Linux File Permissions

Understand and manage Linux file permissions, ownership, and special permission bits.

The Permission Model

Every file has three permission classes: owner, group, and other. Each class has read (r=4), write (w=2), and execute (x=1) bits.

# Example: -rw-r--r-- 1 craig www-data 4096 Jun 16 file.txt
# - = regular file (d = directory, l = symlink)
# rw-  = owner can read and write
# r--  = group can read only
# r--  = others can read only

chmod: Change Permissions

# Numeric mode
chmod 755 script.sh   # rwxr-xr-x  (owner: all, group/others: read+execute)
chmod 644 file.txt    # rw-r--r--  (owner: read+write, others: read)
chmod 600 secret.key  # rw-------  (owner only)
chmod 777 /tmp/shared # rwxrwxrwx  (everyone, avoid in production!)

# Symbolic mode
chmod u+x script.sh   # add execute for owner
chmod g-w file.txt    # remove write for group
chmod o= file.txt     # remove all permissions for others
chmod a+r public.html # add read for everyone

chown: Change Ownership

# Change owner
chown craig file.txt

# Change owner and group
chown craig:www-data /var/www/html

# Recursive
chown -R www-data:www-data /var/www/mysite/

chgrp: Change Group

chgrp developers /opt/project/
chgrp -R developers /opt/project/

Special Permission Bits

# SetUID (run as owner)
chmod u+s /usr/bin/program
# chmod 4755 /usr/bin/program

# SetGID (run as group / inherit group for directories)
chmod g+s /var/shared/
# chmod 2775 /var/shared/

# Sticky bit (only owner can delete in directory)
chmod +t /tmp
# chmod 1777 /tmp

Default Permissions with umask

# View current umask
umask

# Common umask values:
# 022 → files: 644, directories: 755 (default for most systems)
# 027 → files: 640, directories: 750 (more restrictive)

# Set in ~/.bashrc or /etc/profile
echo "umask 027" >> ~/.bashrc

Access Control Lists (ACL)

sudo apt install -y acl

# Give a specific user read access
setfacl -m u:deploy:r /var/www/config.php

# Give a group write access
setfacl -m g:developers:rw /var/www/

# View ACLs
getfacl /var/www/config.php

FAQ

What does chmod 755 mean?

The owner can read, write and execute (7); group and others can read and execute (5). It is the usual setting for folders and scripts.

Is chmod 777 ever a good idea?

Almost never. It lets every user change the file. Fix the owner with chown or give group access instead.