Understanding Linux File Permissions: The Complete Guide to Securing Your System Files

Linux systems incorporate many built-in security features to protect your data and system integrity. One fundamental aspect of Linux security revolves around file permissions and ownership.

Since everything in Linux is represented as a file—whether it’s a text document, directory, or device—implementing proper file permissions is crucial to prevent unauthorized access and potential security breaches.

This comprehensive guide will help you understand Linux file permissions, explore how to manage ownership effectively, and learn practical techniques to implement secure access controls for your files and directories.

File Permission Types

Before we explore terminal commands for managing file permissions, let’s first examine how permissions appear in a graphical user interface (GUI).

Using GUI

When you right-click on a file in most Linux desktop environments and access its properties, you’ll typically see a “Permissions” tab that displays access controls:

Notice that there are three distinct permission categories:

• Owner (the user who created the file)
• Group (the group the owner belongs to)
• Others (all other users on the system)

For any file they own, users can assign specific permissions or restrict access to groups and other users through this interface.

How to fix EACCES: permission denied, access ;/usr/local/lib/node_modules

Using the Terminal

In the terminal, you can view file permissions by using the ls command with the -l option:

ls -l

The output reveals several important pieces of information on each line:

1. The first character indicates the file type:
   • - for regular files
   • d for directories
   • l for symbolic links
2. The next nine characters (e.g., rwxr-xr-x) represent permission settings:
   • First three characters (positions 1-3): Owner permissions
   • Middle three characters (positions 4-6): Group permissions
   • Last three characters (positions 7-9): Other users’ permissions
3. The file owner’s username
4. The group that owns the file
5. The file size in bytes
6. The date and time of last modification
7. The filename

-rwxr-xr--  1  user1  admin  4096  Mar 15 10:30  example.txt
│││││││││  │  │││││  │││││  │││││  │││││││││││  │││││││││││
│││││││││  │  │││││  │││││  │││││  │││││││││││  └─► File name
│││││││││  │  │││││  │││││  │││││  └─► Last modified date/time
│││││││││  │  │││││  │││││  └─► Size in bytes
│││││││││  │  │││││  └─► Group name
│││││││││  │  └─► Owner name
│││││││││  └─► Number of hard links
└┬┘└┬┘└┬┘
 │  │  └─► Permissions for others (r--)
 │  └─► Permissions for group (r-x)
 └─► Permissions for owner (rwx)

Read: A Deep Dive into Linux Operating System Architecture: Components and Functions

Permission Types Explained

Understanding what each permission type allows is crucial for effective system security.

File Permissions

For regular files, the three basic permissions are:

• Read (r): Allows the assignee to view the file’s contents
• Write (w): Allows the assignee to modify the file
• Execute (x): Allows the assignee to run the file (if it’s a program or script)
• Dash (-): Indicates that a particular permission has not been granted

Directory Permissions

For directories, permissions have slightly different meanings:

• Read (r): Allows viewing the directory’s contents (using ls)
• Write (w): Allows creating, deleting, or renaming files within the directory
• Execute (x): Allows accessing the directory (using cd command)

Read: Linux directories explained

For example, if a file has permission rw-rw-r--, this means:

• Owner can read and write to the file (rw-)
• Group members can read and write to the file (rw-)
• Other users can only read the file (r--)

Since it’s not executable, no one can execute this file, as shown by the absence of ‘x’ in all three permission sets.

Here’s a visual breakdown of how file permissions work:

Read: A Beginner’s Guide to Symbolic Links in Linux

Modifying Permissions with chmod

The chmod command (change mode) allows you to modify file and directory permissions. You can use it with either numeric or symbolic notation. Using this command carelessly can create security vulnerabilities, so it’s important to understand how it works.

For example, the file rsyslog.conf has the following permissions:

This translates to:

• Owner: Read & Write (rw-)
• Group: Read only (r--)
• Others: Read only (r--)

While the shadow file has even more restrictive permissions:

Read: How to speed up Linux

Using chmod with Numeric Mode

The basic syntax of the chmod command is:

chmod {options} file_name

When using numeric mode, each permission has a corresponding value:

To set permissions, you add the values for each permission type you want to grant. You’ll need three digits—one each for owner, group, and other users.

Read: ‘usermod’ command usage in Ubuntu/Debian: a beginner’s guide

Example 1: To set permissions rw-r--r-- (owner can read/write; group and others can only read):

chmod 644 lion.jpg

Breaking down the permissions:

• Owner: Read (4) + Write (2) = 6
• Group: Read (4) = 4
• Others: Read (4) = 4

Example 2: To set permissions rw-rw-rwx (owner and group can read/write; others can read/write/execute):

chmod 667 lion.jpg

Breaking down the permissions:

• Owner: Read (4) + Write (2) = 6
• Group: Read (4) + Write (2) = 6
• Others: Read (4) + Write (2) + Execute (1) = 7

Example 3: To set permissions rwxr--r-- (owner can read/write/execute; group and others can only read):

chmod 744 lion.jpg

Breaking down the permissions:

• Owner: Read (4) + Write (2) + Execute (1) = 7
• Group: Read (4) = 4
• Others: Read (4) = 4

Example 4: To set permissions r-x---w- (owner can read/execute; group has no permissions; others can only write):

chmod 502 lion.jpg

Breaking down the permissions:

• Owner: Read (4) + Execute (1) = 5
• Group: No permissions = 0
• Others: Write (2) = 2

Here’s a summary table of common permission values:

Read: How to fix ​​403 Forbidden Error

Using chmod with Symbolic Mode

Symbolic mode provides a more intuitive way to change permissions. The basic syntax is:

[ugoa...][[+-=][rwxXstugo...]...]

This breaks down into three parts:

1. Who: Specifies which users’ permissions to change
   • u: User (owner)
   • g: Group
   • o: Others
   • a: All (u+g+o)
2. Operation: Specifies how to change the permissions
   • +: Add the specified permissions
   • -: Remove the specified permissions
   • =: Set permissions to exactly what’s specified
3. Permissions: Specifies which permissions to modify
   • r: Read
   • w: Write
   • x: Execute
   • X: Execute only if the file is a directory or already has execute permission
   • s: Set user or group ID on execution
   • t: Save program text

Read: Master the Linux Filesystem Hierarchy Standard (FHS): The Ultimate Guide to Navigating and Understanding Linux Directories

Let’s look at some examples to understand how symbolic mode works:

Example 1: Grant execute permission to others for a file:

chmod o+x lion.jpg

This adds execute permission (+x) for others (o), changing the permissions from rwx------ to rwx-----x.

Example 2: Remove write and execute permissions from others:

chmod o-wx lion.jpg

This removes write and execute permissions (-wx) for others (o), resulting in rwx------.

Example 3: Grant all permissions to everyone:

chmod ugo+rwx lion.jpg

This adds read, write, and execute permissions (+rwx) for the owner, group, and others (ugo), resulting in rwxrwxrwx.

Adding Multiple Permissions

You can specify multiple permission changes in a single command by separating them with commas:

chmod g+x,o+x lion.jpg

This adds execute permission to both group and other users simultaneously.

Changing Permissions Recursively

To apply permissions to all files and directories within a specific directory, use the -R option:

chmod 777 -R /path_to_directory

To change permissions for only files within a directory:

find /path_to_directory -type f -print0 | xargs -0 chmod 644

To change permissions for only directories within a directory:

find /path_to_directory -type d -print0 | xargs -0 chmod 755

Note: The standard permission for files is typically 644, while directories commonly use 755.

Cloning Permissions Between Files

You can copy permissions from one file to another using the --reference option:

chmod --reference=file1 file2

In this example, tst.txt now has the same permissions as lion.jpg (changed from rw-r--r-- to -w--wx-wx).

Read: Ubuntu/Debian monitoring tools guide for system administrators

Changing File Ownership

In addition to permissions, Linux provides commands to change file ownership: chown for changing both user and group ownership, and chgrp for changing only group ownership.

Using chown Command

The basic syntax for chown is:

chown options User[.Group] File

Where:

• User: Username or UID of the new owner
• Group: New group name or GID
• File(s): Name of one or more files/directories

The various formats allow different changes:

• user: Changes only the owner
• user:: Changes the owner and sets the group to the user’s login group
• user:group: Changes both owner and group
• :group: Changes only the group

Note: Only the root user or a user with sudo privileges can change file ownership.

Read: How to use sudo without having to enter a password in Ubuntu

Changing the owner of a file:

chown new_owner file_name

For example, to change the owner of a file named myfile to net2_adm:

chown net2_adm myfile

You can specify multiple files or directories by separating them with spaces:

chown net2_adm myfile mydirectory

Changing only the group of a file:

chown :new_group file_name

For example, to change the group of myfile to normal_users:

chown :normal_users myfile

Changing both the owner and group of a file:

chown user:group file_name

For example, to change the owner to net2_adm and group to admins:

chown net2_adm:admins myfile

Changing ownership recursively:

To change ownership of a directory and all its contents, use the -R option:

chown -R user:group directory

For example:

sudo chown -R net2_adm:admins documents

Cloning ownership between files:

chown --reference=reference_file target_file

This assigns the same user and group ownership from the reference file to the target file.

Using chgrp Command

While chown can change both user and group ownership, chgrp is dedicated to changing only group ownership:

chgrp [options] new_group file(s)

For example, to change the group of my_file to admins:

chgrp admins my_file

For multiple files:

chgrp admins first_file first_directory second_directory second_file

Like chown, you can use the -R option to recursively change group ownership.

Conclusion

Understanding and managing file permissions and ownership is essential for maintaining security in Linux systems. By mastering commands like chmod, chown, and chgrp, you can effectively control who can access, modify, and execute your files and directories.

This guide has covered how to view permissions, change permissions using both numeric and symbolic notation, modify file ownership, and apply these changes recursively. With these skills, you can help safeguard your Linux system against unauthorized access and potential security threats.

Frequently Asked Questions

---

If you like the content, we would appreciate your support by buying us a coffee. Thank you so much for your visit and support.