Master Linux File Permissions: chmod, chown, and chgrp Explained

Linux is a multi-user system where different users have different permissions. To protect system security, Linux defines distinct access rights for users accessing the same file or directory.

Two primary commands modify file ownership and permissions: chown (change owner): modifies the owning user and group. chmod (change mode): modifies user permissions.

Use ll or ls -l to display file attributes, ownership, and permissions. Example output:

[root@www /]# ls -l
total 64
drwxr-xr-x 2 root root 4096 Dec 14 2012 bin
drwxr-xr-x 4 root root 4096 Apr 19 2012 boot
…

The first character indicates file type: d = directory - = regular file l = symbolic link b = block device (random access) c = character device (serial, e.g., keyboard, mouse)

The next nine characters represent permissions in three groups of rwx (read, write, execute). A hyphen - means the permission is absent. Positions 1‑3: owner; 4‑6: group; 7‑9: others. Position 0 is the file type.

File Owner and Group

Every file has an owner (user) and a group. Users belong to one or more groups. Permissions are defined for owner, group members, and others. Example: a directory mysql owned by user mysql and group mysql with permissions drwxr-xr-x gives owner full access, group and others read and execute.

The root user generally bypasses permission checks.

Changing File Attributes

1. chgrp: Change Group Ownership

Syntax:

chgrp [-R] groupname filename

-R

: recursively change group for directory and all contents.

2. chown: Change Owner (and Group)

Syntax:

chown [-R] ownername filename
chown [-R] ownername:groupname filename

Example: change owner of install.log to bin:

[root@www ~]# chown bin install.log
[root@www ~]# ls -l
-rw-r--r-- 1 bin users 68495 Jun 25 08:53 install.log

Change both owner and group back to root:

[root@www ~]# chown root:root install.log
[root@www ~]# ls -l
-rw-r--r-- 1 root root 68495 Jun 25 08:53 install.log

3. chmod: Change the Nine Permission Bits

Two methods: numeric and symbolic.

Numeric Mode

Each permission has a value: r=4, w=2, x=1. Sum per identity (owner/group/others). Example -rwxrwx---:

owner = rwx = 4+2+1 = 7

group = rwx = 7

others = --- = 0

Resulting mode: 770.

Syntax: chmod [-R] xyz file_or_directory where xyz are three octal digits.

Example: give all permissions to .bashrc:

[root@www ~]# ls -al .bashrc
-rw-r--r-- 1 root root 395 Jul 4 11:45 .bashrc
[root@www ~]# chmod 777 .bashrc
[root@www ~]# ls -al .bashrc
-rwxrwxrwx 1 root root 395 Jul 4 11:45 .bashrc

For -rwxr-xr-- the numeric mode is 754 (owner 7, group 5, others 4).

Symbolic Mode

Identities: u (user/owner), g (group), o (others), a (all). Operators: + (add), - (remove), = (set exactly). Permissions: r, w, x.

Table: chmod u/g/o/a +/-/= r/w/x file_or_directory Set -rwxr-xr-- via symbolic mode:

# touch test1
# ls -al test1
-rw-r--r-- 1 root root 0 Nov 15 10:32 test1
# chmod u=rwx,g=rx,o=r test1
# ls -al test1
-rwxr-xr-- 1 root root 0 Nov 15 10:32 test1

Remove execute permission for all without affecting other bits:

# chmod a-x test1
# ls -al test1
-rw-r--r-- 1 root root 0 Nov 15 10:32 test1