Permissions: Who’s Allowed to Touch It

In the filesystem post I flagged a second half to the story: knowing where files live is one thing, but knowing who’s allowed to touch them is most of Linux security in a single mechanism. Run ls -l and every file wears a little string up front — -rwxr-xr-- — that looks like line noise and is actually the whole access-control system in ten characters. Let’s decode it.

Reading the string

Those ten characters are one flag plus three permission sets in a row:

Part of `-rwxr-xr--`	Bits	Means
type	`-`	a regular file (`d` = directory, `l` = symlink)
owner	`rwx`	the owner may read, write and execute
group	`r-x`	the group may read and execute
others	`r--`	everyone else may only read

Read, write and execute (r/w/x), granted separately to three audiences: the file’s owner, its group, and everyone else. So -rwxr-xr-- reads as “owner can do anything, group can read and run it, everyone else can only read.” One wrinkle worth banking now: on a directory, x doesn’t mean “execute” — it means “may enter”, and r means “may list what’s inside”.

Changing it: chmod and chown

You set permissions with chmod and ownership with chown. chmod speaks two dialects — a readable one and a numeric one:

$ ls -l script.sh
-rw-r--r-- 1 mitch mitch 812 Jul 27 09:20 script.sh
$ chmod +x script.sh              # readable dialect: add execute
$ chmod 644 notes.txt             # numeric dialect (see below)
$ chown mitch:staff report.pdf    # set owner:group

Note: the magic numbers (644, 755…)

Those three-digit numbers are just the permissions added up: read = 4, write = 2, execute = 1. So rwx = 4+2+1 = 7, r-x = 5, r-- = 4. chmod 755 is therefore “owner does everything, everyone else may read and run” — the usual setting for programs and directories — while 644 (owner read/write, others read) is the norm for ordinary files. Learn those two and you’ve covered most of daily life.

The special bits: sticky, setuid, setgid

Beyond plain rwx there are three “special” bits you’ll bump into. Kept light, because you rarely set them by hand:

The sticky bit — and you’ve already relied on it. /tmp is world-writable so anyone can drop files there, but the sticky bit means you can only delete your own. It shows as a t on the very end (drwxrwxrwt), and you’d set it with chmod +t.
setuid / setgid — a program that runs with the permissions of its owner, not whoever launched it. It’s how an ordinary user can change their own password (passwd quietly edits a root-owned file) without being root. It shows as an s in the owner or group slot. Powerful — and a classic place attackers come looking — so you set these deliberately, if ever.

These special bits are why a full permission value is sometimes four octal digits rather than three (the leading digit carries them) — which is exactly the sort of fiddly sum worth handing to a machine (see the tip below).

Where the defaults come from: umask

Ever noticed new files arrive as 644 and new folders as 755 without you asking? That’s the umask — a mask that subtracts permissions from a base as things are created. The usual 022 umask strips the write bit from group and others, which is precisely how you land on those sensible defaults. You’ll rarely change it, but it’s worth knowing it exists: it’s the reason files aren’t world-writable out of the box, and tightening it (say to 077 for a locked-down account) is a quiet security win.

The golden rule: least privilege

Warning: 777 is not a magic fix

When a permission problem blocks you, the internet’s worst advice is chmod 777 — “let absolutely everyone do absolutely anything.” It usually makes the error vanish, and it hands every user (and every compromised process) full control of that file. The real fix is almost always the right owner (chown) or the single minimum bit that was missing — never 777.

That’s the whole philosophy in a sentence: grant the least that works, never the most. Every extra permission is a door you’ve chosen to leave open — so open as few as the job needs, and no more.

Tip: let the calculator do the maths

Working out a chmod number in your head — three or four octal digits, sticky bit and all — gets old fast. There’s a permissions calculator on the Tools page: tick the boxes for owner, group and other and it hands back the exact chmod number and the symbolic string. It runs entirely in your browser — nothing you type ever leaves the page.

The one-sentence version

Every file has an owner, a group and three sets of read/write/execute bits deciding who may do what; you read them with ls -l, change them with chmod and chown, and — the only rule that truly matters — you grant the least that works, never the most. All of it lives in the Linux Cheatsheet too.

Next in the series we finally stop poking at what’s already installed and add our own: package management — installing software the safe, sane way, and why you almost never grab an installer from a random website.