Linux File Permissions Explained Comprehensive Guide

File permissions are the foundation of Linux security, controlling who can read, write, or execute every file and directory. Understanding them removes the mystery behind “Permission denied” errors and lets you secure your system with confidence. This comprehensive guide breaks it all down.

Reading Permissions with ls -l

Run ls -l and each file shows a 10-character string like -rwxr-xr--. Here’s how to read it:

Read also: How to Install Programs on Linux: APT, Snap, Flatpak, and AppImage

• The first character is the type: - for a regular file, d for a directory, l for a symbolic link.
• The next three characters (rwx) are permissions for the owner.
• The next three are for the group.
• The final three are for others (everyone else).

Within each set, r means read, w means write, and x means execute. A dash means that permission is absent. So -rwxr-xr-- means the owner can read/write/execute, the group can read/execute, and others can only read.

The Three Permission Categories

Every file has an owner (a user) and a group. Linux checks permissions in order:

1. User/owner: applies if you are the file’s owner.
2. Group: applies if you belong to the file’s group.
3. Others: applies to everyone else.

Change ownership with chown user:group file. For example, sudo chown alice:developers report.txt makes alice the owner and developers the group.

Numeric (Octal) Permissions

Permissions are often written as three digits, where each digit is a sum of values:

• read = 4
• write = 2
• execute = 1

Add them per category. So rwx = 4+2+1 = 7, rw- = 4+2 = 6, and r-x = 4+1 = 5. Common combinations:

• chmod 755 script.sh — owner full access, everyone else read and execute. Standard for executables and directories.
• chmod 644 file.txt — owner read/write, others read only. Standard for regular files.
• chmod 600 secret.key — owner read/write, no one else any access. Used for private keys.
• chmod 700 ~/private — owner-only directory.

Symbolic chmod Syntax

You can also modify permissions relatively, which is clearer for small changes:

• chmod +x script.sh — add execute for everyone.
• chmod u+x script.sh — add execute for the user/owner only.
• chmod g-w file.txt — remove write from the group.
• chmod o=r file.txt — set others to exactly read.

Here u, g, o, and a mean user, group, others, and all.

Directories and Special Bits

On a directory, the meanings shift slightly: r lets you list contents, w lets you create or delete files inside, and x lets you enter (cd into) it. You usually need both r and x to use a directory normally. Three special permissions extend the model: the setuid bit runs a file as its owner, setgid runs it as its group or makes new files inherit the directory’s group, and the sticky bit (seen on /tmp) lets users delete only their own files. Set them with chmod 1777 (sticky), chmod 2755 (setgid), or chmod 4755 (setuid).

Frequently Asked Questions

What does chmod 755 mean?

It grants the owner read, write, and execute (7), and grants the group and others read and execute (5 each). It’s the standard for scripts and directories that everyone needs to run or enter but only the owner should modify.

What’s the difference between chmod and chown?

chmod changes the permission bits (who can read/write/execute), while chown changes who owns the file and which group it belongs to. You often use both together when securing files.

Why can’t I delete a file I have write access to?

Deleting a file depends on write permission of the directory containing it, not the file itself. If the parent directory has the sticky bit set, like /tmp, you can only delete files you own.

What does the execute bit do on a directory?

On a directory, execute (x) permission lets you enter it with cd and access files inside. Without it you can’t traverse the directory even if you can read its listing.