EX200 exam objective 1.2 asks you to manage files, directories, and their permissions and ownership. This chapter solves the problem of controlling who can see, change, or run files on a Linux system. For the exam, you must be able to change permissions with chmod, change ownership with chown, and understand the difference between user, group, and others.
Jump to a section
A simple way to picture File Management, Permissions, and Ownership
The Head of Household is the person who owns the house and decides who can enter and what they can do inside. They give out different keys to different people. A close family member gets a key to the front door and a key to every room, so they can go anywhere, rearrange furniture, or even redecorate. A babysitter gets a key to the front door and keys only to the living room, kitchen, and the kids' bedroom — they can use the sofa, wash dishes, and put the children to bed, but they cannot go into the master bedroom or the home office. A cleaner gets a key that only works on the front door and the kitchen and bathroom doors — they can scrub floors and wipe counters, but they cannot touch anything in the private rooms or change any furniture layout. The postman gets no key at all — they can only slide letters through the slot in the front door, nothing more. In this house, every key is tied to a person and to a specific set of permissions. The Head of Household controls who gets which key. If the babysitter leaves, the Head takes the key back. If the cleaner needs to clean the office, the Head updates the key to add that room. This is exactly how Linux file permissions and ownership work: the owner (like the Head) controls who has read, write, or execute access to files and directories, and can change those permissions at any time using commands like chmod and chown.
Linux is a multi-user operating system, which means many different people (or automated processes) can use the same computer at the same time. Without controls, anyone could delete system files, steal private data, or install malicious software. To prevent this, Linux uses a permission and ownership system built around three concepts: users, groups, and others.
Every file and directory in Linux has an owner, which is the user who created it. It also has a group, which is a collection of users that share access. The third category, "others", refers to everyone else on the system who is neither the owner nor a member of the group.
For each of these three categories, there are three possible permissions: read, write, and execute. - Read (r) means you can look at the contents of a file or list the contents of a directory. - Write (w) means you can modify the contents of a file, or create, delete, or rename files inside a directory. - Execute (x) means you can run a file as a program, or — for directories — you can enter that directory (using cd) and access files inside it.
These permissions are shown in a string of letters like this: -rwxr-xr--. The first character tells you the type: a dash (-) means it is a regular file, a "d" means it is a directory. The next three characters are the owner's permissions (rwx means the owner can read, write, and execute). The next three are the group's permissions (r-x means the group can read and execute, but not write). The last three are others' permissions (r-- means others can only read).
To change permissions, you use the command chmod, which stands for "change mode". You can use symbolic mode or numeric mode. - Symbolic mode uses letters: u for user/owner, g for group, o for others, a for all. You add (+) or remove (-) permissions. For example, chmod u+x file.sh adds execute permission for the owner. - Numeric mode uses numbers: read = 4, write = 2, execute = 1. You add these values for each category. For example, chmod 755 file.sh gives the owner read, write, execute (4+2+1 = 7), the group read and execute (4+1 = 5), and others read and execute (4+1 = 5).
To change ownership, you use the command chown, which stands for "change owner". You can change the owner with chown username file, or change both owner and group with chown username:groupname file. To change only the group, use chgrp groupname file.
Why does this matter? In the real world, only root (the superuser) can change ownership of files to another user. Regular users can only change the group of files they own to a group they belong to. This prevents a user from giving away a file they shouldn't share.
Special permissions also exist: setuid, setgid, and the sticky bit. - Setuid (represented as an 's' in the owner's execute position) allows a program to run with the permissions of the file owner, not the person running it. This is dangerous and is rarely used except for programs like passwd. - Setgid (represented as an 's' in the group's execute position) makes new files in a directory inherit the directory's group, not the user's primary group. This is useful for shared project directories. - The sticky bit (represented as a 't' in others' execute position) on a directory means only the owner of a file can delete their own file, even if others have write permission. This is used on /tmp.
Default permissions for new files are controlled by umask, which is a mask that removes permissions from the default maximum (666 for files, 777 for directories). For example, a umask of 022 means files get 644 (rw-r--r--) and directories get 755 (rwxr-xr-x).
View current permissions with ls -l
Run ls -l in a directory. The output shows a 10-character string like -rwxr-xr--. The first character is the file type. The next nine characters are three groups of three: owner, group, others. Each group has r, w, x or a dash if the permission is absent. This tells you exactly who can do what.
Change permissions with chmod (symbolic mode)
Use chmod u+x file to add execute for the owner, or chmod go-w file to remove write for group and others. Symbolic mode is intuitive because you state the target (u/g/o/a), the operator (+/-/=), and the permission (r/w/x). This is useful when you only need to change one permission flag.
Change permissions with chmod (numeric mode)
Use chmod 750 file. The three digits represent owner, group, and others. Each digit is the sum of read (4), write (2), and execute (1). 7 = rwx, 5 = r-x, 0 = ---. Numeric mode is faster and less error-prone when setting all permissions at once, which is why the exam prefers it.
Change ownership with chown and chgrp
Use chown alice file to change the owner to alice. Use chown alice:marketing file to change both owner and group. Use chgrp marketing file to change only the group. Remember: only root can change the owner to another user. A regular user can only change the group to one they are a member of.
Apply special permissions (setgid and sticky bit)
For a shared directory, first set the group with chgrp groupname directory, then set setgid with chmod g+s directory, then set the sticky bit with chmod +t directory. Verify with ls -ld directory: you will see an 's' in the group execute position and a 't' in the others execute position. New files will inherit the group, and users can only delete their own files.
A junior Linux administrator at a mid-sized company is asked to set up a shared project directory for the marketing team. The team has five members: Alice (team lead), Bob, Carol, Dave, and Eve. The directory must allow everyone in the marketing team to read and write files, but only the person who created a file should be able to delete it. The administrators also want a contractor, Frank, from outside the company to be able to read files but not modify or delete anything.
The administrator first creates the group 'marketing' and adds Alice, Bob, Carol, Dave, and Eve to it. They create a directory /projects/marketing and set the group to 'marketing' using chgrp marketing /projects/marketing. Then they set permissions to 2775 using chmod 2775 /projects/marketing. The '2' before the standard permissions sets the setgid bit, meaning any new file created in that directory will automatically be owned by the 'marketing' group, not the creator's personal group. The '7' gives owner (root) read, write, execute. The '7' gives the group read, write, execute. The '5' gives others (including Frank) read and execute but not write. They then set the sticky bit using chmod +t /projects/marketing so that each user can only delete their own files.
To give Frank read-only access, they do not add him to the marketing group. Instead, they use the 'others' permissions (the '5' in 2775). But Frank cannot create any files because others do not have write permission. This is exactly what they want.
Later, Alice creates a file budget.txt. The administrator checks with ls -l and sees: -rw-rw-r-- 1 alice marketing 1024 Mar 15 10:00 budget.txt. The group is marketing, so Bob, Carol, Dave, and Eve can read and write it. Frank (as 'others') can only read it. If Eve tries to delete Alice's file, the sticky bit will stop her. Only Alice or root can delete it.
When the project ends, the administrator removes the sticky bit and setgid bit, and changes the permissions back to 755 so that only the owner can write. They also remove Frank's access by setting others permissions to --- using chmod o-rwx /projects/marketing.
This real-world scenario shows how every command matters: chmod, chown, chgrp, and understanding of permissions prevent data loss, accidental deletions, and unauthorised changes.
In the EX200 exam, objective 1.2 (Manage files, directories, and their permissions and ownership) is heavily tested through practical lab tasks. You will be asked to create files, change permissions, and modify ownership using command-line tools. The exam expects speed and accuracy with chmod, chown, chgrp, umask, and understanding of special permissions like setgid and the sticky bit.
Common question types include: - "Change the permissions of file /project/data.txt so that the owner can read and write, the group can only read, and others have no access." (Answer: chmod 640 /project/data.txt) - "Ensure that new files created in /shared are automatically owned by the group 'devteam'." (Answer: chown root:devteam /shared; chmod g+s /shared) - "Set the sticky bit on /shared so that users can only delete their own files." (Answer: chmod +t /shared) - "Given a file with permissions -rwxr-xr--, what numeric permission would give the owner full access, group read and execute, and others no access?" (Answer: 750) - "Explain the effect of umask 027." (Answer: New files get 640 (rw-r-----), new directories get 750 (rwxr-x---).)
Key trap patterns to watch for:
Traps with chown: you cannot change the owner of a file to another user unless you are root. A regular user can only change the group of a file they own to a group they belong to.
Traps with setgid on directories vs files: setgid on a file makes it run with the group of the file, not the user. This is rarely tested but appears. Setgid on a directory makes new files inherit the directory's group.
Traps with octal permissions: 0 (---), 1 (--x), 2 (-w-), 3 (-wx), 4 (r--), 5 (r-x), 6 (rw-), 7 (rwx). You must memorise this.
Traps with sticky bit: it only prevents deletion by non-owners. It does not prevent reading, writing, or renaming. Renaming is considered deletion of the old name.
Traps with umask: umask subtracts from the default maximum. Default for files is 666, for directories is 777. A umask of 022 gives files 644 and directories 755. A umask of 027 gives files 640 and directories 750.
Concepts to memorise:
The exact syntax of chmod, chown, chgrp.
Numeric permissions table: 0-7 mapped to rwx.
The difference between symbolic mode (u+g+o, + - =) and numeric mode.
That only root can change file ownership to another user.
That setgid on a directory (chmod g+s) is used for shared directories.
That the sticky bit (chmod +t) is applied to /tmp and shared directories.
The effect of umask on default permissions.
Permissions in Linux are split into owner, group, and others, each with read, write, and execute flags.
Use chmod with numeric mode (e.g., 755) for quick permission changes; use symbolic mode (e.g., u+x) for precise changes.
Only root can change file ownership to a different user using chown; regular users can only change the group to one they belong to.
The sticky bit (chmod +t) on a directory prevents users from deleting files they do not own, even if they have write permission on the directory.
Setgid on a directory (chmod g+s) forces new files to inherit the directory's group, which is essential for shared project directories.
The default umask for root is often 022, giving new files 644 and new directories 755; for regular users it is often 002 or 022.
Execute permission on a directory is required to enter it and access its contents, even if you have read permission.
The numerical values for permissions are: r=4, w=2, x=1; sum them to get the octal value for owner, group, and others.
These come up on the exam all the time. Here's how to tell them apart.
chmod
Changes permissions (read, write, execute)
Works with numeric (755) or symbolic (u+x) modes
Does not change who owns the file
chown
Changes owner and/or group of a file
Does not change permissions
Only root can change owner to another user
Symbolic Mode (chmod u+x)
Uses letters (u, g, o, a) and operators (+, -, =)
Good for adding or removing single permissions
Easier for beginners to understand step-by-step changes
Numeric Mode (chmod 755)
Uses three octal digits (0-7)
Sets all permissions at once
Faster and recommended for the exam
Setgid on Directory
Causes new files to inherit the directory's group
Set with chmod g+s
Useful for shared project directories
Sticky Bit on Directory
Prevents users from deleting files they do not own
Set with chmod +t
Useful for /tmp and shared folders
File Permissions
Read gives access to view file contents
Write gives ability to modify file contents
Execute allows running the file as a program
Directory Permissions
Read allows listing directory contents
Write allows creating and deleting files inside
Execute allows entering the directory with cd and accessing files
Mistake
The sticky bit on a directory prevents anyone but the owner from reading the files inside it.
Correct
The sticky bit only prevents users from deleting or renaming files they do not own. It does not affect reading, writing, or executing files inside the directory if the directory permissions allow it.
The word 'sticky' sounds like it restricts all access, so beginners assume it locks the directory. They forget that it only affects deletion, not other operations.
Mistake
The setgid bit on a file makes it so that anyone who runs the file runs it with the group of the file creator.
Correct
Setgid on a file (chmod g+s) makes the program run with the group of the file itself, not the creator. It is used for shared binaries. Setgid on a directory makes new files inherit the directory's group.
Confusion arises because setuid works the same way for users, so beginners assume setgid applies to the creator rather than the file's group.
Mistake
You can change the owner and group of any file you own using chown and chgrp.
Correct
Only root can change the owner of a file to a different user. Regular users can only change the group of files they own, and only to a group they themselves belong to.
New users see 'chown' as a simple command like 'mv' and think they can give away files. They do not realise that ownership change is a privileged operation to prevent security breaches.
Mistake
Permissions shown in 'ls -l' are the same for files and directories.
Correct
Read, write, and execute have different meanings for directories: read lets you list contents, write lets you create/delete files inside, and execute lets you access the directory and its files. For files, permissions affect the file content itself.
Beginners apply the file model to directories and then get confused why they cannot cd into a directory with read-only permissions. They need to understand that execute on a directory is not the same as execute on a file.
Mistake
A umask of 022 means new files get permissions 755.
Correct
A umask of 022 applied to the default maximum of 666 gives 644 (rw-r--r--), not 755. The umask subtracts from the default, and the default for files is 666, not 777.
People see 777 for directories and assume files also start at 777. They forget that files do not get execute permission by default for security reasons, so the base is 666.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
chmod 755 sets permissions so that the owner can read, write, and execute (7), the group can read and execute (5), and others can read and execute (5). It is a common permission for directories and executable scripts.
Use the command sudo chown username file. Only root or a user with sudo privileges can change the owner to a different user. Regular users cannot transfer ownership.
If the directory has the sticky bit set (chmod +t), only the owner of the file or root can delete it. You may own the directory, but you do not own the file. Check the sticky bit with ls -ld directoryname.
chmod changes the permissions (read, write, execute) of a file or directory. chown changes the owner and/or group of a file or directory. They are separate commands because they control different aspects of access.
Create the directory, set the group to the desired group with chgrp, then set permissions with chmod 2775 directoryname. The 2 sets the setgid bit so new files inherit the group, 7 gives the owner full access, 7 gives the group full access, and 5 gives others read and execute.
umask sets default permissions for new files and directories by subtracting from the default maximum (666 for files, 777 for directories). For example, umask 022 gives new files 644 and new directories 755. It is a security measure to prevent accidentally creating world-writable files.
You've finished File Management, Permissions, and Ownership. Continue through the EX200 study guide to build a complete picture of the exam.
Done with this chapter?