Linux online course

Linux File Permissions Basics

Learn how Linux file and directory permissions, ownership, groups, and numeric modes control access with ls, chmod, chown, and chgrp.

Why Linux permissions matter

Linux permissions are access rules applied whenever an account attempts an operation on a file or directory. They help protect private user data, shared project files, and critical system files from unintended reading, modification, deletion, or execution.

Permissions work differently for regular files and directories. For a file, the rules mainly control reading its contents, changing its contents, or running it. For a directory, the rules control listing names, changing directory entries, and traversing paths.

Ownership and permission classes

Every file and directory has an owner user and an owning group. It also has permissions for three classes of account:

The account that owns a file is not automatically the same as every account in its owning group. User accounts can belong to groups, and a group can be assigned to files so that several collaborators receive a common access policy.

Linux evaluates the applicable class in order of identity: owner permissions apply when the accessing account owns the file; otherwise, group permissions apply when the account is an applicable member of the owning group; otherwise, the others permissions apply. The owner does not combine owner and group bits to get extra access.

Read, write, and execute permission bits

A permission bit is one read, write, or execute setting for one class. The symbols are r, w, and x.

Directory write permission controls changes to the directory's entries. Therefore, deleting or renaming a file is primarily an operation on its containing directory, not just on the file itself.

Directory execute permission is also called search permission. Execute without read can allow a user who knows a filename to traverse the directory and access that path when the target's permissions also allow it, while preventing a normal directory listing. Read without execute allows the directory's entries to be known or listed in some situations, but does not by itself allow traversal into the directory or access to its contents.

Examples of permission strings

Consider this regular file:

-rwxrw---- alice developers report.sh

• The leading - identifies a regular file.
• rwx gives owner alice read, write, and execute access.
• rw- gives members of developers read and write access, but not execute access.
• --- gives others no permissions.

Now consider this directory:

drwx------ alice alice private

The leading d identifies a directory. The owner can list, enter, create, remove, and rename entries, subject to other system constraints. The group and others have no normal permission-based access.

This directory has search permission but no read permission:

d--x--x--x shared

Users cannot list the directory's names, but a user who knows a permitted filename may be able to traverse the path. The target file's own permissions still determine whether it can be read or changed.

Viewing ownership and permissions

Use a long listing to inspect a file's mode, owner, group, size, and timestamp:

ls -l report.sh

A typical result may look like this:

-rwxrw---- 1 alice developers 1280 Jun 10 09:30 report.sh

The nine characters after the file-type character are read as three triplets: user, group, and others. A hyphen means that the corresponding permission is absent. Other leading characters can identify special file types, but the basic nine-position interpretation remains the starting point for ordinary files and directories.

To inspect the directory itself rather than its contents, use:

ls -ld directory_name

Numeric, or octal, permission modes

In an octal mode, read is worth 4, write is worth 2, and execute is worth 1. Add the enabled values for each class to produce one digit:

• 7 = 4 + 2 + 1 = read, write, execute
• 6 = 4 + 2 = read, write
• 5 = 4 + 1 = read, execute
• 4 = read only
• 0 = no permissions

The three digits represent user, group, and others in that order. For example, 640 means owner read/write, group read, and no permissions for others.

Do not use 777 as a default fix. Broad permissions can expose confidential data, allow unwanted changes, or let another user replace content. Identify whether the problem requires read, write, execute, ownership, group membership, or directory search permission, then change only that part.

Changing permissions with chmod

chmod changes a file or directory's permission mode. The owner can ordinarily change permissions on files they own. Changing permissions on files owned by another account may require authorized elevated privileges.

Symbolic modes

Symbolic mode uses a class, an operator, and permissions. The classes are u for user, g for group, o for others, and a for all classes. The operators are + to add, - to remove, and = to set exactly.

chmod u+x backup.sh
chmod g-w file
chmod o= file

• chmod u+x backup.sh adds execute permission only for the owner and leaves existing group and other permissions unchanged.
• chmod g-w file removes group write permission.
• chmod o= file removes all permissions from others.

Multiple changes can be specified with commas, such as chmod u=rw,g=r,o= file.

Numeric modes

chmod 600 credentials.conf
chmod 640 shared-report.txt
chmod 755 tool.sh
chmod 755 project-directory

chmod 600 credentials.conf allows the owner to read and modify the file while giving group and others no access. chmod 755 tool.sh gives the owner read, write, and execute access; group and others receive read and execute access but cannot modify the script.

Changing ownership with chown and chgrp

chown changes the owner and can optionally change the owning group:

chown user file
chown user:group file
sudo chown alice:developers report.txt

The last command makes alice the owner and developers the owning group. Changing ownership normally requires administrative privileges.

chgrp changes only the owning group:

chgrp projectteam notes.txt
chmod 660 notes.txt

This associates the file with projectteam, then gives the owner and applicable group members read/write access while denying access to others. The users still need to be members of the intended group.

Recursive ownership changes

The -R option applies an operation to a directory and its nested contents:

sudo chown -R user:group directory

Use recursive ownership changes only after verifying the exact target path and confirming that every nested item should receive the same ownership policy. Applying -R to the wrong path can change system files or unrelated user data. Recursive permission changes require even more care because files and directories often need different modes; a directory generally needs execute/search permission for traversal, while an ordinary data file usually should not be executable.

Safe permission-management workflow

1. Inspect first. Run ls -l file or ls -ld directory. Record the current owner, group, type, and permission triplets.
2. Identify the intended user. Decide whether access is for the owner, owning group, or others. Check group membership when shared access is expected.
3. Identify the operation. Reading a file, editing its contents, listing a directory, traversing a directory, and deleting an entry can require different permissions.
4. Apply the narrowest change. Prefer a focused command such as chmod u+x script.sh or a suitable group assignment over a broad mode such as 777.
5. Be cautious with recursion. Use recursive operations only when one intentional policy applies to all nested contents.
6. Verify afterward. Run the inspection command again and test the intended operation as the intended account when practical.

Troubleshooting permission errors

Permission denied when running a script

Check whether the file has the required execute bit, whether each parent directory has search permission, and whether the account matches the applicable owner, group, or others class.

ls -l script.sh
ls -ld /path /path/to

If the owner should run it, a narrow resolution may be:

chmod u+x script.sh

Do not grant execute access to everyone unless that is part of the intended policy.

A user can see a directory name but cannot list or enter it

Inspect the directory with ls -ld directory. Missing read permission prevents normal listing; missing execute/search permission prevents traversal. Add only the capability that is intended. Read and execute are separate directory permissions.

A user cannot modify a file even though the group has write permission

Confirm that the user is actually a member of the file's owning group. Also check the parent directory: creating, removing, and renaming entries depend primarily on directory permissions. Compare the requested operation with the relevant target—editing file contents differs from creating or deleting a directory entry.

Files became inaccessible after recursive chmod

A common cause is applying one mode to both files and directories. Directories generally need execute/search permission for traversal, while only programs and scripts that should run need file execute permission. Inspect representative files and directories separately, then restore modes according to their roles.

chown reports “operation not permitted”

The current account may lack administrative authority, or the filesystem may impose ownership restrictions. Check current ownership, account privileges, the target path, and the filesystem context. Do not change ownership merely to bypass an error without understanding the intended ownership model.

Exam-relevant points

• The nine basic permission positions are read as user, group, and others triplets.
• Numeric values are read 4, write 2, and execute 1; each class digit is their sum.
• File read means reading contents; directory read means listing entries.
• File write changes contents; directory write changes entries such as creating, removing, or renaming them.
• Directory execute means search or traversal, and is required to reach known paths inside.
• Ownership determines which permission class is evaluated. The owner class does not combine with group permissions.
• chmod changes modes, chown changes owner and optionally group, and chgrp changes only group.
• Recursive operations affect nested contents and should be used only with an intentional policy.

For a broader ownership workflow, see Manage File Ownership. You can also review the Linux File Structure to understand how paths and parent directories affect access.