File Permissions and chmod

Linux was built as a multi-user system from day one, and its permission model is the reason a web server can share a machine with dozens of users without chaos. Understanding permissions explains mysterious "Permission denied" errors and is essential for securing servers. This lesson decodes the rwx notation and teaches you to change permissions with chmod.

Reading a Permission String

Run ls -l and look at the first column:

bash

ls -l script.sh
# -rwxr-xr-- 1 sam developers 512 Jul 20 11:02 script.sh

Break -rwxr-xr-- into four parts:

- – file type (- file, d directory, l symlink)
rwx – permissions for the owner (user sam)
r-x – permissions for the group (developers)
r-- – permissions for others (everyone else)

Each triplet holds three flags: r (read), w (write), x (execute). A dash means the permission is absent. So here the owner can read, write and execute; group members can read and execute; everyone else can only read.

What r, w, x Mean for Files vs Directories

| Permission | On a file | On a directory | |---|---|---| | r | read contents | list filenames inside | | w | modify contents | create, delete, rename entries | | x | run as a program | enter it with cd and access files inside |

The directory column surprises people: to open /home/sam/notes.txt you need x on /, /home and /home/sam, plus r on the file itself. A directory with r but no x lets you see names but touch nothing.

Changing Permissions: Symbolic Mode

chmod (change mode) accepts human-readable instructions: u (user/owner), g (group), o (others), a (all), combined with +, - or =:

bash

chmod u+x deploy.sh      # let the owner execute it
chmod g-w shared.txt     # remove group write
chmod o= secret.txt      # strip all permissions from others
chmod a+r changelog.md   # everyone may read
chmod u+x,g+x run.sh     # combine changes with commas

chmod u+x script.sh is the command you will run constantly: it is how you make a script runnable with ./script.sh.

Changing Permissions: Numeric (Octal) Mode

Each triplet can be written as a number: r=4, w=2, x=1, added together.

bash

chmod 755 script.sh   # rwxr-xr-x  (owner all; group/others read+execute)
chmod 644 page.html   # rw-r--r--  (owner read/write; everyone else read)
chmod 700 private/    # rwx------  (owner only)
chmod 600 id_rsa      # rw-------  (required for SSH private keys)

Memorize the big four: 755 for scripts and directories, 644 for regular files, 700 and 600 for private things. If SSH ever refuses your key with "permissions are too open", chmod 600 is the fix.

Ownership: chown and chgrp

Permissions are relative to who owns the file. Changing ownership requires root:

bash

sudo chown www-data:www-data /var/www/html/index.html
sudo chown -R sam:developers /srv/project   # -R applies recursively

A typical web-server bug: files uploaded as your user cannot be read by the www-data process—fixed by correcting owner or group, not by the lazy (and dangerous) chmod 777.

Why chmod 777 Is Almost Always Wrong

777 means anyone on the machine can modify or replace the file, including a compromised service account. It "fixes" permission errors by removing all protection. Diagnose instead: who needs access, and is it read, write or execute? Grant exactly that.

Practice Session

bash

touch demo.sh
ls -l demo.sh
chmod u+x demo.sh
ls -l demo.sh
chmod 644 demo.sh
ls -l demo.sh

Watch the permission string change after each command until reading it feels natural.

Key Takeaways

Permission strings show three triplets: owner, group, others; each with r, w, x.
On directories, x means "enter", w means "create or delete entries".
chmod u+x makes scripts runnable; octal 755/644/700/600 cover most needs.
chown changes ownership (root required); avoid chmod 777—fix the real cause.

Next lesson: Users, Groups and sudo — see who those owners and groups actually are.