missing directory execute)

SELinux contexts and umask defaults appear under security objectives later. This section focuses on classic discretionary access control: list with ls -l, change mode with chmod, change owner/group with chown/chgrp.

Reading ls -l Output

Long listing is your primary verification tool:

ls -l /path/to/file
ls -ld /path/to/directory    # directory itself, not its contents
ls -la                        # include hidden names starting with .
stat /path/to/file            # detailed mode, uid/gid numbers, timestamps

Example line:

-rw-r--r--. 1 student developers 4096 Aug 5 10:00 report.txt
drwxr-x---. 2 root    admins        6 Aug 5 09:30 shared
lrwxrwxrwx. 1 root    root         11 Aug 5 08:00 link -> /etc/hosts

Meaning of r, w, and x

Exam trap: Directory write controls creating and deleting names inside the directory, not merely editing an existing file’s contents. File write controls content. Directory execute is required to use a path component even if you know the exact filename—without x on each directory in the path, access fails with “Permission denied.”

Who matches which class?

Kernel checks, in order:

1. If the process effective UID matches the file owner → use the user (owner) rwx triad.
2. Else if any process group matches the file group → use the group triad.
3. Else → use other.

There is no “union” of group and other for the same process. Owner bits apply exclusively when UIDs match—even if group bits are wider. That surprises people who expect group write while owning the file with mode --- on user.

chmod: Symbolic Mode

chmod changes the mode. Symbolic form is precise and readable:

chmod WhoWhatWhich file...

• Who: u user, g group, o other, a all (ugo). Multiple letters allowed: ug.
• What: + add, - remove, = set exactly (clears unspecified bits in that class).
• Which: r, w, x; also X (conditional execute—set x on dirs or already-executable files), and special s/t (light touch below).

Examples:

chmod u+x script.sh              # owner may execute
chmod go-w secrets.conf          # remove write from group and other
chmod u=rw,g=r,o= report.txt     # owner rw, group r, other nothing
chmod a+r README                 # everyone read
chmod g+w,o-rwx /projects/app    # group write; strip other entirely
chmod -R g+X /srv/data           # recursive: add group execute only where X applies

Multiple clauses can be comma-separated. Recursive -R walks trees—use carefully on system directories.

chmod: Octal (Numeric) Mode

Each triad is a 3-bit number: r=4, w=2, x=1. Sum per class:

Three digits set user, group, other:

chmod 755 /usr/local/bin/tool    # rwxr-xr-x
chmod 640 /etc/myapp/app.conf    # rw-r-----
chmod 700 ~/.ssh                 # rwx------ (typical private dir)
chmod 600 ~/.ssh/id_ed25519      # rw------- (typical private key)
chmod 644 /var/www/html/index.html  # rw-r--r--

A leading fourth digit sets special bits (for example 4755 for SUID + 755). For this objective, master three-digit modes first; recognize four-digit forms when you see them in stat or documentation.

When to prefer which form: Octal is fast for absolute policy (“make this 640”). Symbolic is safer for relative tweaks (“add group write without touching other bits”). Both appear in real admin work and exam write-ups.

Default Modes and umask (Preview)

New files are not always 666 and directories 777 on disk: the process umask clears bits from the creation mask. Typical interactive umask 022 yields files 644 and directories 755. Managing default umask is a later security objective; for now, after touch or mkdir, verify with ls -l and adjust with chmod when the task specifies an exact mode.

chown and chgrp

chown

chown user file
chown user:group file
chown user: file              # user and that user's primary group (syntax variant)
chown :group file             # group only (same idea as chgrp)
chown -R user:group /path     # recursive tree

Only root (or a process with sufficient capability) can change ownership to another user in normal configurations. Ordinary users cannot “give away” files to others on modern Linux the way some legacy systems allowed.

Examples:

sudo chown student:developers /home/student/project
sudo chown -R apache:apache /var/www/html
sudo chown root:root /etc/myapp/config

chgrp

chgrp developers shared-dir
chgrp -R developers /srv/project

A file’s owner may change the group to a group they belong to (subject to policy); changing to an arbitrary group usually requires privilege. Prefer explicit chown user:group when both must change in one step.

Always re-list:

ls -ld /srv/project
namei -l /srv/project/file.txt   # optional: walk path permissions

Special Bits: Light Overview (SUID, SGID, Sticky)

The same nine mode slots can show s, S, t, or T instead of plain x when special bits are set. Full security design is later; RHCSA candidates must read them so ls -l never confuses you.

ls -ld /tmp
# drwxrwxrwt. ... /tmp    ← sticky bit (t) on other

ls -l /usr/bin/passwd
# -rwsr-xr-x. ... passwd  ← SUID (s) on user execute

Symbolic special forms exist (chmod u+s, g+s, +t); octal uses the high digit (4 SUID, 2 SGID, 1 sticky). Do not set SUID/SGID casually on exam systems unless the task requires it—misuse is a security problem. For this chapter, interpret special bits when listing, and keep standard rwx changes correct.

Practical Exam Workflows

Lock down a config file

Requirement: owned by root, group root, mode 640.

sudo chown root:root /etc/myapp/app.conf
sudo chmod 640 /etc/myapp/app.conf
ls -l /etc/myapp/app.conf

Shared group directory (standard bits only)

Requirement: /projects/team owned by root:developers, mode 2775 appears in many real designs (SGID); if the task only says “group developers may rwx, others none,” start with ownership and 770/2770 as specified:

sudo mkdir -p /projects/team
sudo chown root:developers /projects/team
sudo chmod 770 /projects/team
ls -ld /projects/team

If the grader later expects setgid collaboration, you will add g+s under security/shared-directory practice—here, nail ugo and ownership first.

Fix “cannot cd”

User can ls /data sometimes but fails deeper:

namei -l /data/app/bin/tool
# Ensure each directory component has x for that user’s class
sudo chmod o+x /data /data/app   # only if policy should allow other traverse

Prefer least privilege: grant group execute to the right group rather than world x when the task names a group.

Script must run

chmod u+x ~/bin/backup.sh
# or: chmod 755 ~/bin/backup.sh
ls -l ~/bin/backup.sh

Shebang scripts still need read permission for the interpreter to read the text; execute alone is not always enough for scripts.

Common Pitfalls

• Using chmod 777 as a blunt fix—works briefly, fails security-minded grading and real policy
• Changing a file’s mode but leaving parent directories without traverse (x) for the user
• Running as root, creating files under a user home, forgetting chown user:user
• Confusing octal digit order (user-group-other) or mixing up 644 vs 664
• Applying chmod -R from / or /etc by path typo—always check pwd and path
• Misreading s/t as ordinary execute when diagnosing setuid programs or /tmp
• Assuming group write helps the owner when owner triad is ---

RHEL 10 and Persistence Notes

Permission and ownership live in the filesystem inode metadata. After chmod/chown, a reboot keeps the settings. No systemctl enable is involved. If a task also involves a service reading the file, you may still need to restart that service for the application to reopen the path—but the mode itself is already durable.

Coreutils on RHEL provide GNU chmod, chown, chgrp, and ls. Prefer portable flags you will remember under stress: ls -l, ls -ld, chmod 640, chown user:group.

Section Checkpoint

You should be able to decode any ls -l mode line, explain r/w/x on files versus directories, set exact modes with symbolic and octal chmod, change owner and group safely, verify every change, and recognize SUID/SGID/sticky notation without freezing. Those skills underpin later diagnose-and-correct permission objectives and shared multiuser directory designs.