Managing File and Directory Permissions in Linux

Linux permissions control how users access, modify, and execute files or directories on a system. Efficient management of user permissions improves system security and access control by preventing unauthorized access to sensitive data, files, and directories. This guide explains how to read and interpret Linux permissions, then use the chmod and chown commands to change them. By the end, you'll be able to view, calculate, and modify file and directory permissions — including special permissions like the sticky bit, SUID, and SGID — on your Linux workstation.

Linux Permissions

Linux permissions are categorized into read, write, and execute (RWX), which define user or group privileges on a file or directory:

• Read (r): View the contents of a file or list the contents of a directory.
• Write (w): Modify, add, remove, or rename files in a directory.
• Execute (x): Run a file or access the files in a directory.

Permissions can be assigned to the following user classes:

• Owner: The user who owns the file or directory.
• Group: The group associated with the file or directory.
• Others: All other system users.

If a user owns a file and also belongs to its group, the owner's permissions override the group's permissions. If the owner has read permission (r) but no write or execute permissions, they cannot write or execute the file even if the group has full permissions (rwx). You can add users to a group with the usermod or gpasswd command to grant them specific group permissions.

String Representation of Linux Permissions

Files and directories use a 10-character format to represent permissions, visible by running a command such as ls -l:

• The first character represents the file type:
  • -: Regular file.
  • d: Directory.
  • l: Symbolic link.
  • b: Block device or special file, such as disks and partitions.
  • c: Character device or special file, such as terminals and serial ports.
  • p: Named pipe.
  • s: Socket.
  • D: Door.
• The next nine characters represent owner, group, and others permissions in order (three characters each).

For example:

drwxrw-r-- example.com

• d: Specifies that example.com is a directory.
• rwx: The owner has read, write, and execute permissions.
• rw-: The group has read and write permissions.
• r--: Other users have read-only permissions.

How to Calculate Linux Permissions

Linux permissions use binary values to represent access levels:

For example:

• Read + Write: 4 + 2 = 6 (binary: 110, symbol: rw-)
• Read + Execute: 4 + 1 = 5 (binary: 101, symbol: r-x)
• Write + Execute: 2 + 1 = 3 (binary: 011, symbol: -wx)
• Read + Write + Execute: 4 + 2 + 1 = 7 (binary: 111, symbol rwx)

Common Linux Permissions

644 — owner can read and write; group and others can only read:

755 — owner has full permissions; group and others have read and execute:

777 — owner, group, and others all have full permissions:

The root user can override all Linux user permissions on a file or directory. Using sudo while reading or executing a file enables root superuser privileges, overriding any existing permissions.

View File and Directory Permissions

1. Create a new sample file and directory:

$ touch file.txt && sudo mkdir /var/www/html

2. View the permissions on the file with ls -l:

$ ls -l file.txt

Your output should be similar to:

-rwxr-xr-x 1 user group 1024 Jan 1 12:00 file.txt

• -: Shows that file.txt is a regular file.
• rwx: The owner's permissions.
• r-x: The group permissions.
• r-x: Other users' permissions on the file.

3. View the directory permissions with ls -ld:

$ ls -ld /var/www/html

Your output should be similar to:

drwxr-xr-x 2 user group 4096 Jan 1 12:30 /var/www/html

• d: Shows that /var/www/html is a directory.
• rwx: The directory owner's permissions.
• r-x: The group permissions.
• r-x: Other users' permissions on the directory.

Change File and Directory Permissions

You can change permissions using the chmod command in two modes: numeric and symbolic.

$ chmod [permissions] [file or directory]

Change Permissions Using Numeric Mode

Assign permissions using three digits representing the owner, group, and others. Each digit is the sum of read (4), write (2), and execute (1):

• Read (r): 4
• Write (w): 2
• Execute (x): 1
• No permissions (-): 0

1. Change file.txt permissions to 755:

$ chmod 755 file.txt

This allows all users to read and execute the file, but only the owner to modify it.

2. Change the /var/www/html directory permissions to 755:

$ sudo chmod 755 /var/www/html

This allows all users to view the directory contents, but only the owner can add new files.

3. Recursively apply permissions to all files and subdirectories using the -R option:

$ sudo chmod -R 755 /var/www/html

This enables 755 permissions for all files and subdirectories in /var/www/html, allowing all users to navigate and read/execute files, but only the owner can modify contents.

Change Permissions Using Symbolic Mode

Symbolic mode uses letters for user classes:

• u: File or directory owner.
• g: The group associated with a file or directory.
• o: Other system users who are neither the owner nor part of the group.
• a: All users, including owner, group, and others.

And operators to assign, remove, or set permissions:

• +: Adds a permission.
• -: Removes a permission.
• =: Explicitly sets the permission and overwrites the active permissions.

$ chmod [userclass][operator][permissions] [filename or directory]

1. Grant the owner read, write, and execute permissions on file.txt:

$ chmod u+rwx file.txt

2. Remove execute permission from the group on the /var/www/html directory:

$ sudo chmod g-x /var/www/html

3. Enable read permissions for all users on file.txt:

$ chmod a+r file.txt

4. Change the file owner's permission to read-only, removing write and execute:

$ chmod u=r file.txt

5. Apply permissions recursively on the /var/www/html directory with -R:

$ sudo chmod -R a+rx /var/www/html

This adds read and execute permissions for all users on /var/www/html and its contents.

6. Modify multiple user categories in a single command:

$ chmod ug+rw file.txt

This adds read and write permissions to both the owner and group on file.txt.

7. Modify different permissions for multiple user classes in a single command:

$ chmod u+rwx,g+w,o+x file.txt

This enables read, write, and execute for the owner, write for the group, and execute for other users on file.txt.

Set Special Permissions (Sticky Bit, SUID, SGID)

Sticky bit, Set User ID (SUID), and Set Group ID (SGID) are special permissions that let administrators control file and directory access in multi-user environments.

Sticky Bit

Sticky bit applies only to directories and ensures that only the owner can rename, delete, or move files in a directory.

1. Use the +t option to enable sticky bit on the /var/www/html directory:

$ sudo chmod +t /var/www/html

2. Or use the 1 numeric prefix to enable sticky bit while setting permissions, e.g. 755 with sticky bit:

$ sudo chmod 1755 /var/www/html

• 1: Enables the sticky bit.
• 7: Grants read, write, and execute permissions to the owner.
• 5: Grants read and execute permissions to the group.
• 5: Grants read and execute permissions to other users.

3. List the directory permissions to verify the sticky bit change:

$ ls -ld /var/www/html

Your output should be similar to:

drwxr-xr-t 2 user group 4096 Jan 1 12:00 /var/www/html

Sticky bit is active based on the t in the above output.

Set User ID (SUID)

SUID enables the execution of a file with the privileges of its owner instead of the active user running it — useful for executable files that may require elevated privileges.

1. Create a sample hello.sh script:

$ touch hello.sh

2. Use u+s with chmod to enable the SUID bit on hello.sh:

$ chmod u+s hello.sh

This allows all users to execute hello.sh with the permissions of the file owner.

3. Or use numeric mode by adding 4 as the leading digit:

$ chmod 4755 hello.sh

• 4: Enables the SUID bit.
• 7: Grants read, write, and execute permissions to the owner.
• 5: Grants read and execute permissions to the group.
• 5: Grants read and execute permissions to other users.

4. View the hello.sh permissions to verify the SUID bit is active:

$ ls -l hello.sh

Your output should be similar to:

-rwsr-xr-x 1 root root 1024 Jan  15 20:43 hello.sh

The SUID bit is active based on the s value in the owner permissions (rws).

Set Group ID (SGID)

SGID applies to executable files and directories and enables file execution using the group's permissions instead of the user's.

1. Enable SGID on the hello.sh script:

$ sudo chmod g+s hello.sh

2. Enable SGID on the /var/www/html directory:

$ sudo chmod g+s /var/www/html

3. Use the 2 numeric mode to enable SGID while setting 755 permissions on hello.sh:

$ sudo chmod 2755 hello.sh

• 2: Enables the SGID bit.
• 7: Grants read, write, and execute permissions to the owner.
• 5: Grants read and execute permissions to the group.
• 5: Grants read and execute permissions to other users.

4. View the hello.sh permissions and verify SGID is active:

$ ls -l hello.sh

Your output should be similar to:

-rwxr-sr-x 1 user group 123456 Jan  1 12:00 hello.sh

SGID is active based on the s in the group permissions (-rwxr-sr-x).

5. List the /var/www/html permissions and verify SGID is active:

$ ls -ld /var/www/html

Your output should be similar to:

drwxr-sr-x 2 user group 4096 Jan 1 12:00 /var/www/html

SGID is active based on the s in the group's permissions (drwxr-sr-x).

Change User and Group Ownership Permissions

You can change ownership using the chown command:

$ chown [options] user:group [filename/directory]

1. Grant linuxuser ownership of file.txt:

$ sudo chown linuxuser file.txt

This sets linuxuser as the owner while keeping group ownership unchanged.

2. Grant the www-data group ownership of the /var/www/html directory:

$ sudo chown :www-data /var/www/html

This sets www-data as the group owner while file ownership permissions remain unchanged.

3. Change both owner and group by separating them with ::

$ sudo chown www-data:www-data /var/www/html

4. Recursively change owner and group for all files and subdirectories with -R:

$ sudo chown -R www-data:www-data /var/www/html

5. Use --reference to copy the ownership of one file to another:

$ sudo chown --reference=/var/www/html file.txt

6. View the owner and group permissions to verify the changes:

$ ls -l file.txt && ls -ld /var/www/html

Your output should be similar to:

-rwxr-xr-- 1 www-data www-data 1024 Jan 1 12:00 file.txt
drwxr-xr-x 2 www-data www-data 4096 Jan 1 12:30 /var/www/html

Next Steps

• Audit sensitive directories (like web roots and config folders) for overly permissive 777 settings
• Combine SGID with shared group directories to keep team-owned files consistently group-writable
• Script routine permission and ownership checks with find and chmod/chown for consistency across servers
• Run man chmod and man chown for the full set of options on your system

For the full guide with additional tips, visit the original article on Vultr Docs.