What are Linux file permissions, and how do you read and modify them using chmod?

Question

Accepted Answer

Linux file permissions control who can read, write, or execute a file or directory. Every file has three permission sets: one for the owner, one for the group, and one for everyone else. Understanding permissions is fundamental to keeping systems secure and operational.

Each permission set has three bits: read (r), write (w), and execute (x). When you run ls -l, you see something like -rwxr-xr-- which breaks down as: the first character indicates the file type (dash for regular file, d for directory), then three groups of three characters representing owner, group, and others permissions.

In numeric notation, read equals 4, write equals 2, and execute equals 1. You add these values together for each permission set. So rwxr-xr-- translates to 754: the owner gets 7 (4+2+1), the group gets 5 (4+0+1), and others get 4 (4+0+0).

To modify permissions, you use the chmod command. There are two approaches. The symbolic method uses letters: chmod u+x file.sh adds execute permission for the owner, chmod g-w file.txt removes write permission for the group, and chmod o=r file.txt sets others to read-only. The numeric method sets all permissions at once: chmod 755 script.sh gives the owner full access, and the group and others can read and execute but not write.

For directories, permissions work slightly differently. Read permission lets you list the directory contents, write permission lets you create or delete files within it, and execute permission lets you enter the directory with cd. A common gotcha is that you need execute permission on a directory to access any files inside it, even if those files have broader permissions.

The chown command changes file ownership, and chgrp changes the group. For example, chown www-data:www-data /var/www/html changes both the owner and group to www-data, which is common for web server files.

Special permissions like setuid, setgid, and the sticky bit add extra security controls. The sticky bit on /tmp prevents users from deleting each other's files. As an SRE, you should regularly audit permissions to prevent unauthorized access while ensuring services can read the files they need.