Linux File and Directory Permissions Explained (chmod, chown, umask)

Linux is a multi-user system, so every file and directory carries permissions that decide who can read, change or run it. Understanding Linux file permissions is essential for administrators, developers and anyone securing a server. This guide explains how permissions work, how to read them and how to change them safely.

Owners and classes

Each file has:

• an owner (user);
• a group;
• permissions for three classes: user (u), group (g) and others (o).

The three permissions

The directory meanings surprise many people. For example, a user can delete a file they cannot write to if they have write permission on the directory containing it.

Reading permissions

$ ls -l report.sh
-rwxr-x--- 1 asha devops 512 Oct 20 10:15 report.sh

• The first character shows the type: - file, d directory, l link.
• rwx: the owner (asha) can read, write and execute.
• r-x: the group (devops) can read and execute.
• ---: others have no access.

Changing permissions with chmod

Symbolic mode

chmod u+x script.sh        # add execute for the owner
chmod g-w report.txt       # remove write for the group
chmod o= secret.txt        # remove all permissions for others
chmod u=rw,go=r notes.txt  # set exact permissions

Numeric (octal) mode

Each permission has a value: read = 4, write = 2, execute = 1. Add them for each class.

chmod 640 config.ini
chmod -R 750 /srv/project

Use -R carefully, because it changes everything beneath a directory.

Changing ownership with chown and chgrp

sudo chown asha report.txt
sudo chown asha:devops report.txt
sudo chgrp devops report.txt
sudo chown -R www-data:www-data /var/www/site

Default permissions: umask

The umask removes permissions from new files and directories. With the common umask 022, new files get 644 and new directories get 755. A stricter umask of 027 gives 640 and 750.

umask        # show the current value
umask 027    # set it for this session

Common mistakes

• Using 777. It lets anyone change or replace the file. Fix ownership or group membership instead.
• Wrong SSH permissions. SSH refuses keys if ~/.ssh or authorized_keys are too open.
• Web files owned by the web server. If the web server can write to its code, an attacker who compromises it can too.

Going further

For special permissions (SUID, SGID and the sticky bit) and access control lists, read Linux special permissions and ACLs. To manage who belongs to which group, see Linux user and group management.

Sources

• The Linux man-pages project

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.