Linux permissions: read, write, execute and chmod

On Linux every file and folder has an owner, a group and a set of permissions that decide who can do what. It is a simple model, inherited from Unix, but understanding it well solves half of all «permission denied» problems and prevents dangerous setups such as the infamous chmod 777.

Reading permissions with ls -l

The ls -l command shows a line like this:

-rw-r--r-- 1 anna office 2048 Mar 3 10:15 report.txt

The first character is the type: - regular file, d directory, l symbolic link. Nine characters follow, split into three groups of three:

Then come the owner (anna) and the group (office). The system checks the categories in order: if you are the owner, the owner's permissions apply, even if the group's were broader.

What r, w and x mean

For files the meaning is intuitive: r allows reading the content, w modifying it, x running it as a program or script.

For directories things are less obvious:

• r allows listing the names of the files inside;
• w allows creating, renaming and deleting files inside it;
• x allows traversing the directory, that is entering it and accessing files whose name you know.

An important consequence: whether you can delete a file depends on the permissions of the directory containing it, not on those of the file itself. A read-only file can be removed by anyone with write permission on the directory.

Octal notation

Each permission has a value: r = 4, w = 2, x = 1. Adding them gives one digit per category.

• 7 = 4+2+1 = rwx
• 6 = 4+2 = rw-
• 5 = 4+1 = r-x
• 4 = r--
• 0 = ---

So 644 means rw-r--r--, typical for documents, and 755 means rwxr-xr-x, typical for directories and programs. For a file holding confidential data, such as a private key, you use 600: only the owner reads and writes.

chmod: changing permissions

chmod accepts both the octal and the symbolic form.

chmod 640 contract.pdf         # rw- r-- ---
chmod u+x backup.sh            # adds execute for the owner
chmod go-w shared.txt          # removes write from group and others
chmod -R g+rX project/         # read for the group, X only where needed

In symbolic form u, g, o and a stand for owner, group, others and all; +, - and = add, remove or set. The capital X is a valuable detail: it grants execute only to directories and to files that are already executable for someone, so you do not make every document executable when working recursively.

chown and chgrp: changing owner and group

chown user file changes the owner, chown user:group file changes both, chgrp group file only the group. Changing a file's owner requires administrator privileges, so sudo is usually involved. With -R the operation becomes recursive: convenient, but to be used carefully on system directories.

Why chmod 777 is almost always wrong

When a web application cannot write to a directory, the temptation is to give it 777: everyone can read, write and execute. The problem disappears, but any user or process on the system can now modify or replace those files. The correct fix is to work out which user needs to write, for instance the user the web server runs as, and give that user ownership or group membership, keeping tight permissions such as 750 or 770.

umask: the starting permissions

New files are not created with random permissions. The umask says which permissions to remove from the base values, which are 666 for files and 777 for directories. With the common umask 022, files are created 644 and directories 755. With 027, the group loses write and others lose everything, giving 640 and 750. Running umask without arguments shows the current value.

The special bits

Besides the nine permissions there are three extra bits:

• setuid on an executable makes it run with the privileges of the file's owner. It is the mechanism that lets passwd update a system file the user could not otherwise touch. It appears as s in place of the owner's x.
• setgid on a directory makes new files inherit the directory's group: ideal for a team's shared folders.
• sticky bit on a directory prevents deleting other people's files even for those with write permission. It is why /tmp is writable by everyone without each user being able to remove the others' files; it appears as t at the end.

In octal form they are added as a leading fourth digit: chmod 2770 shared/ sets setgid, chmod 1777 /tmp the sticky bit.

In short

• Every file has separate rwx permissions for owner, group and others.
• On directories x means traverse and w allows creating and deleting the files inside.
• In octal r=4, w=2, x=1: 644 for documents, 755 for programs, 600 for confidential data.
• Instead of 777, give ownership or group to the user who actually needs to write.
• setgid and the sticky bit neatly solve shared directories.