What Is File permission in Operating Systems?

Imagine you live in a house with a few roommates. Each room has a lock, and you can decide who gets a key. The kitchen might be open for everyone, but your bedroom is only for you. File permissions work the same way on a computer. Every file and folder (a directory) has a set of rules that say which users or groups can see it, change it, or run it like a program.

Think of three basic actions: reading, writing, and executing. Reading is like looking at a document but not being able to change it. Writing is like being able to edit that document or even delete it. Executing is like running a game or an app, you need special permission to start it. On most operating systems like Windows, Linux, or macOS, each file has an owner, a group, and then everyone else. The owner can set permissions for themselves, for people in their group, and for the public.

For a real-world analogy, consider a public library book. Anyone can walk in and read it (read permission), but only the librarian can change the due date or remove the book (write permission). Only the librarian can also "run" a special scanner program (execute permission). If you treat your computer files like that library, you can keep important system files safe from accidental changes and let users only do what they need. This simple idea is the foundation of computer security and is tested heavily in IT certification exams.

File permissions are a fundamental security mechanism used by operating systems to regulate access to files and directories. In Unix-like systems (Linux, macOS), permissions are implemented using a user-group-others model combined with read (r), write (w), and execute (x) flags. These are stored as a three-digit octal number for classic permissions, or as part of an Access Control List (ACL) for more granular control. In Windows NTFS, permissions are managed through Security Identifiers (SIDs) and Access Control Entries (ACEs) that form a Discretionary Access Control List (DACL).

The classic Unix permission model uses nine bits: three for the owner, three for the group, and three for others. Each set of three bits represents read (value 4), write (value 2), and execute (value 1). So permission 755 means the owner has read, write, and execute (4+2+1=7), the group has read and execute (4+1=5), and others have read and execute (5). The chmod command changes these permissions. For directories, execute permission means the ability to enter or traverse the directory. The chown command changes the owner and group, while chgrp changes only the group.

In Windows, permissions are more complex. Each file or folder has an owner (often the creator), and the owner can grant or deny permissions. Common file permissions include Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. These are set through the Security tab in Properties. Windows also supports inheritance, where child objects inherit permissions from parent folders. The Effective Permissions tool shows exactly what access a user has after all inheritance and explicit permissions are combined. In both systems, special permissions like setuid, setgid, and sticky bit exist. The sticky bit (chmod +t) on a directory, like /tmp, prevents users from deleting files they do not own. Setuid and setgid allow a program to run with the permissions of the file owner or group, which is powerful and risky.

File permissions are not just an academic concept, they are the bedrock of operating system security and data integrity. Without proper file permissions, any user could read private data, modify critical system files, or run malicious code. In a corporate IT environment, a misconfigured permission can lead to data breaches, ransomware infections, or system crashes. For example, if a web server’s configuration file has world-writable permissions, an attacker could upload a malicious script and take control of the server.

For IT professionals, managing file permissions is a daily task. You might need to give a new employee access to a shared drive, lock down a sensitive database, or troubleshoot why a service cannot start because it lacks execute rights. Operating systems use permissions to enforce the principle of least privilege, users should only have the minimum access needed to do their job. This reduces the attack surface and limits damage if an account is compromised.

In cloud and DevOps environments, file permissions are equally important. When configuring Linux servers, a mistake like setting 777 permissions on a directory can expose the system. When using containers, improper permissions can allow a container to escape its isolation. Even in scripting and automation, setting proper permissions on SSH keys (600) or configuration files (640) is essential. Understanding file permissions helps you pass exams and, more importantly, keep real systems secure.

Exam questions on file permissions come in several patterns. The most common is the scenario-based multiple-choice question: A user reports they cannot save a file in a shared folder. The answer choices list permission strings. You must identify which permission allows the user to read and write but not execute. For example, 755 allows owner full access, group and others read and execute only. 775 allows group to write as well. 777 gives full access to all, which is insecure. You need to match the requirement with the correct octal value.

Another pattern is the command-line fill-in-the-blank or simulation. The exam shows a terminal and asks you to change the owner of a file to root and give the group read-write access. You would need to type chown root:group filename and then chmod 760 filename. Some exams ask you to identify the effect of a command: What does chmod u+s script.sh do? The answer is it sets the setuid bit, meaning when any user runs that script, it runs with the owner's permissions.

Troubleshooting questions are also common. A service fails to start because it cannot read its configuration file. The log shows "Permission denied." You need to check the file's ownership and permissions. If the service runs as user "apache" but the file is owned by "root" with permission 600 (owner only read/write), the fix is to change the group or add read access for others. In Windows, you might see a user who has Full Control on a folder but still cannot delete a file because the file has explicit Deny permissions. You must know that Deny overrides Allow. Effective permissions can be calculated by combining all Allow entries and then subtracting all Deny entries. Question types often include drag-and-drop to assign permission levels or ordering steps to grant access.

In a real IT environment, file permissions are the first line of defense against data loss and unauthorized access. As a system administrator, you will frequently use the chmod, chown, and umask commands. Understanding the numeric octal system is essential. Each digit corresponds to owner, group, and others. The bits are read (4), write (2), execute (1). So 6 = 4+2 (read+write), 5 = 4+1 (read+execute), 7 = 4+2+1 (full). Here is a quick reference: 400 = owner read, 200 = owner write, 100 = owner execute. For groups and others, the digits shift in the same pattern.

One common real-world task is securing SSH keys. A private SSH key must have permission 600 (owner read/write only) or 400 (owner read only) to be accepted by the SSH client. If the permissions are too open (e.g., 644), SSH will refuse to use the key for security reasons. Similarly, the .ssh directory should be 700 (rwx------) so only the owner can access it. Another example is web server configuration. A typical web root (/var/www/html) is often set to 755 with files set to 644. The web server user (like www-data) needs read and execute on directories and read on files. Never give write access to the web user for production files, as that could allow an attacker to modify web content.

The umask command controls default permissions for newly created files and directories. The umask is a mask that subtracts from the base permissions. The base for files is 666 (read+write for all), and for directories 777. A typical umask value is 022, which subtracts write permission for group and others. So new files get 644 (666 - 022 = 644) and new directories get 755. If you set umask 077, new files get 600 and directories 700, which is very secure. Always check the umask when troubleshooting why newly created files have unexpected permissions.

ACLs extend basic permissions. Use getfacl to view and setfacl to assign. For example, setfacl -m u:alex:rw /shared/file gives user alex read and write without changing group or others. ACLs are powerful but can make permissions more complex. The command getfacl shows the file's ACL, and ls -l now shows a '+' at the end of the permissions if ACLs are present. In Windows, the equivalent is the Security tab where you can add specific users. Inheritance in Windows can be confusing, enabling inheritance means child objects inherit parent permissions. Disabling inheritance allows you to set unique permissions for that folder and choose whether to copy or remove existing inherited permissions. Always document your permission structure to avoid chaos.