Understanding Linux file permissions
Linux organizes file security using permission bits divided across three distinct user classes:
the file owner (u), the assigned group (g), and all other users on the
system (o).
Every class has three primary access rights: read (r), write (w), and
execute (x). Permissions can be expressed in numeric octal notation or symbolic
strings.
Octal notation explained
Octal notation calculates permissions by summing the binary values of active bits:
- Read (r) = 4: Allows inspecting file contents or listing directory entries.
- Write (w) = 2: Allows modifying or removing files, and altering directory contents.
- Execute (x) = 1: Allows running executable programs or entering and traversing directories.
Combining values yields numbers from 0 to 7 per class. For instance, 755 translates
to owner read-write-execute (4+2+1=7), group read-execute (4+0+1=5),
and others read-execute (4+0+1=5).
Special permission bits
Linux supports three advanced permission bits placed before standard octal triplets:
-
Setuid (4000): Executes a binary with the permissions of the file owner
rather than the executing user, required for tools like
passwd. - Setgid (2000): Runs executables under the file group or forces files created within a directory to inherit that directory's group ownership.
-
Sticky bit (1000): Prevents regular users from deleting or renaming files
they do not own within shared directories like
/tmp.
Worked examples
- Web server content (644): Owner edits pages while web servers and visitors read files safely without execution rights.
- Private SSH keys (600): Restricts reading and writing exclusively to the owning user; OpenSSH aborts if other users have access.
- Shared team folder (2775): Read-write-execute for owner and group, with setgid ensuring collaborators maintain shared access to new files.
Common mistakes
- Applying 777 to fix permission errors: Granting full write access to all users exposes secrets and allows arbitrary deletion.
- Stripping execute from directories: Removing execute on a folder blocks users from entering it or accessing nested files.
-
Forgetting recursive precautions: Running
chmod -R 755sets the execute bit on every file, making non-executable documents runnable.
Frequently asked questions
What is the difference between octal and symbolic permissions?
Octal uses base-8 digits where read=4, write=2, and execute=1 (for example, 755). Symbolic uses letter notation like rwxr-xr-x. Both represent identical permission bits in the Linux file system.
What do the setuid, setgid, and sticky bits do?
Setuid (4000) executes binary files as the file owner. Setgid (2000) runs files with group privileges or makes new directory files inherit the parent group. Sticky bit (1000) restricts file deletion in shared directories like /tmp to file owners.
Why are 777 permissions dangerous?
Mode 777 grants full read, write, and execute rights to everyone on the machine. Any local user, daemon, or compromised service can alter or delete the file.
How does a umask affect file creation?
The umask specifies permission bits stripped from newly created items. Standard Linux files start at base 666 and directories start at 777; a 022 umask yields 644 files and 755 directories.
Why does execute permission matter on directories?
On directories, execute (x) permits path traversal and entering the folder. Read without execute allows listing directory entries but prevents accessing their file contents or metadata.