By the end of this lesson you will be able to
- Read the ten-character permission string that ls -l prints and say who may read, write or run the file.
- Change a practice file's permissions safely with chmod, using letters.
- Find help with man, --help and help, and leave a manual page with q.
- Explain what sudo does, why it exists and when not to use it.
- Use apt to search for and view a package, and describe what installing and removing one does.
Linux was built for many people to share one computer, so every file records who may do what with it. That is why you sometimes see 'Permission denied'. This lesson explains that system first, because sudo (a way to act as the administrator) and apt (the tool that installs software) only make sense once you understand what they are allowed to override. You will also learn how to find help without searching the internet, which is the best defence against pasting commands you do not understand.
Why files have permissions
Think of a block of flats. Each flat belongs to someone, the building has shared areas, and the caretaker has keys to everything. A permission is a rule that says who may open, change or use a file. Every file has an owner (usually the person who created it), a group (a named set of accounts) and a setting for everyone else. Each of the three can be allowed to read, write or execute (run).
| Letter | Name | On a file | On a folder |
|---|---|---|---|
| r | read | You can see what is inside | You can list the names inside |
| w | write | You can change or replace the contents | You can create, rename and delete things inside |
| x | execute | You can run it as a program or script | You can enter it with cd |
Reading the permission string
You met ls -l earlier. Its first column is the permission string: ten characters. The first says what kind of thing it is (- for an ordinary file, d for a directory). The next nine are three groups of three, for the owner, the group and others, in that order. A dash means that permission is not given.
-Type- = file, d = directoryrw-Ownerread and writerw-Groupread and writer--Othersread onlyRead this figure as text
An anatomy diagram splitting the permission string into type, owner, group and others sections.
The string -rw-rw-r-- is split into four labelled parts. The first character, a dash, is the type: an ordinary file (a d would mean a directory). The next three characters, rw-, are the owner's permissions: read and write, no execute. The next three, rw-, are the group's permissions: read and write, no execute. The last three, r--, are everyone else's permissions: read only. So the owner and the group can change the file, while others can only read it.
A full line from ls -l also shows the owner and group names, the size in bytes, the date and the name. Here Amina's file notes.txt is owned by the account amina, in the group amina.
cd ~/practice
touch notes.txt
ls -l notes.txt-rw-rw-r-- 1 amina amina 0 Oct 20 09:15 notes.txtChanging permissions with chmod
chmod means 'change mode'. In its letter form you say who (u owner, g group, o others, a all), then + to add or - to take away, then what (r, w, x). So chmod o-r notes.txt means 'for others, remove read from notes.txt' and chmod u+x hello.sh means 'let the owner run hello.sh'. A file is only runnable as a program if it has the execute permission, which is why a new script fails the first time you try to run it.
- Marker 1: Others may read it
- Marker 2: Others have no access now
- Marker 3: No execute permission yet
- Marker 4: x added for the owner
Read this figure as text
A simulated terminal in the practice folder showing ls -l, chmod o-r, a permission denied error for a script and chmod u+x fixing it.
A simulated terminal in ~/practice. Command 1: ls -l notes.txt prints -rw-rw-r-- 1 amina amina 24 Oct 20 09:15 notes.txt (mark 1: others can read). Command 2: chmod o-r notes.txt prints nothing, and the next ls -l notes.txt prints -rw-rw---- (mark 2: others now have no access). Command 3: touch hello.sh then ./hello.sh prints bash: ./hello.sh: Permission denied (mark 3: the file has no execute permission). Command 4: chmod u+x hello.sh prints nothing, and ls -l hello.sh prints -rwxrw-r-- (mark 4: an x now appears in the owner's group). Successful commands that change things print nothing.
Getting help without leaving the terminal
Linux comes with its own documentation. Reading it is safe, free and always matches the version you have installed. There are three ways in.
- `command --help` prints a short summary of the options and usually fits on one screen, for example
ls --help. Add| lessto read a long one page by page (pressqto leave). - `man command` opens the manual page (called a man page) for a command, for example
man ls. Press the space bar to go down a page,/followed by a word to search,nfor the next match andqto quit. - `help cd` shows help for built-in shell commands such as
cd, which do not have a separate man page.
- Marker 1: Command name and manual section
- Marker 2: Brackets mean optional; dots mean more than one
- Marker 3: Press q to leave
Read this figure as text
A simulated terminal showing the top of the ls manual page with the name, synopsis and description sections marked.
A simulated terminal after typing man ls. The page begins with LS(1) User Commands (mark 1: the name and manual section). NAME: ls - list directory contents. SYNOPSIS: ls [OPTION]... [FILE]... (mark 2: square brackets mean optional, the three dots mean you can give more than one). DESCRIPTION: List information about the FILEs (the current directory by default). The bottom line reads Manual page ls(1) line 1 (press h for help or q to quit) (mark 3: press q to leave).
sudo: acting as the administrator
Some jobs, such as installing software for everyone on the computer, would be dangerous if any ordinary program could do them. These need the powers of the root account, the all-powerful administrator. sudo (short for 'superuser do') runs one command with those powers, after checking that your account is allowed (members of the group sudo, which you saw in id). Ubuntu asks for your own account password, and does not show the characters as you type. sudo is a power tool: it removes the safety guards, so a mistake can damage the system. It is not a magic 'make it work' word.
- Uses your own permissions
- Can change only your files
- Mistakes stay small
- 'Permission denied' protects you
The normal, safe way.
- Runs one command as administrator
- Can change system files and software
- Asks for your password first
- A mistake can break the system
Only when you know why and what.
Read this figure as text
Two columns comparing running a command as an ordinary user with running it with sudo as the administrator.
Two columns. Column 1, Ordinary command: runs with your own account's permissions; can change only your own files; safe mistakes stay small; 'Permission denied' is the system protecting itself. Column 2, With sudo: runs one command with the administrator's powers; can change system files and installed software; asks for your password first; a mistake can damage the whole system, so check every word before pressing Enter. The advice: use sudo only when you know why it is needed and what the command does.
apt: installing software the safe way
On Ubuntu, software lives in repositories: online libraries of checked packages. A package manager called apt finds a package, downloads it and installs everything it needs. The App Center you used earlier does the same thing with pictures. Reading about a package is safe and needs no administrator: apt search word looks for packages and apt show package explains one. Changing what is installed needs sudo.
| Command | What it does | Needs sudo? |
|---|---|---|
apt search word | Lists packages whose name or description mentions the word | No |
apt show tree | Shows details about one package (what it is for, its size) | No |
sudo apt update | Refreshes the list of available packages (installs nothing) | Yes |
sudo apt install tree | Downloads and installs the package and what it needs | Yes |
sudo apt remove tree | Uninstalls the package | Yes |
apt update does not install updates. It only refreshes the catalogue. Installing newer versions is done by sudo apt upgrade, but on a desktop the Software Updater does the same job and shows you what will change, so it is the better habit. tree is a small harmless program that draws a folder as a tree, which makes it a good example.
- Marker 1: Reading only: no sudo needed
- Marker 2: Your own password; nothing shows as you type
- Marker 3: Read what will change, then answer
Read this figure as text
A simulated terminal where apt show prints package details and sudo apt install asks for a password and a confirmation.
A simulated terminal. Command 1: apt show tree prints Package: tree, Section: utils, Description: displays directory tree, in color (mark 1: reading only, no sudo needed). Command 2: sudo apt install tree. The terminal prints [sudo] password for amina: (mark 2: Ubuntu asks for your own password and shows nothing as you type). It then prints Reading package lists... Done, The following NEW packages will be installed: tree, and the question Do you want to continue? [Y/n] (mark 3: read what will be installed before you answer, and press n if anything surprises you).
The danger of pasting commands
Many web pages, videos and chat replies offer a 'quick fix' as a line to paste into the terminal. Pasting is fast and runs the whole line the moment you press Enter, with no chance to think. Some lines are harmless. Some delete files, give strangers access or install malware. Before you run any pasted command, split it into words and know what each one does.
curl https://example.com/install.shDownloada script you have not read | Pipehands it straight onsudoAdministratorfull powers bashRun itexecutes every lineRead this figure as text
An anatomy diagram of a risky pasted command split into download, pipe and sudo bash parts, labelled with what each does.
An educational simulation of a command you must never run. The line is: curl https://example.com/install.sh | sudo bash. It splits into four parts. 'curl https://example.com/install.sh' downloads a script from the internet whose contents you have not read. The pipe character '|' hands that downloaded text directly to the next command. 'sudo' gives the next command administrator powers. 'bash' runs whatever text it receives as commands. Together, they run unknown code from the internet with full control of your computer. The safe alternative is to download nothing, read the official installation instructions, and use apt or the App Center.
- Read the line slowly. What is the command? What does each word do? If you cannot say, stop.
- Look at the source. Does it come from the official Ubuntu documentation or a page you have good reason to trust? A random forum post is not a reason.
- Look for danger words.
sudo,rm,chmod -R,curl ... | bash,ddand anything touching/need extra care. If you do not understand them, do not run the command. - Look it up.
man commandandcommand --helpexplain the pieces. - Try it on practice files first, without sudo, when you can.
- Ask someone you trust if you are still unsure. Not understanding is a good reason to stop.
Common mistakes
✖ Instead of: Adding sudo whenever a command says 'Permission denied'.
✔ Do this: Ask why it is denied. Often you are in the wrong folder. Use sudo only when you know why it is required.
✖ Instead of: Using chmod -R 777 as a quick fix.
✔ Do this: Change one file with the smallest permission you need, for example chmod u+x script.sh.
✖ Instead of: Running a command pasted from a web page without reading it.
✔ Do this: Split it into words, look each up and check the source before pressing Enter.
✖ Instead of: Thinking apt update installs new software.
✔ Do this: It only refreshes the package list. Use the Software Updater or apt upgrade for new versions.
If something goes wrong
- man says 'No manual entry for something'.
- That word has no manual page. It may be a built-in (try help word), a typing mistake, or a program that is not installed. Try
something --helpas well. - The manual page will not close.
- Press q. Closing the terminal is not necessary.
- apt says 'E: Unable to locate package' for a name you typed.
- Check the spelling and try
apt searchwith part of the name. Runsudo apt updateif the package list is old. - sudo says your account 'is not in the sudoers file'.
- That account is not an administrator on this computer. Do not try to get around it. Ask the person who administers the computer.
- chmod says 'No such file or directory'.
- The file name is wrong or you are in the wrong folder. Check with pwd and ls, then try again.
Key terms
- Permission string
- The ten characters at the start of an ls -l line that show a file's type and who may read, write or run it.
- Execute permission
- The right to run a file as a program or script, or to enter a folder; shown as x.
- Man page
- The built-in manual page for a command, opened with man and closed with q.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Read and change permissions in the practice folder
In Terminal, run cd ~/practice, then touch perms-demo.txt and ls -l perms-demo.txt. Write down the permission string and say in words who can read and write. Run chmod o-r perms-demo.txt and ls -l perms-demo.txt again and note what changed. Then run chmod o+r perms-demo.txt to put it back. Work only on this file. Do not use sudo.
Challenge: find help and inspect a package without installing
Without searching the web, use man or --help to find out what the -a option of ls does and what the -h option of df does. Then run apt show tree and write down what the package is for. Do not install anything and do not use sudo. Finally, write two sentences explaining why curl ... | sudo bash is risky.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Every file has an owner, a group and a setting for others, each with read, write and execute rights.
- ls -l shows them as a ten-character string such as -rw-rw-r--.
- chmod changes them. Use letters, change one file, and never use chmod -R 777.
- man, --help and help give safe, built-in documentation. Press q to leave a man page.
- sudo runs one command as the administrator. It removes safety guards, so use it knowingly.
- Never run a pasted command, especially one with sudo, rm or curl piped into bash, that you cannot explain.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- The Linux command line for beginners (Ubuntu)
- Ubuntu Server documentation: package management (Ubuntu)
- chmod invocation (GNU Project)