Permissions: who can do what

Linux was designed for many people sharing one computer. Every single file carries a tiny rulebook that says who may read it, change it, or run it. Once you can read that rulebook, a lot of mysterious “Permission denied” errors suddenly make sense.

Three questions, three groups of people

Every file has an owner (a user) and a group. Linux sorts everyone into exactly one of three classes, then checks the matching three letters:

• r = read, w = write, x = execute. A - means “not allowed.”
• If you're the owner, only the owner letters count. If you're in the file's group, the group letters count. Otherwise, the “others” letters count.
• root ignores all of this. That's why sudo fixes “Permission denied.” It's also why you should use it carefully.

Files vs folders

Permissions as numbers

Admins usually write permissions as three digits. Each letter has a value: r = 4, w = 2, x = 1. Add them up for each class:

Changing permissions: chmod

chmod +x backup.sh        # add execute for everyone (so you can ./backup.sh)
chmod u+x,go-w notes.txt  # owner gets x, group & others lose w
chmod 600 diary.txt       # only me: read + write
chmod 755 website/        # folder: everyone can enter and look, only I can change
chmod -R g+w shared/      # -R = everything inside, too

With letters you pick who (u owner, g group, o others, a all), an action (+ add, - remove, = set exactly), and which letters. Only a file's owner (or root) may chmod it.

Changing owners: chown and chgrp

sudo chown alex report.txt            # new owner
sudo chown alex:webteam report.txt    # new owner AND group
sudo chown -R alex:alex /home/alex    # everything inside, too
sudo chgrp webteam report.txt         # just the group

Giving files away needs root. Otherwise you could make a file look like someone else's.

Default permissions: umask

New files start from 666 and new folders from 777. Then the umask takes permissions away. For normal users, both families use a umask of 0002 (a mask from the “user private group” setup), so:

new file   → 666 - 002 = 664  rw-rw-r--
new folder → 777 - 002 = 775  rwxrwxr-x
(root uses umask 0022 → files 644, folders 755)

Where the families differ

That last row matters. If you chmod 600 a web page, the web server's user can't read it anymore, and visitors get 403 Forbidden. Web files need r for “others”: 644 for files, 755 for folders.

Try it

Quick check