🔐 Lesson 3.2: File Permissions

Reading Permissions

When you run ls -l, the first column shows the file's permissions:

ls -l
# -rw-r--r-- 1 ray ray  1234 Apr 14 10:00 notes.txt
# drwxr-xr-x 2 ray ray  4096 Apr 14 10:00 projects/

Let's break down that first column character by character:

 -   rw-   r--   r--
 │    │     │     │
 │    │     │     └── Others: read only
 │    │     └──────── Group:  read only
 │    └────────────── Owner:  read + write
 └─────────────────── Type:   - = file, d = directory, l = link

Permission Types: r, w, x

Permission Levels: User, Group, Other

Permissions are checked in a specific order:

# This file:
# -rw-rw-r-- 1 ray developers 1234 Apr 14 10:00 project.txt
#
# ray (owner)       → can read and write
# developers group  → can read and write
# everyone else     → can only read

chmod — Symbolic Mode

chmod (change mode) modifies file permissions. Symbolic mode uses letters:

# Add execute permission for the owner
chmod u+x script.sh

# Remove write permission from group and others
chmod go-w secret.txt

# Give everyone read permission
chmod a+r readme.txt

# Set exact permissions: owner rwx, group rx, others nothing
chmod u=rwx,g=rx,o= project.sh

# Make a script executable by everyone
chmod +x myscript.sh   # shorthand for a+x

chmod — Octal (Numeric) Mode

Octal mode uses a three-digit number where each digit represents one permission level:

# 755: owner rwx, group r-x, others r-x (common for scripts/dirs)
chmod 755 script.sh

# 644: owner rw-, group r--, others r-- (common for regular files)
chmod 644 document.txt

# 700: owner rwx, nobody else (private)
chmod 700 secrets/

# 600: owner rw-, nobody else (private file)
chmod 600 id_rsa

# Apply recursively to a directory and all its contents
chmod -R 755 project/

Common Permission Patterns

chown and chgrp

Permissions control what can be done; ownership controls who the permissions apply to.

chown — Change Owner

# Change the owner of a file
sudo chown alice report.txt

# Change owner AND group at the same time
sudo chown alice:developers report.txt

# Change only the group (note the colon before the group name)
sudo chown :developers report.txt

# Recursive — change an entire directory tree
sudo chown -R alice:developers project/

chgrp — Change Group

# Change just the group
sudo chgrp developers report.txt

# Recursive
sudo chgrp -R developers project/

Permissions on Directories

Directory permissions work differently than file permissions, which trips up many beginners:

# Demonstrate directory permissions
mkdir testdir
echo "secret" > testdir/file.txt

# Remove read: can't list but can access by name
chmod u-r testdir
ls testdir/           # Permission denied
cat testdir/file.txt  # Works! (if you know the name)

# Remove execute: can list names but nothing else works
chmod u+r,u-x testdir
ls testdir/           # Shows file.txt
cat testdir/file.txt  # Permission denied

# Restore both
chmod u+rx testdir

Special Permissions

Beyond the basic rwx, Linux has three special permission bits you'll encounter:

# See setuid in action: passwd has an 's' where you'd expect 'x'
ls -l /usr/bin/passwd
# -rwsr-xr-x 1 root root 68208 Apr 14 2026 /usr/bin/passwd

# See the sticky bit on /tmp: 't' at the end
ls -ld /tmp
# drwxrwxrwt 12 root root 4096 Apr 14 10:00 /tmp

# Set sticky bit on a shared directory
chmod +t shared_folder/

# Set setgid on a group directory (new files inherit group)
chmod g+s team_project/

Exercises

-rwxr-xr--  1 alice developers  report.sh
-rw-------  1 bob   bob         secrets.txt
drwxrwxr-x  2 alice developers  shared/

# Create test files
touch public.txt private.txt script.sh

# Make public.txt readable by everyone
chmod 644 public.txt
ls -l public.txt  # -rw-r--r--

# Make private.txt accessible only to you
chmod 600 private.txt
ls -l private.txt  # -rw-------

# Make script.sh executable
chmod 755 script.sh
ls -l script.sh  # -rwxr-xr-x

# Same results using symbolic mode:
chmod a+r public.txt
chmod go-rwx private.txt
chmod u+x,go+rx script.sh

# Create a file and check ownership
touch teamfile.txt
ls -l teamfile.txt
# Your username is both owner and group

# Change the group (if you're in a group like "sudo")
sudo chgrp sudo teamfile.txt
ls -l teamfile.txt

# Change both owner and group
sudo chown root:root teamfile.txt
ls -l teamfile.txt

# Take it back
sudo chown $USER:$USER teamfile.txt

# Clean up
rm teamfile.txt

Knowledge Check

Quick Reference

Summary

🚀 What's Next?

Module 4 covers viewing and editing files — you'll learn cat, less, head, tail, grep, and the text editors nano and vim.