Linux online course

Manage File Ownership in Linux

Learn how Linux file ownership works, how to inspect owners and groups with ls -l, and how chown and chgrp affect access.

Linux ownership model

Every filesystem object, including regular files and directories, has an owning user and an owning group. The file owner is the user account associated with the object. The owning group is the group account associated with it.

Ownership is separate from permissions. Permissions are access rules for reading, writing, and executing an object. Linux evaluates those rules using the object's owner and group, together with the identity of the process requesting access.

• User owner: identifies one user account.
• Group owner: identifies one group account.
• Permission bits: specify what the owner, members of the group, and other users may do.

For example, a file may be owned by user alice and group developers. A program running as alice is evaluated against the owner permissions. A program running as another member of developers is generally evaluated against the group permissions.

For background on directories and paths, see File Structure in Linux. Basic permission behavior is also important when working with ownership.

Read ownership with ls -l

The ls -l FILE command displays a long listing for a file. Among other metadata, it shows the file's permission bits, owner, and group.

$ ls -l xeyes
-rwxr-x--- 1 alice developers 48216 Aug 17 10:30 xeyes

In this example, the owner is alice and the owning group is developers.

The fields appear in this order: permissions, link count, owner, group, size, modification date and time, and filename. The third and fourth fields after the permissions and link-count fields are the user owner and group owner.

Users, groups, UID, and GID

Linux internally identifies accounts with numbers. A UID, or User Identifier, is the numeric identifier assigned to a user account. A GID, or Group Identifier, is the numeric identifier assigned to a group account.

Commands often display names such as alice and developers, but those names map to numeric UID and GID values in the system's account databases.

$ id
uid=1001(alice) gid=1001(alice) groups=1001(alice),1005(developers)

$ id alice
uid=1001(alice) gid=1001(alice) groups=1001(alice),1005(developers)

A user has a primary group and may belong to additional groups. The id command shows the current user's UID, primary GID, and group memberships. id USER displays this information for a specified user.

If Linux cannot resolve a stored UID or GID to a current account or group name, a long listing may display a numeric value instead of a name. This does not change the ownership number; it indicates that name resolution was unavailable.

Ownership and process identity

Process identity means the user and group credentials under which a running program operates. A program normally runs under the identity of the account that launched it.

When a program attempts to read, write, execute, or otherwise modify a file, the operating system compares the process's user and group identity with the file's owner, group, and permission bits. The relevant permission category is normally:

1. Owner: used when the process user matches the file's owning user.
2. Group: used when the process does not match the owner but has an applicable group membership.
3. Other: used when neither the owner nor an applicable group category matches.

For example, suppose report.txt has owner alice, group developers, and permissions -rw-r-----. Alice can read and write it through the owner permissions. A member of developers who is not Alice can read it through the group permissions, but cannot write it. A user who is neither Alice nor a member of the applicable group receives only the permissions in the other category, which provide no access in this example.

Changing ownership does not automatically make every operation possible. The permission bits still determine whether the process may perform the requested operation.

Who may change ownership?

The root user is the privileged administrative account with authority to change a file's user owner and group owner. An ordinary user generally cannot transfer a file's user ownership to another user.

An ordinary file owner may change the file's group owner only to a group of which that user is a member, subject to the system's authorization rules. Changing the group is different from changing the user owner.

Change the owning user or group

chown changes the owning user and, when specified, the owning group. Check your authority and group membership before running a change.

Change only the owning user

Use a username followed by the file:

$ sudo chown alice report.txt

This changes the user owner to alice while leaving the group owner unchanged. Assigning another user's ownership normally requires root authority, so an authorized administrator may use sudo.

Change only the owning group

Put a colon before the group name when changing only the group:

$ chown :developers report.txt

An ordinary owner may use this form when developers is one of that user's groups. The equivalent group-specific command is:

$ chgrp developers report.txt

Change both owner and group

Separate the user and group with a colon:

$ sudo chown alice:developers report.txt

This changes both ownership values. Use administrative privileges when assigning a different user or when the current account lacks the required authority.

Verify every change

Always inspect the result with a long listing:

$ ls -l report.txt
-rw-r----- 1 alice developers 2048 Aug 17 10:45 report.txt

Here, alice is the user owner and developers is the group owner. Use id to confirm the current account and its groups before a group change.

Practical examples

A user assigns a file to one of their groups

Suppose alice owns notes.txt and belongs to developers:

$ id
uid=1001(alice) gid=1001(alice) groups=1001(alice),1005(developers)

$ ls -l notes.txt
-rw------- 1 alice alice 120 Aug 17 11:00 notes.txt

$ chown :developers notes.txt

$ ls -l notes.txt
-rw------- 1 alice developers 120 Aug 17 11:00 notes.txt

The command changed only the group owner. The user owner remains alice. The change is permitted because developers appears in Alice's group memberships.

An administrator transfers a file

An administrator can assign both ownership values to another account:

$ sudo chown bob:developers project.txt
$ ls -l project.txt
-rw-r----- 1 bob developers 4096 Aug 17 11:15 project.txt

The verification shows that the user owner is now bob and the group owner is developers.

A program attempts to modify a file

Suppose a program launched by bob tries to modify a file owned by alice and grouped under developers:

$ ls -l settings.conf
-rw-r----- 1 alice developers 600 Aug 17 11:20 settings.conf

$ id bob
uid=1002(bob) gid=1002(bob) groups=1002(bob),1005(developers)

Bob does not match the user owner, but he is a member of the owning group. The group permissions are r--, so the program may read the file but cannot modify it. If the group permissions included w, the write could be allowed, assuming no other security control denied it.

Troubleshooting ownership and access

Operation not permitted when changing the user owner

The command was likely run by a non-root user attempting an ownership change that requires administrative privileges.

• Inspect the object: ls -l FILE.
• Confirm the current account: id.
• Determine whether an authorized elevated command is required, such as sudo chown USER FILE.

Operation not permitted when changing the group

The requested group may not be one of the current user's groups, or the user may lack the necessary authority.

• Run id and list the current memberships.
• Compare the target group with those memberships.
• Use administrative privileges only when appropriate and authorized.

A program cannot modify a file

A correct filename does not guarantee access. The process identity may not match the file owner or an applicable group, or the matching permission category may not include write access.

• Inspect permissions, owner, and group with ls -l FILE.
• Identify the account that launched the program.
• Evaluate the owner, group, or other permission category that applies to that process.

The expected owner or group name is not displayed

The system may display a numeric UID or GID when it cannot resolve the number to an account or group name.

• Use id USER to inspect known numeric identities.
• Confirm that the intended user and group accounts exist and can be resolved.

Summary

• Every file and directory has a user owner and an owning group.
• ls -l displays the owner and group in the long listing.
• UIDs and GIDs are the numeric identities behind displayed account and group names.
• A running program normally uses the identity of the account that launched it.
• Access decisions combine process user and group identity with file ownership and permissions.
• chown USER FILE changes the user owner, chown :GROUP FILE or chgrp GROUP FILE changes the group owner, and chown USER:GROUP FILE changes both.
• Verify ownership changes with ls -l.