Understanding File Permissions and Ownership

Why permissions exist

Linux is a multi-user system. Even on a personal laptop, many programs run as different internal users. Permissions decide who may read a file, who may change it and who may run it. They protect your files from other users and protect the system from mistakes.

Owner, group and others

Every file and directory has an owner (a user) and a group (a named set of users). Permissions are set separately for three kinds of people:

• the owner
• the group
• others, which means everybody else

List files in long format to see all of this:

ls -l

-rwxr-xr--  1 alex devs  2048 Oct 3 10:15 script.sh

Reading from the left:

• -rwxr-xr-- is the permission string, explained next.
• alex is the owner.
• devs is the group.
• 2048 is the size in bytes, followed by the date and the file name.

Reading the permission string

The first character is the type: - for a regular file and d for a directory. The next nine characters are three groups of three, for the owner, the group and others in that order.

 -   rwx   r-x   r--
 |    |     |     |
type owner group others

Each group uses the same three letters:

• r is read: look at the contents.
• w is write: change the contents.
• x is execute: run the file as a program or script.
• - means that permission is not granted.

So rwxr-xr-- means: the owner can read, write and run; the group can read and run; others can only read.

The numeric form

Each permission has a number: read is 4, write is 2, execute is 1. Add the numbers for each group to get one digit.

• rwx = 4 + 2 + 1 = 7
• r-x = 4 + 0 + 1 = 5
• r-- = 4
• --- = 0

Three digits give the owner, group and others. So rwxr-xr-- is 754.

Changing permissions with chmod

chmod ("change mode") sets permissions. With numbers:

chmod 755 script.sh
chmod 644 notes.txt
chmod 600 secret.txt

• 755: owner can read, write and run. Group and others can read and run. Typical for scripts and programs.
• 644: owner can read and write. Group and others can only read. Typical for ordinary files.
• 600: only the owner can read and write. Typical for private files such as keys.
• 777: everyone can do everything. Avoid it.

The letter form

Letters are easier when you want to change one thing without touching the rest. The format is who, then + or -, then what.

• Who: u user (the owner), g group, o others, a all.
• + adds a permission and - removes one.

chmod +x script.sh
chmod u+x script.sh
chmod go-w file.txt
chmod a+r file.txt

A very common error

You write a script and try to run it, and Bash answers Permission denied:

./backup.sh

bash: ./backup.sh: Permission denied

The file is missing the execute permission. Add it and run again:

chmod +x backup.sh
./backup.sh

Permissions on directories

For directories the letters mean something slightly different:

• r: you can list the names inside.
• w: you can create, delete and rename files inside.
• x: you can enter the directory, for example with cd.

A directory without x cannot be entered, even if you can see that it exists.

Changing ownership: chown and chgrp

sudo chown bob file.txt
sudo chown bob:devs file.txt
sudo chgrp devs file.txt
sudo chown -R bob projects/

• chown bob file.txt makes bob the owner.
• chown bob:devs file.txt sets the owner and the group together, written owner:group.
• chgrp changes only the group.
• -R applies the change to a directory and everything inside it.

Only the administrator can give a file to another user, which is why these commands start with sudo.

A word about sudo

sudo means "run this command with administrator (root) rights". It asks for your password. Use it only when you understand what the command does, because root can overwrite or delete anything.