Linux file permissions explained: chmod, chown and umask

Every file and directory on Linux has an owner, a group and a set of permissions that decide who can do what with it. Understanding this is the base of server security.

Reading ls -l

-rwxr-xr-- 1 deploy www-data 4096 Oct 26 10:00 app.sh

• First character: type (- file, d directory, l link).
• Next nine characters, in three groups of three: owner, group, others.
• Then the owner (deploy) and the group (www-data).

Each group has three possible letters:

• r read, w write, x execute (run a file, or enter a directory).
• - means that permission is missing.

So rwxr-xr-- means: owner can read, write and run; group can read and run; others can only read.

What the permissions mean for directories

• r: list the names inside.
• w: create, rename or delete files inside.
• x: enter the directory and access items by name.

A directory without x cannot be used even if you can read it.

Changing permissions with chmod

Symbolic form: who (u user/owner, g group, o others, a all), an operator (+, -, =), and the permissions.

chmod u+x script.sh      # add execute for the owner
chmod g-w file.txt       # remove write from the group
chmod o= secret.txt      # remove all access for others

Octal form: each permission has a number: read = 4, write = 2, execute = 1. Add them for each group.

Number	Meaning
7	rwx
6	rw-
5	r-x
4	r--
0	---

chmod 640 config.env     # owner rw, group r, others nothing
chmod 755 script.sh      # owner rwx, group and others r-x
chmod 700 ~/.ssh         # only the owner

Use -R to change a folder and everything in it, carefully.

Changing owner and group with chown

chown deploy file.txt
chown deploy:www-data file.txt
chown -R deploy:deploy /srv/app

Usually you need sudo for this.

umask: the default for new files

umask removes permissions from the defaults (666 for files, 777 for directories). A common value is 022, giving files 644 and directories 755. A stricter 027 or 077 is safer for private data.

Safe defaults for common things

Item	Typical permission
Web content (public)	files 644, directories 755
App config with secrets	600 or 640, owned by the service user
~/.ssh directory	700
Private SSH key	600 (SSH refuses keys that others can read)
Scripts you run	755 or 750

Avoid chmod 777

777 lets anyone on the system read, write and run the file. It is the usual "quick fix" for a permission error, and it is a security hole. Find the real cause instead: the wrong owner, the wrong group, or a missing x on a directory.

Special bits (good to know)

• setuid / setgid (s): run a program with the owner's or group's rights. Powerful and risky; audit them.
• sticky bit (t) on a shared directory such as /tmp: users can delete only their own files.

Takeaway: read permissions as owner, group and others, use the least access that works (600, 640, 644, 750, 755), set the right owner instead of reaching for 777, and keep secrets readable only by the service that needs them.

---

Linux & DevOps series, Part 1 (servers and containers): 1 of 5.