ls -lchmodchownchgrpumasksetfaclgetfacl| Class | Applies To |
|---|---|
| Owner (u) | The user who owns the file |
| Group (g) | Members of the file's group |
| Other (o) | Everyone else on the system |
| Permission | On a File | On a Directory |
|---|---|---|
Read r | View file contents | List directory contents |
Write w | Modify file contents | Create, rename, or delete entries inside |
Execute x | Run the file as a program/script | Enter (cd into) the directory |
x is what lets you enter it and reach the files inside. r alone only lists the names.$ ls -l notes.txt
-rw-r--r--. 1 sarah developers 482 Aug 5 09:14 notes.txt
| Field | Meaning |
|---|---|
- | File type (- file, d directory, l symlink) |
rw- | Owner's permissions: read + write, no execute |
r-- | Group's permissions: read only |
r-- | Other's permissions: read only |
sarah | Owning user |
developers | Owning group |
. after the permission string means the file has an SELinux context. That's normal on RHEL.Combine a class (u, g, o, a), an operator (+, -, =), and permissions.
# Add execute permission for the owner chmod u+x script.sh # Remove write permission for group and other chmod go-w notes.txt # Set exact permissions for all three classes chmod u=rw,g=r,o= notes.txt # Add read permission for everyone chmod a+r notes.txt
| Value | Permissions |
|---|---|
| 7 | rwx (4+2+1) |
| 6 | rw- (4+2) |
| 5 | r-x (4+1) |
| 4 | r-- (4) |
| 0 | --- (none) |
# Owner: rwx, Group: r-x, Other: r-x # common for scripts/directories chmod 755 deploy.sh # Owner: rw-, Group: r--, Other: --- # common for private config files chmod 640 secrets.conf # Apply recursively chmod -R 755 /var/www/html
find with -type f or -type d to be precise.# Change the owning user chown sarah notes.txt # Change the owning group only chgrp developers notes.txt # Change both user and group at once chown sarah:developers notes.txt # Change ownership recursively chown -R sarah:developers /home/sarah/project
The umask removes permissions from a maximum of 666 for files and 777 for directories.
# Show the current umask umask # Common default: 022 # New file: 666 - 022 = 644 (rw-r--r--) # New dir: 777 - 022 = 755 (rwxr-xr-x) # Set a stricter umask for the current shell session umask 027
027, new files get 640, not 639.chmod.| Bit | Symbol | On a File | On a Directory |
|---|---|---|---|
| SUID (4000) | s in owner's execute slot | Runs with the file owner's privileges, not the invoking user's | No effect |
| SGID (2000) | s in group's execute slot | Runs with the file's group privileges | New files inside inherit the directory's group |
| Sticky bit (1000) | t in other's execute slot | No standard effect | Only the file's owner (or root) can delete files inside, even with directory write access |
# Set SUID (e.g. why /usr/bin/passwd works for regular users) chmod u+s /usr/bin/passwd # Set SGID on a shared project directory so new files inherit its group chmod g+s /srv/shared-project # Set the sticky bit — this is exactly how /tmp is configured chmod +t /tmp # Numeric form: leading 4th digit chmod 4755 /usr/bin/passwd chmod 2775 /srv/shared-project chmod 1777 /tmp
ACLs grant access to additional users or groups beyond the single owner and group, without changing group membership.
# Grant an additional user read+write access to a file setfacl -m u:miguel:rw notes.txt # Grant an additional group read access setfacl -m g:auditors:r notes.txt # View the ACL entries on a file getfacl notes.txt # Remove a specific ACL entry setfacl -x u:miguel notes.txt # Remove all ACL entries setfacl -b notes.txt
ls -l shows a + after the permission string when a file has ACL entries.chmod command for owner read/write, group read-only, and no access for others.chmod and chown?022, what permissions does a new file get?