Understanding file permissions

Linux was built from day one to be used by many people at once, so every file carries permissions: who is allowed to read it, change it, or run it. Getting this right is the difference between a secure server and one that anyone can tamper with.

Reading the ten characters

In ls -l, the first column looks like -rw-r--r--. The first character is the type (- file, d folder). The next nine are three groups of three: the owner, the group, and everyone else. In each group, r = read, w = write, x = execute, and a dash means “not allowed”.

$ ls -l app.py
-rwxr-xr-x 1 root root 128 Nov 2 12:01 app.py
  │└┬┘└┬┘└┬┘
  │ │  │  └ others: read + execute
  │ │  └──── group: read + execute
  │ └─────── owner: read + write + execute
  └───────── type: regular file

Changing permissions: chmod

chmod changes permissions. The friendly form adds (+) or removes (-) a permission for the owner (u), group (g), others (o) or all (a). For example, make a script runnable:

chmod +x app.py      # anyone can now run it
chmod go-w notes.txt # group & others cannot write
chmod u+rw,go-rwx key # owner read/write, nobody else anything

The number shortcut

You'll often see chmod 755 or chmod 644. Each digit is one group (owner, group, others), where read=4, write=2, execute=1 are added up. So 7 = rwx, 6 = rw-, 5 = r-x, 4 = r--. 755 means the owner can do everything and others can read and run — the standard for a program.