File permissions: rwx, chmod and chown

Reading permissions

$ ls -l /srv/payroll.csv
-rw-r-----. 1 meena finance 20480 Oct 19 11:00 /srv/payroll.csv

After the type letter, the nine characters are three groups of three: owner, group, others. Each slot shows the letter if allowed, or a dash if not. Linux checks them in order: if you are the owner, only the owner set counts; else if you are in the group, only the group set counts; else the others set. root skips these checks for reading and writing.

Note the directory row. Deleting a file needs w on the DIRECTORY, not on the file. And a directory without x is almost useless: you cannot cd into it or open anything inside, even if the files themselves are readable.

Numbers (octal mode)

Each permission has a value: r = 4, w = 2, x = 1. Add the values in each set to get one digit, so three digits describe all nine slots. This form is called octal because each digit is 0 to 7.

So rwxr-x--- is 750, rw-r--r-- is 644, and rw------- is 600. Common choices: 644 for normal files, 755 for programs and public directories, 600 for secrets such as private keys, 750 or 770 for team directories.

chmod: changing permissions

$ chmod 640 payroll.csv          # numbers: rw-r-----
$ chmod u+x deploy.sh            # letters: add execute for the owner
$ chmod g-w,o-r report.txt       # remove group write and others read
$ chmod o= secret.txt            # others: nothing
$ chmod a+r notice.txt           # a = all (u, g and o)
$ chmod -R g+rX /srv/team        # recursive; capital X = execute only on directories (and files already executable)

In the letter form, who is u, g, o or a; the operator is + (add), - (remove) or = (set exactly); and then the permissions. Letters are best for small changes; numbers are best for setting everything at once.

chown and chgrp: changing owner and group

# chown meena payroll.csv            # new owner
# chown meena:finance payroll.csv    # owner and group together
# chown :finance payroll.csv         # group only (same as chgrp finance payroll.csv)
# chown -R apache:apache /var/www/app  # whole tree

Common mistakes

• chmod 777 to "fix" a permission error. It lets everyone change or replace the file, which is a real security hole. Find out which user needs what, and give only that.
• chmod -R 755 on a tree with private keys or config files makes them readable by all. Use -R g+rX or set files and directories separately with find -type f / -type d.
• Forgetting execute on the directories along a path. To read /srv/team/plan.txt you need x on /srv and /srv/team as well as r on the file.
• Running a script with ./deploy.sh and getting "Permission denied": add execute with chmod u+x deploy.sh (or run bash deploy.sh).