Changing Permissions and Ownership

Octal modes

chmod (change mode) sets permissions. Only a file’s owner, or root, can change them ¹.

The fast way is three digits, one each for owner, group, and others. Each digit adds up the permissions it grants ¹:

Read = 4, write = 2, execute = 1; add them. That’s why these numbers are octal: each digit holds exactly three bits ¹.

me@linuxbox:~$ chmod 600 secrets.txt      # rw-------  private file
me@linuxbox:~$ chmod 644 notes.txt        # rw-r--r--  normal file
me@linuxbox:~$ chmod 755 tools            # rwxr-xr-x  normal folder or program
me@linuxbox:~$ chmod 700 private          # rwx------  private folder

Those four, plus 664 and 775 for shared group work, cover nearly everything you’ll ever set ¹.

Symbolic modes

The other form names who, an operation, and which permissions ¹:

• Who: u (user, the owner), g (group), o (others), a (all three). Leave it out and it means all.
• Operation: + add, - remove, = set exactly (and clear the rest).
• Which: r, w, x.

me@linuxbox:~$ chmod u+x backup.sh          # owner may run it
me@linuxbox:~$ chmod go-w notes.txt         # take write away from group and others
me@linuxbox:~$ chmod a=r report.txt         # read-only for everyone
me@linuxbox:~$ chmod u+x,go=rx tool         # several changes, comma-separated

The advantage: symbolic changes one thing and leaves everything else alone ¹. Use octal when you know the whole mode you want, symbolic when you’re adjusting.

chmod -R changes a whole tree, but it applies the same mode to files and folders, which you rarely want ¹. A trick worth knowing: capital X adds execute only to directories (and to files that already have it), so chmod -R u=rwX,go=rX folder gives folders 755 and files 644 in one pass.

Making a script runnable

A new file never has the execute bit, so a script you just wrote won’t run by name ²:

me@linuxbox:~$ ./hello.sh
bash: ./hello.sh: Permission denied
me@linuxbox:~$ chmod +x hello.sh
me@linuxbox:~$ ./hello.sh
Hello!

You’ll do this for every script you write. (The ./ means “the file in this directory”; module 5 explains why you need it.)

umask: what new files start with

When a program creates a file, it asks for rw-rw-rw- (666), and a directory rwxrwxrwx (777). The umask then switches some bits off: every 1 bit in the mask removes that permission ¹.

me@linuxbox:~$ umask
0002

• 022 (a common default): new files 644, new folders 755. Only you can change them.
• 002 (common on desktop systems that give each user a private group): new files 664, folders 775. Your private group can write too, which is safe because only you are in it, and handy in shared folders ¹.

Check yours with umask; under WSL it’s often 0022. You rarely need to change it. If you do, umask 022 lasts until the shell closes; put it in ~/.bashrc to keep it (module 5).

Changing owners

chown changes the owner and group; it needs root ¹:

chgrp family file changes just the group, and you can do it without root if you own the file and belong to the new group. Add -R to either for a whole tree.

The common case: you copied something with sudo cp, and the copy is owned by root. sudo chown me: thefile gives it back ¹.

The special bits

Three more bits sit in front of the usual nine, as a fourth octal digit ¹:

• setuid (4000, shows as s in the owner’s x place): a program runs with its owner’s powers, not yours. /usr/bin/passwd is -rwsr-xr-x and owned by root; that’s how you can change your own password in /etc/shadow, a file only root can write. Setuid programs are kept to a bare minimum for security.
• setgid (2000, s in the group’s x place): on a directory, new files inside get the directory’s group instead of the creator’s. That’s what makes shared folders work.
• sticky (1000, t in the others’ x place): on a directory, people can delete or rename only their own files. /tmp is drwxrwxrwt: everyone can write there, nobody can delete anyone else’s files.

A shared folder, start to finish

Two people, alex and sam, want a folder for household paperwork that both can edit ¹:

alex@linuxbox:~$ sudo groupadd household
alex@linuxbox:~$ sudo usermod -aG household alex
alex@linuxbox:~$ sudo usermod -aG household sam
alex@linuxbox:~$ sudo mkdir /srv/household
alex@linuxbox:~$ sudo chown :household /srv/household
alex@linuxbox:~$ sudo chmod 2775 /srv/household
alex@linuxbox:~$ ls -ld /srv/household
drwxrwsr-x 2 root household 4096 Oct  5 08:30 /srv/household

• groupadd makes the group; usermod -aG appends each person to it. (Leave out the -a and you’d replace all their other groups.)
• The folder belongs to group household with mode 2775: group members can create files, others can look, and the setgid bit (the s) makes every new file belong to household.
• New group memberships take effect at your next login: log out and back in, or close WSL and reopen it, then check with id.
• With a umask of 002, files each of you creates there stay group-writable, so the other can edit them. With 022, set umask 002 in each person’s ~/.bashrc ¹.

On Ubuntu, sudo adduser sam household does the same as usermod -aG ³.

Your turn

So

Set permissions with chmod: three octal digits (r=4, w=2, x=1) for a full mode, or u/g/o/a with + - = to adjust one thing. chmod +x makes a script runnable, umask decides how new files start, and chown changes owners. The setuid, setgid, and sticky bits explain passwd, shared folders, and /tmp.