Chapter 17
File Ownership & Permissions
Linux System Administration — Complete Reference Guide
17.1 Introduction
File ownership is critical for file security. Every file has a user owner and a group owner. This chapter covers how to specify the user and group ownership of a file, the concept of
file and directory permissions, how to change permissions on files and directories, and default permissions given to files and directories when they are initially created.
17.2 File Ownership
By default, users own the files that they create. While ownership can be changed, this requires administrative privileges. Although most commands show the user owner as a
name, the operating system associates ownership with the UID for that username.
Every file also has a group owner. By default, the primary group of the user who creates the file becomes its group owner. Users can change group ownership of their own files to
any group they belong to. The OS stores group association by GID, not by name.
If a user's UID is changed or the user is deleted, files previously owned by that user will display the raw UID number instead of a username, since no matching entry exists in
/etc/passwd.
Use the id command to verify your current user and group memberships:
sysadmin@localhost:~$ id
uid=1001(sysadmin) gid=1001(sysadmin) groups=1001(sysadmin),4(adm),27(sudo),1005(research),1006(development)
Consider This
This user has UID 1001 and belongs to a User Private Group (UPG) — the account and primary group share the same numeric ID. Supplemental groups: adm (4), sudo (27), research
(1005), development (1006).
When a new file is created it is owned by the current user and their current primary group:
sysadmin@localhost:~$ touch /tmp/filetest1
sysadmin@localhost:~$ ls -l /tmp/filetest1
-rw-rw-r--. 1 sysadmin sysadmin 0 Oct 21 10:18 /tmp/filetest1
17.3 Changing Groups
If the file you are about to create should belong to a group other than your current primary group, use newgrp to switch your active primary group:
newgrp group_name
The groups command lists every group you belong to — useful for seeing what you can switch to:
sysadmin@localhost:~$ groups
sysadmin adm sudo research development
Example — switching to the research group and creating a file:
sysadmin@localhost:~$ newgrp research
sysadmin@localhost:~$ id
uid=1001(sysadmin) gid=1005(research) groups=1005(research),4(adm),27(sudo),1001(sysadmin),1006(development)
sysadmin@localhost:~$ touch /tmp/filetest2
sysadmin@localhost:~$ ls -l /tmp/filetest2
-rw-r--r--. 1 sysadmin research 0 Oct 21 10:53 /tmp/filetest2
The newgrp command opens a new shell. The group change persists until you type exit. To restore the original primary group, simply exit the shell. To permanently change a
user's primary group, root must run:
usermod -g groupname username
17.4 Changing Group Ownership
The chgrp command changes the group owner of an existing file. As root it can target any group; as a regular user, only groups the user already belongs to are permitted.
chgrp group_name file
sysadmin@localhost:~$ chgrp research sample
sysadmin@localhost:~$ ls -l sample
-rw-rw-r--. 1 sysadmin research 0 Oct 23 22:12 sample
To recursively change group ownership across an entire directory tree, use the -R flag:
sysadmin@localhost:~$ chgrp -R development test_dir
Consider This
The stat command provides richer detail than ls -l, displaying ownership by both name and GID number:
stat /tmp/filetest1 → Access: (0664/-rw-rw-r--) Uid: (1001/sysadmin) Gid: (1001/sysadmin)
17.5 Changing User Ownership
The chown command allows root to change the user ownership of files and directories. It also supports changing group ownership. There are three usage forms:
# Syntax Effect
1 chown user /path/to/file Change user owner only — requires root
2 chown user:group /path/to/file Change both user and group owner — requires root
3 chown :group /path/to/file Change group owner only — owner or root
# Form 1 — change user owner
root@localhost:~# chown jane /tmp/filetest1
-rw-rw-r-- 1 jane sysadmin 0 Dec 19 18:44 /tmp/filetest1
# Form 2 — change user and group owner
root@localhost:~# chown jane:users /tmp/filetest2
-rw-r--r-- 1 jane users 0 Dec 19 18:53 /tmp/filetest2
# Form 3 — change group owner only (used by non-root owner)
jane@localhost:~$ chown .users /tmp/filetest1
-rw-rw-r-- 1 jane users 0 Dec 19 18:44 /tmp/filetest1
17.6 Permissions
The output of ls -l begins each line with ten characters indicating the file type and permissions:
-rw-r--r--. 1 root root 4135 May 27 21:08 /etc/passwd
File Type — first character:
Char File Type
– Regular file (empty, text, or binary data)
d Directory — contains names of other files and links
l Symbolic link — a filename that points to another file
b Block device — data read in blocks (e.g. hard drive)
c Character device — data read one byte at a time
p Pipe file — connects output of one process to input of another
s Socket file — allows two-way communication between processes
Permission Groups — characters 2 through 10:
The nine permission characters are split into three groups of three. Only the first matching category applies to any given user:
Group Characters Who It Applies To
User Owner 2–4 The user who owns the file. Checked first; if you are the owner, only these permissions matter.
Group Owner 5–7 Members of the file's group. Checked if you are not the owner.
Others 8 – 10 Everyone else — not the owner, not in the group.
Permission Types — each group has r, w, and x:
Char Type On a File On a Directory
r Read View and copy file contents List file names (ls)
w Write Save changes to file (also needs r) Add or remove files (also needs x)
x Execute Run the file as a program Enter directory (cd) and use in pathnames
– None Permission not granted Permission not granted
17.7 Understanding Permissions — Worked Scenarios
Scenario #1 — Directory Access
Question: What access would user bob have on the file [Link]?
drwxr-xr-x. 17 root root 4096 23:38 /
drwxr-xr--. 10 root root 128 03:38 /data
-rwxr-xr--. 1 bob bob 100 21:08 /data/[Link]
Answer: None.
To reach [Link], bob must first enter /data. His permissions on /data are 'others' = r-- — read but no execute. Without x on the directory, bob cannot cd into it, so the file's own
generous permissions are irrelevant.
■ Lesson Learned
The permissions of ALL parent directories must be checked before the permissions on the file itself.
Scenario #2 — Viewing Directory Contents
Question: Who can run ls /data to list the contents of /data?
drwxr-xr-x. 17 root root 4096 23:38 /
drwxr-xr--. 10 root root 128 03:38 /data
-rwxr-xr--. 1 bob bob 100 21:08 /data/[Link]
Answer: All users.
Listing a directory only requires r on that directory. All users have x on / (can pass through) and r on /data (can list names). However, ls -l also requires x on /data — which only root
and the root group have — so detailed listing is restricted.
■ Lesson Learned
The r permission allows a user to list directory contents, but ls -l also requires x on the directory.
Scenario #3 — Deleting Directory Contents
Question: Who can delete the file /data/[Link]?
drwxr-xr-x. 17 root root 4096 23:38 /
drwxrw-rw-. 10 root root 128 03:38 /data
-rwxr-xr--. 1 bob bob 100 21:08 /data/[Link]
Answer: Only the root user.
Deleting a file requires w on its containing directory AND x to enter that directory. While all users have w on /data, only root has x — so only root can enter /data to perform
deletions. Permissions on the file itself are not checked for deletion.
■ Lesson Learned
w permission on a directory allows deletion of files, but only if the user also has x on the same directory.
Scenario #4 — Accessing File Contents
Question: True or False: Can user bob successfully run: more /data/[Link]?
drwxr-xr-x. 17 root root 4096 23:38 /
dr-xr-x--x. 10 root root 128 03:38 /data
-rwxr-xr--. 1 bob bob 100 21:08 /data/[Link]
Answer: True.
The more command checks: x on /, x on /data, then r on [Link]. Bob's 'others' permission on /data is --x — enough to enter the directory even without r. He also has r on [Link], so
the command succeeds.
■ Lesson Learned
x is required to enter a directory; r on the directory is NOT required unless you want to list its contents.
Scenario #5 — The Complexity of Users and Groups
Question: True or False: Can user bob successfully run: more /data/[Link]? (Note: /data has different owners than previous examples.)
drwxr-xr-x. 17 root root 4096 23:38 /
dr-xr-x---. 10 sue payroll 128 03:38 /data
-rwxr-xr--. 1 bob bob 100 21:08 /data/[Link]
Answer: Not enough information to determine.
Bob needs x on /data. Whether he has it depends on his group membership. If bob is in the payroll group → his permissions on /data are r-x → command succeeds. If bob is NOT
in payroll → his permissions on /data are --- → command fails.
■ Lesson Learned
You must examine each file and directory separately and know which groups the user belongs to.
Scenario #6 — Permission Priority
Question: True or False: Can user bob successfully run: more /data/[Link]? (Note: /data is owned by bob.)
drwxr-xr-x. 17 root root 4096 23:38 /
dr-xr-x---. 10 bob bob 128 03:38 /data
----rw-rwx. 1 bob bob 100 21:08 /data/[Link]
Answer: False.
Because bob is the owner of [Link], only the user owner permissions (---) are checked for him. Even though the group and others have rw- and rwx respectively, those are not
consulted. Bob has zero permissions on his own file.
■ Lesson Learned
Never grant more access to group/others than to the file owner — the owner's permissions are applied first and exclusively.
17.8 Changing Permissions
The chmod (change mode) command changes permissions on files and directories. You must own the file or be root to change its permissions. Basic syntax:
chmod new_permission file_name
17.8.1 — Symbolic Method
The symbolic method modifies only the permissions you specify; all others remain unchanged. The permission argument is built from three parts:
Part Options Meaning
Who ugoa user owner / group owner / others / all
Operator +–= add / remove / set exactly (removes unspecified)
Type rwx read / write / execute
# Add write permission for group
chmod g+w [Link]
-rw-rw-r-- 1 root root 0 Dec 19 18:58 [Link]
# Add execute for user+group; remove read for others
chmod ug+x,o-r [Link]
-rwxrwx--- 1 root root 0 Dec 19 18:58 [Link]
# Set user owner to read+execute exactly (removes write)
chmod u=rx [Link]
-r-xrwx--- 1 root root 0 Dec 19 18:58 [Link]
17.8.2 — Numeric (Octal) Method
The numeric method assigns octal values to each permission type. All nine permissions must be specified at once — making it ideal when changing many permissions
simultaneously.
Value Binary Permissions Value Binary Permissions
4 100 r-- (read) 7 111 rwx (all)
2 010 -w- (write) 6 110 rw- (read+write)
1 001 --x (execute) 5 101 r-x (read+execute)
0 000 --- (none) 3 011 -wx (write+execute)
# Set permissions: user=rwx(7) group=r-x(5) others=r--(4)
chmod 754 [Link]
-rwxr-xr-- 1 root root 0 Dec 19 18:58 [Link]
# Common permission combinations:
# 755 rwxr-xr-x — typical executable / public directory
# 644 rw-r--r-- — typical text file
# 600 rw------- — private file (owner only)
# 700 rwx------ — private directory (owner only)
Consider This
The stat command shows permissions in both symbolic and numeric formats simultaneously, which is helpful for learning and verification: stat /tmp/filetest1 → Access:
(0664/-rw-rw-r--) Uid: (1001/sysadmin) Gid: (1001/sysadmin)
17.9 Default Permissions (umask)
The umask command determines the default permissions applied when new files or directories are created. Default permissions are calculated by subtracting the umask value
from the maximum allowable default:
Type Maximum Default Reason
Files rw-rw-rw- (666) Execute cannot be set at creation — must be added afterwards
Directories rwxrwxrwx (777) Execute is needed to enter directories, so it is included
sysadmin@localhost:~$ umask
0002
# ■■ digit 1: octal notation flag
# ■■ digit 2: subtract from user owner permissions
# ■■ digit 3: subtract from group owner permissions
# ■■ digit 4: subtract from others permissions
Example — umask 027 applied to files and directories:
File default: 666 (rw-rw-rw-)
Umask: - 027
Result: 640 (rw-r-----)
Directory default: 777 (rwxrwxrwx)
Umask: - 027
Result: 750 (rwxr-x---)
sysadmin@localhost:~$ umask 027
sysadmin@localhost:~$ touch sample
sysadmin@localhost:~$ ls -l sample
-rw-r-----. 1 sysadmin sysadmin 0 Oct 28 20:14 sample
sysadmin@localhost:~$ mkdir test-dir
sysadmin@localhost:~$ ls -ld test-dir
drwxr-x---. 1 sysadmin sysadmin 4096 Oct 28 20:25 test-dir
Consider This
The umask set with the umask command only applies to the current shell session. To permanently change a user's default umask, edit the .bashrc file in their home directory. Note
that root typically uses umask 0022 (more restrictive) while regular users often default to 0002.
Chapter 17 — File Ownership & Permissions | Linux System Administration