# File Permissions and Ownership

> Chapter 4 of the Courseiva LINUX-PLUS curriculum — https://courseiva.com/learn/linux-plus/file-permissions-and-ownership

**Official objective:** 1.4 — Configure file permissions and ownership

## Introduction

File permissions and ownership. They stop strangers from messing with your files and keep sensitive data safe inside a Linux system. For the XK0-006 exam, you must know how to change permissions, assign ownership, and predict what a given set of symbols actually allows.

## The Shared House Analogy

3 doors. That is the number of locked doors in a shared house where four housemates live. Each door represents a different level of permission for the rooms inside. The Front Door (Read permission) lets anyone knock and see the hallway, but they cannot touch anything. The Living Room Door (Write permission) lets a housemate rearrange the furniture or leave their laundry on the sofa. The Basement Door (Execute permission) lets someone turn on the furnace or run the washing machine.

Now add ownership. The housemate who signed the lease is the Owner (like the user who created a file). They hold all three keys. The Co-signer (the group) shares a set of keys with the other housemates. The Landlord (everyone else on the street) gets only the Front Door key. If a housemate loses their key (wrong permission), they cannot enter. If the Owner changes the locks (using chmod), the new keys (rwx symbols) decide who gets in.

This is exactly how file permissions and ownership work in Linux. Every file and directory has three key types for three sets of people: Owner, Group, and Others. The keys are Read, Write, and Execute. Knowing who holds which key keeps the house—and the system—secure.

## Core explanation

When you create a file in Linux, the system assigns an owner (your user account), a group (often a project team), and default permissions. These permissions determine what can be done: Read, Write, Execute. Think of them as three switches per category.

The three categories are:
- Owner (user): the person who created the file.
- Group: a collection of users who share access, like a team folder.
- Others: everyone else on the system who is neither the owner nor in the group.

Now the three actions:
- Read (r): see the file's contents or list a directory's files.
- Write (w): modify or delete the file; add or remove files in a directory.
- Execute (x): run the file as a program; enter a directory (cd into it).

If you look at your terminal and type "ls -l", you will see a line like "-rwxrwxrwx". The first character "-" means it is a file ("d" means directory). Then the next nine characters are three groups of three: Owner (rwx), Group (rwx), Others (rwx).

Permissions can also be shown as a three-digit numeric code (octal):
- rwx = 7
- rw- = 6
- r-x = 5
- r-- = 4
- -wx = 3
- -w- = 2
- --x = 1
- --- = 0

Example: 755 means owner has rwx (7), group has r-x (5), others have r-x (5).

To change permissions, use the chmod command. For example, "chmod 755 script.sh" sets those permissions. You can also use symbolic mode: "chmod u+x script.sh" adds execute for the owner.

Ownership is changed with chown (change owner) and chgrp (change group). Only the root user or sudoers can change ownership of someone else's files. So "sudo chown alice:developers file.txt" makes alice the owner and developers the group.

Special permissions add extra flavour:
- SetUID (s on owner's execute): when a program runs, it runs with the file owner's privileges, not the user who ran it.
- SetGID (s on group's execute): the program runs with the group's privileges; on a directory, new files inherit the directory's group.
- Sticky bit (t on others' execute): only the owner of a file can delete or rename it, even if the directory is world-writable. Think of the /tmp folder.

Why does this all exist? Because multi-user systems need security. Without permissions, anyone could delete critical system files or steal passwords. With ownership, you know who is responsible for a file. Changing permissions is a daily task for system administrators.

To see current permissions and ownership, use "ls -l". To see the full numeric equivalent, use "stat -c %a filename". Remember: directories need execute permission for you to enter them, or to access any file inside.

## Real-world context

Imagine you are a junior Linux administrator at a medium-sized company called GreenLeaf Ltd. The company has a shared server used by the Marketing team, the Sales team, and the IT team. Each team has its own directory under /home. The Marketing director asks you to set up a new project folder for a campaign launching next week.

You create the folder:
- sudo mkdir /home/marketing/campaign2025

Now you check the default permissions using "ls -ld /home/marketing/campaign2025". It shows drwxr-xr-x. That means the marketing team (owner and group) can read and enter it, but only the owner can write. But the Marketing team needs everyone in the marketing group to be able to add files, edit them, and delete them.

So you change the group permissions:
- sudo chgrp marketing /home/marketing/campaign2025
- sudo chmod 775 /home/marketing/campaign2025
- Now the directory is drwxrwxr-x

The Marketing director then says that contractors from an external agency need to view the files but not change them. You create a separate group called "campaign_guests" and add the contractors' user accounts to it. Then you change the directory's group to a new group that includes both marketing and guests? No. Instead, you set permissions so that others (world) can only read and enter. But the contractor accounts are actually others from the system's perspective, not members of the marketing group. So you could either:
- Add them to the marketing group (but then they get write access).
- Or set the directory to 755 and use Access Control Lists (ACLs) for fine-grained permissions. ACLs let you grant specific users or groups specific permissions beyond the traditional three groups.

You would use setfacl to give read and execute to the contractors' group:
- setfacl -m g:campaign_guests:rx /home/marketing/campaign2025

Next, a month later, a user leaves. You need to reassign ownership of their files to their manager. You run:
- sudo chown -R manager:manager /home/former_employee/

The "-R" flag means recursive—it changes everything inside the directory.

Every week, you run audits to check for weak permissions on critical files. You might find a script that is world-writable, which any user could modify to install malware. You would then fix it with "chmod o-w script.sh".

What an IT professional does:
- Checks file permissions during troubleshooting (log files, config files).
- Sets executable permissions on scripts and binaries.
- Manages group memberships to control access.
- Uses sticky bit on shared directories like /tmp and /home/shared.
- Applies SetGID on project folders so new files automatically belong to the project group.
- Audits permissions periodically with tools like "find / -perm -o+w" to find world-writable files.
- Uses umask to control default permissions for newly created files.

In a business context, getting permissions wrong can lead to data breaches, accidental deletion of critical data, or non-compliance with regulations like GDPR. So this skill is part of every sysadmin's daily checklist.

## Exam focus

On the XK0-006 exam, 'File Permissions and Ownership' is tested with multiple-choice questions, fill-in-the-blank commands, and scenario-based items. The domain 1.4 focuses on your ability to interpret permission strings, change permissions and ownership, and handle special bits.

Here is what the exam loves to test:
- Interpreting the nine-character permission string. Example: What does -rwxr-xr-- mean?
- Numeric (octal) notation: converting between symbolic and numeric.
- Chmod with symbolic mode (u+rwx, g+rx, o-rwx).
- Chown and chgrp syntax.
- Special permissions: SetUID, SetGID, sticky bit.
- Default permissions with umask.
- Recursive changes with -R flag.

Common traps the exam sets:
- Trick: They give a permission like 644 on a script and ask if it can be executed. The answer is no because execute (x) is missing.
- Trick: They show "chmod 777 /etc/shadow" and ask if that is dangerous. Yes—that exposes the password file to everyone.
- Trick: They ask what the sticky bit does, and one wrong answer says "prevents deletion by anyone" while the correct one says "prevents deletion by non-owners even with write permission".
- Trap with umask: They give umask 022, and ask what default permissions are created for a new file (files: 644, directories: 755).
- Trap with recursive: "chown user:group /dir" without -R changes only the directory, not its contents. The exam loves that.
- Symbolic mode trick: "chmod u-s file" removes the SetUID bit, not toggles it.

Key definitions to memorise:
- chmod: change file mode bits.
- chown: change file owner and group.
- chgrp: change group ownership only.
- umask: user file-creation mode mask.
- SetUID (4xxx): runs with owner's privileges.
- SetGID (2xxx): runs with group's privileges, or new files inherit group.
- Sticky bit (1xxx): restricts deletion to file owners.
- 755: typical for scripts.
- 644: typical for text files.
- 700: private files.

Exam question style example:
"A user cannot run a script even though they have read permission. What is the most likely cause?" Answer: The script lacks execute permission for that user (or group, or others).

Study the output of "ls -l" carefully. The exam may show you a listing and ask you to identify which entries could be executed by a specific user.

Also know how to use the find command with -perm to locate files with dangerous permissions. For example, "find / -perm -4000 -type f" finds all SetUID files—a common security question.

## Step by step

1. **View Current Permissions and Ownership** — Type 'ls -l' or 'ls -la' to see a detailed list of files in a directory. The output shows permissions, owner, group, size, and last modification date. This is your starting point for any permission change.
2. **Interpret the Permission String** — Look at the first 10 characters. The first is file type (- for file, d for directory). The next nine are three groups of three: owner (rwx), group (rwx), others (rwx). Missing letters mean that permission is denied. For example, 'rw-r--r--' means owner can read/write, group and others can only read.
3. **Change Permissions with chmod** — Decide the new permission set. For numeric mode, calculate the three-digit octal (e.g., 755). Run 'chmod 755 script.sh'. For symbolic mode, run 'chmod u+x script.sh' to add execute for the owner. Use '-R' for recursive changes on directories.
4. **Change Ownership with chown or chgrp** — To change both owner and group: 'sudo chown newowner:newgroup file'. To change only group: 'sudo chgrp newgroup file'. Only root or sudo users can change ownership of files owned by others. Always use 'sudo' when changing other users' files.
5. **Apply Special Permissions (SetUID, SetGID, Sticky Bit)** — To add SetUID (4xxx): 'chmod 4755 file'. To add SetGID (2xxx): 'chmod 2755 dir'. To add sticky bit (1xxx): 'chmod 1777 dir'. Verify with 'ls -l'; a lowercase 's' in execute position means SetUID/SetGID, 't' means sticky bit. Capital 'S' or 'T' means the corresponding execute bit is missing, which is invalid.
6. **Set Default Permissions with umask** — Check current umask with 'umask'. To set a new umask (e.g., 022), run 'umask 022'. This means new files get 644 and new directories get 755. Add it to your shell profile (.bashrc or .profile) to make it permanent.

## Comparisons

### Symbolic Mode vs Numeric Mode

**Symbolic Mode:**
- Uses letters u, g, o, a with +, -, = (e.g., u+rwx)
- Easier to read for small changes
- Does not require calculating sums

**Numeric Mode:**
- Uses three-digit octal numbers (e.g., 755)
- Sets all permissions at once, overriding existing
- Requires memorising r/w/x values (4,2,1)

### chown vs chgrp

**chown:**
- Changes both owner and optionally group
- Syntax: chown user:group file
- Requires root or sudo to change another user's file

**chgrp:**
- Changes only the group ownership
- Syntax: chgrp group file
- Can be run by file owner if they are a member of the target group

### SetUID vs SetGID

**SetUID:**
- Applies to executable files
- Runs the program with the owner's privileges
- Denoted by 's' in owner's execute slot (e.g., -rwsr-xr-x)

**SetGID:**
- Applies to executables and directories
- On executables, runs with group's privileges; on directories, new files inherit group
- Denoted by 's' in group's execute slot (e.g., -rwxr-sr-x)

### Permissions on Files vs Permissions on Directories

**Permissions on Files:**
- Read: allows viewing file content
- Write: allows modifying or deleting the file
- Execute: allows running the file as a program

**Permissions on Directories:**
- Read: allows listing the directory's contents
- Write: allows adding or deleting files inside
- Execute: allows entering the directory (cd into it)

### umask 022 vs umask 077

**umask 022:**
- Default file permissions: 644 (rw-r--r--)
- Default directory permissions: 755 (rwxr-xr-x)
- Moderately permissive for group

**umask 077:**
- Default file permissions: 600 (rw-------)
- Default directory permissions: 700 (rwx------)
- Very restrictive – only owner has access

## Diagram

_This diagram shows how to interpret an ls -l permission string and convert it to octal notation to use with chmod._

```mermaid
flowchart TD
    A[ls -l output: -rwxr-xr--] --> B{File type?}
    B --> C[ - regular file]
    B --> D[ d directory]
    C --> E[Owner: rwx = 7]
    C --> F[Group: r-x = 5]
    C --> G[Others: r-- = 4]
    E --> H[Octal: 754]
    F --> H
    G --> H
    H --> I[chmod 754 file]
    I --> J[New permissions set]
```

## Common misconceptions

- **Misconception:** The owner of a file can always do anything to it, including changing permissions regardless of the current settings. **Reality:** The owner can change the permissions of their own file using chmod, but they cannot bypass existing restrictions that the root user sets. Also, if the owner sets permissions so that even they cannot read the file, they can still change the permissions back—unless the filesystem is mounted with special restrictions. (Beginners think ownership means total control, but Linux's security model allows root to override, and the owner can accidentally lock themselves out until they use chmod.)
- **Misconception:** Symbolic permissions (rwx) and numeric permissions (777) are two completely different systems that do not relate to each other. **Reality:** They are the same thing expressed in different ways. rwxrwxrwx equals 777. Each letter maps to a bit value (r=4, w=2, x=1). (The numeric system feels like 'code' to new learners, so they treat it as separate when it is just shorthand.)
- **Misconception:** The sticky bit lets any user delete files in a directory if they have write permission. **Reality:** The sticky bit overrides that. It allows only the file's owner, the directory's owner, or root to delete or rename files inside the directory, even if the directory is world-writable. (The name 'sticky' sounds like it sticks files in place, but new users assume write permission on the directory is enough to delete anything inside.)
- **Misconception:** chmod 777 on a directory gives everyone full access including the ability to read files inside that directory. **Reality:** chmod 777 gives everyone read, write, and execute on the directory. Execute on a directory allows the user to enter it, but reading the files inside still depends on the individual file permissions. (People confuse directory permissions with file permissions. They think directory permissions cascade to all files inside, but they do not.)
- **Misconception:** Once you set a file to -rwx------ (700), no one except the owner can see it, not even root. **Reality:** Root (the superuser) can always read, write, and execute any file regardless of permissions. The only exception is when the filesystem is mounted with specific restrictions (e.g., nosuid). (New users think permissions are absolute, but root's power overrides them. This is often a surprise.)

## Key takeaways

- Read (r) lets you view a file's content; Write (w) lets you modify it; Execute (x) lets you run it as a program or enter a directory.
- Permissions are stored as a three-digit octal number where r=4, w=2, x=1, and the sum determines the mode (e.g., 755 = owner rwx, group r-x, others r-x).
- Use chmod to change permissions, chown to change owner and group, and chgrp to change group only.
- The sticky bit (1xxx) on a directory prevents non-owners from deleting files inside it, even if they have write permission.
- SetUID (4xxx) makes a program run with the file owner's privileges, which can be a security risk if misused.
- SetGID (2xxx) on a directory makes new files and subdirectories inherit the directory's group, which is useful for shared team folders.
- The umask subtracts permissions from the default (usually 666 for files, 777 for directories) to set the final permissions on newly created items.
- Root can always bypass file permissions, so never rely on permissions to restrict root's access.

## FAQ

**How do I check the current permissions of a file in Linux?**

Use the 'ls -l' command followed by the filename. The output shows a string like '-rwxr-xr--' that indicates the permissions, plus the owner and group.

**What does chmod 777 do and why is it dangerous?**

It grants read, write, and execute to everyone (owner, group, and others). This is dangerous because any user on the system can modify or delete the file, which can lead to security breaches or accidental damage.

**How do I make a script executable in Linux?**

Run 'chmod +x scriptname.sh' or 'chmod 755 scriptname.sh'. The +x adds execute permission to the file, and 755 sets owner to rwx, group and others to r-x.

**What is the difference between chown and chgrp?**

chown changes both the owner and optionally the group (e.g., 'chown alice:staff file'). chgrp changes only the group ownership of a file (e.g., 'chgrp developers file').

**How do I give a user access to a directory but not its subdirectories?**

You need to set read and execute permissions on the directory itself. Use 'chmod 755 /dir' to allow others to enter and list files but not write. The subdirectory permissions remain independent and can be more restrictive.

**What is the sticky bit and how do I set it?**

The sticky bit is a special permission that restricts deletion in a shared directory so that only the file's owner can delete or rename files. Set it with 'chmod 1777 /shared_dir' or 'chmod +t /shared_dir'.

**Why can't I open a file even though I have read permission on it?**

You must also have execute permission on every directory in the file's path to traverse to it. If any directory lacks execute for you, you cannot access the file, even if the file itself has read permission.

## Check your understanding

1. **What command changes the permissions of a file named 'script.sh' so that the owner can read, write, and execute; the group can read and execute; and others have no access?**

   Answer: chmod 750 script.sh (or chmod u=rwx,g=rx,o= script.sh).

2. **A file has permissions -rwxr--r-- (744). Can the group write to this file?**

   Answer: No, because the group's permissions are r-- (read only). Write permission is missing.

3. **What does the sticky bit do when set on a directory like /tmp?**

   Answer: It prevents users from deleting or renaming files that they do not own inside that directory, even if they have write permission on the directory.

4. **If you want to change the owner of a file to 'alice' and the group to 'developers', what command do you use?**

   Answer: sudo chown alice:developers filename (or sudo chown alice:developers filename).

5. **What is the default umask typically set to, and what file permissions does it produce?**

   Answer: The typical default umask is 022, which produces file permissions 644 (rw-r--r--) and directory permissions 755 (rwxr-xr-x).

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/linux-plus/file-permissions-and-ownership