🔐 File Permissions

The Big Idea

Linux is a multi-user system. Permissions answer three questions:

1. WHO can access this file?
2. WHAT can they do with it?
3. HOW strict are the rules?

---

The Three Permission Types

Letter	Number	Meaning	For Files	For Directories
r	4	Read	View contents	List contents
w	2	Write	Modify contents	Add/delete files
x	1	Execute	Run as program	Enter directory

---

The Three User Classes

Class	Symbol	Who
Owner	u	The user who owns the file
Group	g	Users in the file’s group
Others	o	Everyone else

---

Reading Permissions

ls -l myfile.txt
-rw-r--r-- 1 alice developers 1024 Dec 30 10:00 myfile.txt

Breaking down -rw-r--r--:

 -    rw-    r--    r--
 │    └┬┘    └┬┘    └┬┘
 │     │      │      │
type  owner  group  others

- = regular file
d = directory
l = symbolic link

This means:

• Owner (alice): can read and write
• Group (developers): can only read
• Others: can only read

---

Octal Notation

Each permission class is a number from 0-7:

 r   w   x
 4 + 2 + 1 = 7 (full access)
 4 + 0 + 0 = 4 (read only)
 4 + 2 + 0 = 6 (read + write)

Common Permission Patterns

Octal	Symbolic	Meaning
755	rwxr-xr-x	Executable program
644	rw-r–r–	Normal document
600	rw—––	Private file
700	rwx——	Private executable
777	rwxrwxrwx	DANGEROUS! Everyone can do anything

---

chmod — Change Permissions

Octal Method

chmod 755 script.sh      # rwxr-xr-x
chmod 644 document.txt   # rw-r--r--
chmod 600 secret.key     # rw-------

Symbolic Method

chmod u+x script.sh      # Add execute for owner
chmod g-w file.txt       # Remove write for group
chmod o-rwx private.txt  # Remove all for others
chmod a+r public.txt     # Add read for all
chmod u=rwx,go=rx file   # Set exact permissions

Symbols:

• + add permission
• - remove permission
• = set exactly
• u owner, g group, o others, a all

---

chown — Change Ownership

Only root can change ownership:

sudo chown alice file.txt              # Change owner
sudo chown alice:developers file.txt   # Change owner and group
sudo chown :developers file.txt        # Change group only
sudo chown -R alice:alice directory/   # Recursive

---

Special Permissions

Octal	Name	Effect
4000	SUID	Run as file owner
2000	SGID	Run as file group
1000	Sticky	Only owner can delete

The /tmp directory has the sticky bit:

ls -ld /tmp
drwxrwxrwt 10 root root 4096 Dec 30 10:00 /tmp
       └── 't' means sticky bit

---

Security Best Practices

1. Never use 777 — Anyone can modify your files
2. Private keys should be 600 — SSH will refuse insecure keys
3. Scripts should be 755 — Readable but owner-modifiable
4. Home directory should be 755 or 700

---

Try It!

Use the terminal to practice permissions:

Exercises:

1. ls -l to see current permissions
2. Create a file: touch myfile.txt
3. Check its default permissions
4. Make it private: chmod 600 myfile.txt
5. Try to read /etc/shadow (you’ll get “Permission denied”)
6. Switch to root: su root and try again

Try it: change permissions

The matrix on the right shows every file’s mode, owner, and group as you run chmod and chown. Goal: chmod 755 script.sh.