Master Linux File & Directory Permissions: Commands, Examples, and Best Practices

Basic Permission Concepts

Viewing Permissions

# Example: use ls to view permissions
ls -l filename

Interpreting Permission Strings

# Example: -rwxr-xr--

Meaning of File and Directory Permissions

File Permissions

r

(read): allows viewing file contents. w (write): allows modifying file contents. x (execute): allows running the file as a program.

# Set file permissions: owner read/write, group read, others none
chmod 644 filename

Directory Permissions

r

(read): allows listing directory contents. w (write): allows creating, deleting, renaming files. x (execute): allows entering the directory.

# Set directory permissions: owner rwx, group rx, others none
chmod 750 directory

Modifying Permissions

Numeric Representation

# Set file permissions to -rwxr-xr--
chmod 754 filename

Symbolic Representation

# Same effect using symbolic mode
chmod u=rwx,g=rx,o=r filename

User and Group Management

Changing File Owner

# Change owner to newuser
chown newuser filename

Changing File Group

# Change group to newgroup
chown :newgroup filename

Special Permissions and ACL

SUID

# Set SUID so file runs with owner's privileges
chmod u+s executable_file

SGID

# Set SGID so new files inherit directory's group
chmod g+s directory

ACL

# Grant specific user read/write via ACL
setfacl -m u:specialuser:rw filename

Inheritance and Default Permissions

Directory Inheritance

# Enable sticky bit for directory
chmod +t directory

Default Permissions (umask)

# Set default mask to 027
umask 027

Finding and Fixing Permission Issues

Locate Files with Specific Permissions

# Find files with others write permission
find /path -type f -perm -o+w

Repair Permissions

# Reset all files to 644
find /path -type f -exec chmod 644 {} \;

Practical Use Cases

Protect Sensitive Files

# Owner-only access
chmod 600 sensitive_file

Shared Directory

# Group read/write
chmod 770 shared_directory

Web Server Directory

# Owner rwx, group rx
chmod 750 web_directory

Configuration Files

# Owner read/write, group read
chmod 644 config_file

Database Files

# Owner and group read/write
chmod 660 database_file

System Scripts

# Owner rwx, group rx
chmod 750 system_script

Regular Review and Updates

Audit Permissions

# Find world-writable files
find /path -type f -perm -o+rwx -ls

Bulk Update

# Set all files to 644
find /path -type f -exec chmod 644 {} \;

Tracking Changes with auditd

Monitor Permission Changes

# Watch a file for attribute changes
auditctl -w /path/to/file -p wa

Review Audit Logs

# Search audit logs for a file
ausearch -f /path/to/file

Conclusion

Applying these commands and strategies enables administrators to fine‑tune Linux file and directory permissions, protect sensitive data, and maintain system security through regular audits and updates.