VMware ESXi and vSphere Cluster Management

Manage File Ownership in Linux

Learn how Linux user and group ownership works, inspect UID and GID values, and safely use chown and chgrp to manage files and directories.

Linux assigns every filesystem object a user owner and a group owner. Ownership applies to regular files, directories, symbolic links, and other objects such as sockets and device files. The owner and group identify which permission classes apply; the permission bits then determine whether reading, writing, or execution is allowed.

This lesson explains how to inspect ownership and change it safely with ls, stat, chown, and chgrp. For related access control concepts, see Linux file ownership and permissions.

Linux's ownership model

A filesystem object has two ownership identities:

• File owner: the user account associated with the object.
• Group owner: the group associated with the object.

Ownership is different from permissions. Ownership answers “which user and group are associated with this object?” Permissions answer “what actions may the applicable user, group, or other users perform?” A file can be owned by alice and the group developers, while its permission bits independently specify whether Alice, members of developers, and everyone else may read, write, or execute it.

When a process creates a file, Linux normally assigns the creating process's effective user identity as the user owner. The group owner usually comes from the process's effective group identity, subject to directory group-inheritance rules and filesystem behavior. The effective identity is important: it is the identity the process uses for many access checks.

Files, directories, and symbolic links

Directories have owners and groups just like regular files. Their permissions control access to directory operations such as listing names, creating entries, removing entries, and traversing the directory. Therefore, changing a directory's ownership can affect administration and access to everything inside it, especially when combined with directory permission changes.

Symbolic links also have filesystem metadata, including an owner and group. Ownership commands may treat a symbolic link itself or its target differently depending on the command and options. Always confirm the behavior of the implementation on your system before using a recursive command in a tree containing links.

Users, groups, UID, and GID

A Linux user account represents an identity that can own files and run processes. A group is a collection of users used to organize access. Linux uses numeric identifiers internally:

• UID means User Identifier. It is the numeric value for a user account.
• GID means Group Identifier. It is the numeric value for a group.

Commands often translate these numbers into names. For example, a UID may be displayed as alice and a GID as developers. The numeric IDs remain the authoritative values stored in filesystem metadata. If an account or group cannot be resolved, a command may display a number instead of a name.

A user's primary group is the default group associated with the account and commonly the initial group identity of its processes. Supplementary groups are additional memberships that can affect access decisions. A process may use its effective UID and effective GID together with its supplementary groups when checking access.

Querying account and group information

Local account and group records are commonly defined in /etc/passwd and /etc/group. Modern systems may also obtain identity information from configured directory services or other sources. Use commands rather than editing these files directly for routine inspection:

id
id alice
groups

id shows the current user's UID, primary GID, and group memberships. groups lists groups available to the current user. To inspect the configured records directly, you can use:

getent passwd alice
getent group developers

The getent command consults the system's configured identity sources, rather than assuming that all accounts are stored only in local files.

Reading ownership with ls -l

Use a long listing to inspect a file:

ls -l report.txt

A result might look like this:

-rw-r----- 1 alice developers 1842 Aug 18 09:30 report.txt

In this example, alice is the user owner and developers is the group owner. The permission string is separate from those ownership columns.

Display numeric ownership

Use -n with ls to prevent name translation:

ls -ln report.txt

You may see output such as:

-rw-r----- 1 1001 1050 1842 Aug 18 09:30 report.txt

This is useful when investigating mismatched accounts across systems, containers, network filesystems, or missing identity records.

Use stat for detailed metadata

stat report.txt

stat reports detailed metadata, including owner and group names and numeric values. A typical result includes lines similar to:

Uid: ( 1001/   alice)   Gid: ( 1050/developers)

Exact formatting varies by operating system. The numeric UID and GID are especially useful when a displayed name is unavailable or ambiguous.

Change user ownership with chown

chown means “change owner.” Its basic form assigns a new user owner:

sudo chown newuser filename

Changing a file's user owner normally requires root or equivalent administrative privileges. Root is Linux's administrative account. sudo lets an authorized user run one command with another user's privileges, commonly root.

For example, to assign report.txt to the account bob:

sudo chown bob report.txt
ls -l report.txt
stat report.txt

Always verify the result. A successful command does not by itself prove that the intended path, account, and group were used.

Change user and group together

Use the owner:group form to set both identities:

sudo chown appuser:appgroup application.conf

This pattern is common when assigning an application file to a service account and its service group.

Change only the group with chown

To preserve the current user owner while changing the group, use a leading colon:

sudo chown :developers report.txt

Some systems also support an explicit owner-preserving form such as chown --preserve-root only for a different purpose; do not confuse that option with group-only syntax. The portable group-only pattern is :group, while chown user:group file changes both fields.

Change group ownership with chgrp

chgrp changes only the group owner:

chgrp developers report.txt
ls -l report.txt
stat report.txt

An ordinary user can generally change a file's group only to a group of which that user is a member, and normally must own the file. Exact behavior also depends on filesystem and system policy. Administrative users can change the group more broadly.

chgrp developers report.txt and chown :developers report.txt express the same group-only goal, but chgrp communicates that no user-owner change is intended. If the group is not one of your memberships, use authorized administrative privileges or ask an administrator.

Recursive ownership changes

The -R option makes an operation recursive: it applies to a directory and the objects below it.

sudo chown -R newuser:newgroup /srv/example-data

Use this only when every affected object should receive the requested ownership. A recursive command can alter configuration files, uploads, logs, nested application trees, or files that should remain owned by another account. Broad commands against system directories can break boot processes, services, SSH access, backups, package-managed files, or security boundaries.

Preview and limit the target

Record the current state and preview a limited portion of the hierarchy before changing it:

find /srv/example-data -maxdepth 2 -ls
sudo chown -R newuser:newgroup /srv/example-data
find /srv/example-data -maxdepth 2 -ls

Replace the example path with the exact intended directory. Check spelling, symbolic links, mount points, and whether the command's link-handling behavior matches your goal. Do not assume that a recursive ownership command will treat links exactly as you expect. Consult the local command manual with man chown before operating on a tree containing links.

Ownership, permissions, and process identity

A running program normally operates under the account that started it. The kernel uses the process's effective UID and effective GID, plus relevant supplementary groups, when performing many file-access checks. A privileged program may have a different effective identity from the person who launched it, so the visible login account is not always the identity that matters.

Ownership alone does not grant access. For example, a service may own a file but still be unable to update it if the owner permission lacks write access. Conversely, a process that is not the user owner may gain access through the group class or the “other” class, if those permission bits allow it.

When an application cannot write a file, inspect all of the following:

• The file's user owner and group owner.
• The file permission bits shown by ls -l.
• The permissions on parent directories, because accessing or replacing a file requires directory access.
• The account and groups under which the application process runs.
• Where applicable, ACLs, mandatory access controls, read-only mounts, and filesystem state.

Safe ownership administration

1. Identify the exact path and intended final owner and group.
2. Record the original owner and group with ls -l, ls -ln, or stat.
3. Check your identity and memberships with id or groups before attempting a group change.
4. Use the least privilege necessary. Prefer a narrowly scoped command over a broad recursive operation.
5. Preview directory contents before using -R.
6. Run the change only on the required path.
7. Verify the resulting owner and group, including numeric UID and GID when identity resolution may be unreliable.

Avoid commands such as sudo chown -R on broad system paths unless you have a documented, well-understood reason. Ownership changes can interfere with service startup, application deployments, SSH key access, backups, and files managed by the operating system's package tools.

Troubleshooting ownership problems

chown reports “Operation not permitted”

• Confirm that you have root-level authorization.
• Check whether the command requires sudo and whether your account is permitted to use it.
• Check whether the target filesystem supports the Unix ownership operation. Some mounted or non-native filesystems apply different ownership rules.

Use authorized administrative privileges or ask the system administrator to make the change.

chgrp rejects the target group

• Run id or groups and confirm membership in the target group.
• Confirm that you own the file when attempting a non-administrative group change.

Choose a group you belong to, or use authorized administrative privileges.

The owner appears as a number

Compare ls -ln with stat, then check whether matching account and group records exist through the configured identity source. The numeric UID and GID remain the filesystem values even when a name cannot be resolved.

A service cannot write despite the expected owner

Inspect permission bits, identify the service's effective user and group, and check parent-directory permissions. Then consider ACLs, mandatory access controls, and read-only filesystem state. Correct ownership or permissions only after identifying the service's actual access path.

A recursive command changed too much

Stop and inspect the affected path. Use command history, backups, deployment records, or the ownership listings you recorded earlier to determine what changed. Check symbolic links and nested mount points before attempting a narrow correction. Restore ownership from known-good records rather than repeating an unvalidated recursive command.

Command summary

# Inspect names and permission context
ls -l filename

# Inspect numeric UID and GID values
ls -ln filename
stat filename

# Inspect your identity and groups
id
groups

# Change only the user owner
sudo chown newuser filename

# Change both user and group owners
sudo chown newuser:newgroup filename

# Change only the group owner
chgrp newgroup filename
sudo chown :newgroup filename

# Preview and then cautiously change a directory tree
find directory -maxdepth 2 -ls
sudo chown -R newuser:newgroup directory
find directory -maxdepth 2 -ls