Unit

Modify File Permissions: Numeric Modes, Special Permissions, and Access Control

Learn to inspect and modify Linux file permissions with ls, chmod, numeric and symbolic modes, recursive changes, special bits, ownership, and troubleshooting.

Linux permissions control who may read, change, enter, or run a filesystem object. The main command for changing these access bits is chmod. This lesson covers symbolic and numeric modes, directories, recursive changes, special permission bits, ownership, verification, and least-privilege practices.

1. The Unix Permission Model

A file or directory has three ordinary permission classes:

• Owner or user: the user account associated with the object.
• Group: the group associated with the object.
• Other: every user who is neither the owner nor a member of the owning group.

Each class can have read (r), write (w), and execute (x) permission. A mode is the complete collection of ordinary permissions and special bits assigned to a filesystem object.

Directory permissions differ from file permissions. Directory read permission lets a user list names, but directory execute permission is normally required to access an item by name. Directory write permission controls changes to entries, such as creating, removing, or renaming files; it does not by itself make existing file contents writable.

For example, a user might know that reports/summary.txt exists but still be unable to open it because the user lacks execute permission on reports or on an ancestor directory.

2. Inspecting Permissions with ls -l

Use ls -l to inspect a directory entry:

ls -l path

A typical result is:

-rw-r--r-- 1 alice developers 1842 Aug 18 09:30 document.txt
drwxr-x--- 2 alice developers 4096 Aug 18 09:31 project

The first character identifies the file type. The next nine characters are three groups of three permissions:

- rw- r-- r--
|  |   |   |
|  |   |   +-- other: read
|  |   +------ group: read
|  +---------- owner: read and write
+------------- regular file

• - indicates a regular file.
• d indicates a directory.
• l indicates a symbolic link. Its target is normally shown after an arrow.
• Other first characters can identify special filesystem objects, such as device files or sockets.

In -rw-r--r--, the owner has rw-, the group has r--, and other users have r--. In drwxr-x---, the object is a directory; its owner can list, modify entries, and traverse it, the group can list and traverse it, and other users have no listed permissions.

Special bits may replace the execute indicators. Lowercase s or t means the special bit and execute permission are both enabled. Uppercase S or T means the special bit is enabled but the corresponding execute permission is not.

3. Symbolic chmod Notation

chmod changes mode bits. Symbolic mode describes the classes, operation, and permissions directly.

chmod u+x script.sh       # Add execute permission for the owner
chmod g+w project.txt     # Add group write permission
chmod o-r private.txt     # Remove read permission from other users
chmod u=rw,g=r,o= file.txt # Set an exact scheme

The + and - operators make incremental changes. They preserve unrelated bits. The = operator replaces the selected class's ordinary permissions with exactly the letters supplied. For example, chmod g=rw file gives the group read and write permissions and removes group execute permission.

You can change multiple classes in one expression:

chmod u=rw,g=rw,o= project.txt
chmod a+r notice.txt
chmod u-x,g-x,o-x program

If no class is specified, the command uses the default behavior defined by the platform and shell utility. Explicit classes such as u, g, and o make the intended change clearer.

4. Numeric, or Octal, Modes

A numeric mode expresses permissions as octal digits. Octal is base 8. For each class, add the values of its permissions:

• read = 4
• write = 2
• execute = 1

Thus, read plus write is 6, read plus execute is 5, write plus execute is 3, and read plus write plus execute is 7. The three ordinary digits are ordered owner, group, other.

For example, 644 is calculated as owner 4+2=6, group 4=4, and other 4=4:

chmod 644 document.txt
# owner: rw- = 4 + 2 = 6
# group: r-- = 4
# other: r-- = 4

A numeric mode sets the specified ordinary permission bits; it does not incrementally add them. Therefore, chmod 644 file makes the ordinary mode exactly rw-r--r--, removing any existing group or other write and execute bits.

5. Choosing Permissions for Files and Directories

Useful starting points include 600 for a private file, 644 for a non-secret publicly readable document, 700 for a private directory, and 770 or 775 for collaboration depending on whether other users should have access.

Execute permission is normally appropriate for directories because users need it to enter or search them. It is appropriate for regular files only when the file is intended to be run, such as a script or compiled program. Avoid assigning one file-oriented mode to an entire tree containing both directories and regular files.

6. Recursive Changes

The -R option makes an operation recursive: it applies to a directory and its descendants.

chmod -R g+rwX project

Here, g+rwX adds group read and write permission and uses capital X to add execute permission only to directories and to files that already have an execute bit. This is safer than blindly adding x to every regular file.

Recursive changes are still potentially dangerous. A broad numeric command can make scripts non-executable, make ordinary data files executable, remove traversal permission from directories, or expose sensitive material. Inspect the tree before and after the change.

find project -print
find project -type d -exec chmod 755 {} +
find project -type f -exec chmod 644 {} +

The two find commands assign different modes to directories and regular files. Review whether scripts, private files, generated files, and special objects need exceptions before using this pattern.

7. Special Permission Bits

Special bits extend the basic owner, group, and other model. Use them cautiously because they can affect identity, inheritance, and deletion behavior.

Symbolic examples:

chmod u+s program       # Set setuid
chmod u-s program       # Remove setuid
chmod g+s shared-project # Set setgid
chmod g-s shared-project # Remove setgid
chmod +t shared-temp    # Set the sticky bit
chmod -t shared-temp    # Remove the sticky bit

Numeric prefixes are placed before the three ordinary digits:

chmod 2750 shared-project # setgid, owner rwx, group r-x, other ---
chmod 1777 shared-temp    # sticky, rwx for all classes
chmod 4755 helper         # setuid plus ordinary mode 755

On an executable, setuid changes the effective user identity during execution. Setgid can similarly affect the effective group identity. On a directory, setgid is commonly used for a project area so newly created entries inherit the directory's group. A suitable group ownership and group-oriented umask are still important.

A sticky directory such as 1777 permits users to create files while restricting deletion and renaming of files owned by other users. This is useful for temporary-style shared locations, but world-writable access should never be added without a clear requirement.

8. Ownership and Permission-Class Selection

chmod changes access bits; it does not change ownership. Related commands are:

chgrp developers shared-project
chown user:group path

Changing ownership generally requires elevated privileges. For group collaboration, assign the correct group with chgrp, add users to that group through appropriate administration, and use setgid or an ACL policy as needed. See Administer Groups for related group concepts.

For each access check, the process is treated as the owner, a member of the owning group, or other. Permissions are not combined across classes. If the process is the owner, a permissive group or other field does not compensate for a missing owner permission. If it is not the owner but matches the owning group, the group class is used rather than combining group and other permissions.

9. Verify and Test Changes

Always verify a permission change:

ls -l document.txt
stat document.txt
id
umask

stat provides detailed metadata and commonly displays the numeric mode. id shows the current identity and group memberships. umask displays the process setting that removes default permissions from newly created files and directories; it does not directly change existing objects.

Test with an account that represents the intended owner, group member, or unrelated user. A test performed only as an administrator may hide a denial that affects ordinary users.

For a nested path, inspect every component:

namei -l /path/to/item
ls -ld /path /path/to /path/to/item

namei -l helps identify a parent directory that lacks execute/search permission. If the mode bits look correct but access still fails, investigate ACLs, filesystem mount options, read-only state, SELinux or AppArmor policy, and application-level checks.

10. Practical Permission Tasks

Private text file

chmod 600 private.txt
ls -l private.txt

The owner can read and write; group and other have no ordinary permissions. This is a common baseline for private data, but credentials and keys may also have application-specific requirements.

Owner-writable, publicly readable document

chmod 644 document.txt

The digits mean owner 6 (rw-), group 4 (r--), and other 4 (r--).

Group-editable project file

chmod g+w project.txt
ls -l project.txt

This adds group write without necessarily changing unrelated permissions. Confirm that other users do not have write access.

Private directory

chmod 700 private-directory

The owner receives read, write, and execute. Directory execute is included so the owner can enter and search the directory.

Shared project directory

chgrp developers shared-project
chmod 2775 shared-project
ls -ld shared-project

Mode 2775 sets setgid and gives owner and group full directory access while allowing other users to traverse and read directory contents where permitted. Set the group deliberately and verify that membership is correct.

Shared temporary-style directory

chmod 1777 shared-temp
ls -ld shared-temp

The sticky bit limits deletion and renaming of entries by unrelated users. This mode still permits broad creation and access, so use it only for an intentional shared location.

11. Troubleshooting Permission Problems

“A user can read a file but cannot modify it.”

• Inspect ls -l and determine whether the user is the owner, a member of the owning group, or other.
• Check identity and groups with id.
• Check whether the filesystem or file is read-only.
• Grant write access to the correct class, or correct ownership or group membership. Do not solve a narrowly scoped problem with world-writable access.

“The file is readable, but the user cannot access it.”

• Run namei -l /full/path/to/file.
• Inspect each parent with ls -ld.
• Look for missing execute/search permission on an ancestor.
• Check ACLs and mandatory access control if the mode bits are not the cause.

“chmod 777 did not fix the problem.”

Mode 777 may not affect ownership, parent-directory traversal, ACLs, mount options, SELinux or AppArmor, or application restrictions. It can also let any local user modify data, creating confidentiality, integrity, and malware risks. Revert overly broad permissions and diagnose the complete path and security policy instead.

“New shared files have the wrong group.”

• Check whether the shared directory has setgid, shown by s in the group execute position or by a numeric mode beginning with 2.
• Check the directory's group ownership and users' group memberships.
• Review umask, which can remove intended group permissions.
• Set the correct group and setgid bit, then establish a suitable umask or ACL policy.

“A recursive chmod changed file executability.”

A single numeric mode applied with chmod -R treats files and directories alike. Identify object types with find, then assign directory and regular-file modes separately. Preserve execute permission for scripts only where execution is intentional.

“Users can delete one another's files.”

Inspect the shared directory for the sticky bit and confirm ownership. A writable directory without the sticky bit allows users with suitable directory permissions to remove or rename entries owned by others. Add the sticky bit when that restriction is required, while remembering that privileged users and directory owners may still have additional authority.

12. Security and Least Privilege

• Choose the narrowest permissions that satisfy the actual access requirement.
• Avoid unnecessary world-writable and world-executable permissions.
• Protect private keys, credentials, configuration secrets, and user data. A mode such as 600 is often a safer starting point than a public mode.
• Do not treat chmod 777 as a general troubleshooting solution.
• Use setuid only when the executable is trusted, necessary, and maintained.
• For collaboration, prefer a controlled group, setgid directory, and suitable ACL or umask policy over broad access.

Standard mode bits are only one layer of access control. ACLs can add per-user or per-group entries beyond owner, group, and other. Filesystem mount options, read-only mounts, mandatory access controls such as SELinux or AppArmor, and application-level authorization can also allow or deny access.

13. Exam- and Practice-Ready Summary

• ls -l shows file type, owner permissions, group permissions, other permissions, owner, and group.
• r=4, w=2, and x=1; add values within each octal digit.
• chmod 644 file sets owner rw-, group r--, and other r--.
• Symbolic + adds, - removes, and = sets the selected class exactly.
• Directory execute means traversal/search; directory write controls entries, not necessarily file contents.
• Use chmod -R carefully. Separate directory and regular-file changes with find when appropriate.
• Special prefixes are setuid 4, setgid 2, and sticky 1.
• chmod changes mode bits, while chown and chgrp change ownership information.
• Use namei -l when a missing parent-directory permission may cause a denial.

For broader command-line practice, see Essential Linux Commands. If permissions involve SSH private keys, treat those files as sensitive data and apply least privilege.