Permissions & Ownership

Understanding permissions

Every file and directory has an owner, a group, and a set of permissions. Run ls -l to see them:

$ ls -l
-rw-r--r-- 1 user user  123 Aug  5 10:00 notes.txt

The first column is the permission string. It has ten characters:

- rw- r-- r--
│ │    │    └── permissions for others
│ │    └─────── permissions for the group
│ └─────────── permissions for the owner
└──────────────── file type (- = file, d = directory, l = link)

Each triple is read (r), write (w), execute (x). A - means that permission is absent. For a directory, r means list contents, w means create/delete files inside, and x means enter it (cd).

chmod — change permissions

chmod changes permissions. Use the numeric (octal) form: read = 4, write = 2, execute = 1, and add them per role.

$ chmod 644 notes.txt    # owner rw-, group r--, others r--
$ chmod 755 script.sh    # owner rwx, group r-x, others r-x
$ chmod 600 secret.txt   # owner rw- only

Common values:

The symbolic form uses letters instead of numbers:

$ chmod +x script.sh      # add execute for everyone
$ chmod u+w notes.txt     # add write for the owner (u=user, g=group, o=others)
$ chmod g-r notes.txt     # remove read from the group
$ chmod -R 755 mydir      # recursive: apply to everything inside

chown — change owner

chown changes which user owns a file or directory. It needs root.

$ sudo chown alice notes.txt

To change both owner and group, use user:group:

$ sudo chown alice:staff notes.txt

chgrp — change group

chgrp changes the group of a file. The owner can usually do this for their own files.

$ chgrp staff notes.txt

umask — default permissions

umask sets the default permission mask for new files. The mask names the permission bits that are removed from the base (666 for files, 777 for directories): 022 strips write for group and others, 077 strips everything for group and others.

$ umask
0022

A mask of 022 means new files are created as 644 and new directories as 755. A stricter mask like 077 gives new files 600.

$ umask 077
$ touch new.txt
$ ls -l new.txt
-rw------- 1 user user 0 Aug  5 10:00 new.txt

The umask command only affects the current shell. To make it permanent, add it to your shell startup file (~/.bashrc).

id — who am I?

id shows your user, group and user ID:

$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo)

whoami prints just the username — the short answer to “who am I right now?”. After sudo -i it shows root:

$ whoami
alice

sudo — run as administrator

sudo runs a single command with root privileges. It is the safe way to do administrative work without logging in as root.

$ sudo apt update
$ sudo systemctl restart ssh

When you run sudo, you are asked for your own password once; the privileges are cached for a few minutes.

$ sudo -i
# whoami
root

Careful: with root power, rm, chmod and chown can break the system. Always double-check the path when running them with sudo.