RED HAT ENTERPRISE LINUX

Standard File
Permissions

List, set, and change standard ugo/rwx permissions

CIS126RH | RHEL System Administration 1
Mesa Community College

Every file and directory on a Linux system has a set of permissions that control who can read it, write to it, and execute it. The ugo/rwx permission model — user, group, and other combined with read, write, and execute — is the foundation of Linux access control. Understanding how to read, set, and change these permissions is tested directly on the RHCSA exam and applied in nearly every other administration task.

Learning Objectives

1. Read and interpret permission strings — Identify file type, user, group, and other permissions from ls -l output
2. Understand what permissions mean for files and directories — Explain how read, write, and execute apply differently to files versus directories
3. Change permissions with chmod — Use both symbolic mode and octal mode to set permissions exactly
4. Change ownership with chown and chgrp — Reassign the user owner and group owner of files and directories

The Permission Model

Every file and directory has three sets of permissions — one for each of three categories of users.

Each category has three permissions:

Reading the ls -l Permission String

The first field in ls -l output is a 10-character permission string.

$ ls -l /etc/ssh/sshd_config
-rw-r--r-- 1 root root 3905 May 25 09:00 sshd_config
# ^   ^^^  ^^^  ^^^
# |   u    g    o     (user, group, other)
# file type

Common Permission Patterns

These patterns appear throughout a RHEL system. Being able to read them at a glance is an essential administration skill.

Permissions on Directories

Directory permissions behave differently from file permissions. This is the most commonly misunderstood area of Linux access control.

chmod: Symbolic Mode

chmod changes permissions. Symbolic mode uses letters to describe the change — readable and easy to apply incrementally.

Symbolic syntax: chmod WHO OPERATOR PERMISSION file

# Add execute permission for the owner
$ chmod u+x script.sh

# Remove write permission from group and other
$ chmod go-w config.txt

# Set group to read-only exactly — removes write and execute
$ chmod g=r config.txt

# Add read and execute for everyone
$ chmod a+rx shared-script.sh

# Multiple changes in one command — comma separated
$ chmod u+x,g-w,o=r file.txt

chmod: Octal Mode

Octal mode uses a three-digit number to set all nine permission bits at once. Each digit represents one category — user, group, other.

Add the values together for each category to get the digit for that category.

chmod Octal Examples

Three digits — user, group, other — each calculated by adding the permission values.

# 644: rw-r--r-- — standard config file
$ chmod 644 /etc/myapp.conf

# 755: rwxr-xr-x — standard executable or public directory
$ chmod 755 /usr/local/bin/myscript.sh

# 700: rwx------ — private directory, owner only
$ chmod 700 /home/student/.ssh

# 600: rw------- — private file, owner read/write only
$ chmod 600 /home/student/.ssh/id_ed25519

# 664: rw-rw-r-- — group-writable shared file
$ chmod 664 /srv/project/report.txt

# Recursive — apply to a directory and everything inside
$ chmod -R 755 /var/www/html

Symbolic vs Octal: When to Use Each

Changing Ownership with chown

chown changes the user owner and optionally the group owner of a file or directory. Only root can change ownership.

# Change the user owner only
$ sudo chown maria report.txt

# Change the group owner only — note the colon
$ sudo chown :developers project/

# Change user owner and group owner together
$ sudo chown maria:developers project/

# Recursive — apply to a directory tree
$ sudo chown -R apache:apache /var/www/html

# Verify the result
$ ls -l report.txt
-rw-r--r-- 1 maria developers 1024 May 25 09:00 report.txt

Changing Group with chgrp

chgrp changes only the group owner of a file or directory. A regular user can use chgrp to change the group to any group they are a member of.

# Change group owner of a file
$ chgrp developers project.txt

# Change group of a directory tree
$ chgrp -R developers /srv/project

# chown :group is equivalent — most admins prefer chown
$ sudo chown :developers project.txt

# Verify group membership before attempting chgrp
$ id
uid=1000(student) gid=1000(student) groups=1000(student),1001(developers)

The umask

The umask is a mask applied to the default permissions of newly created files and directories. It subtracts permissions from the maximum default.

• Default maximum for new files: 666 (rw-rw-rw-) — no execute by default
• Default maximum for new directories: 777 (rwxrwxrwx)
• The umask is subtracted from the maximum to give the actual permissions

# View the current umask
$ umask
0022

# umask 022 applied to new files:  666 - 022 = 644 (rw-r--r--)
# umask 022 applied to directories: 777 - 022 = 755 (rwxr-xr-x)

# Change the umask for the current session
$ umask 027
# New files: 666 - 027 = 640 (rw-r-----)
# New dirs:  777 - 027 = 750 (rwxr-x---)

# Confirm the effect
$ touch testfile
$ ls -l testfile
-rw-r----- 1 student student 0 May 25 testfile

How the Kernel Makes Access Decisions

When a process tries to access a file, the kernel checks permissions in order and stops at the first match.

1. Is the process running as root? Root bypasses permission checks — access is always granted (with exceptions for execute).
2. Is the process's UID the same as the file's user owner? Apply the user (u) permission bits.
3. Is the process's GID or any supplementary group the same as the file's group? Apply the group (g) permission bits.
4. Otherwise, apply the other (o) permission bits.

Diagnosing Permission Problems

Permission errors are the most common cause of "why isn't this working" on Linux. A systematic approach finds the problem quickly.

Step 1: Identify who is running the command

$ id
uid=1000(student) gid=1000(student) groups=1000(student),1001(developers)

Step 2: Check permissions on the file and its parent directories

$ ls -l /etc/ssh/sshd_config
$ ls -ld /etc/ssh
$ ls -ld /etc

Step 3: Apply the access decision rules

• Does the user own the file? Check user bits.
• Is the user in the file's group? Check group bits.
• Neither? Check other bits.
• Does every directory in the path have execute permission for this user?

Common Mistakes

Knowledge Check

Answer these before moving to the next slide.

1. What does the permission string drwxr-x--- tell you about the file type and what each category of user can do?
2. A user owns a file with permissions -rw-rw-r--. What can the owner do? What can a group member do? What can others do?
3. Write the chmod command to make a script executable by the owner only, without changing any other permissions.
4. What octal value sets permissions to rwxr-x---? Show your arithmetic.
5. After creating a new file, you see its permissions are -rw-r--r--. What is the current umask value?
6. You want to give the developers group ownership of /srv/project and all its contents. Write the command.

Knowledge Check — Answers

1. drwxr-x--- is a directory (d). The owner can read, write (create/delete files inside), and enter it. Group members can read the listing and enter it but cannot create or delete files. Others have no access at all.
2. With -rw-rw-r--: the owner can read and write the file. Group members can also read and write. Others can only read — no write or execute for anyone.
3. chmod u+x script.sh — adds execute for the user owner only, leaving all other permission bits unchanged.
4. rwx=7, r-x=5, ---=0, so the octal value is 750. Arithmetic: user: 4+2+1=7, group: 4+0+1=5, other: 0+0+0=0.
5. Files default to a maximum of 666. The actual permission is 644. The umask is 666 - 644 = 022.
6. sudo chown -R :developers /srv/project — the colon before the group name changes the group owner only; -R applies to all contents recursively.

Key Takeaways

1. Every file has three permission sets: user, group, and other. Each set has read (4), write (2), and execute (1) bits. The kernel checks them in order and stops at the first match — only one set is applied per access attempt.
2. Execute means different things on files versus directories. On a file: run it as a program. On a directory: enter it and access its contents. A directory without execute permission blocks all access to everything inside it.
3. chmod changes permissions; chown changes ownership. Symbolic mode (u+x, go-w) makes targeted changes. Octal mode (644, 755) sets all bits at once. Only root can change ownership with chown.
4. Diagnose permission problems systematically. Check who is running the process with id, check the file with ls -l, and check every parent directory with ls -ld. A missing execute bit on any directory in the path blocks access to everything below it.

Graded Lab

• Create the directory /tmp/permlab and three files inside it. Run ls -l to record the default permissions created by your current umask.
• Use umask to display the current value. Change it to 027, create a new file, and confirm the new default permissions.
• Use chmod in octal mode to set one file to 644, one to 755, and one to 600. Verify each with ls -l.
• Use chmod in symbolic mode to add group write permission to the 644 file without changing any other bits. Verify the result.
• Use sudo chown to change the owner of one file to root and the group to wheel. Verify with ls -l.
• Remove execute permission from the /tmp/permlab directory itself, then attempt to cd into it from a new shell. Observe the error, then restore execute permission.

Next: Locate, Read, and Use System Documantation Including man, info, and files in /usr/share/doc/