By the end of this lesson you will be able to
- Explain what a user, a group and the root user are on Linux.
- Read a permission string such as `-rwxr-x---` and say who may read, write and run the file.
- Convert between letters (rwx) and numbers (4, 2, 1) for common modes such as 644 and 755.
- Change the permissions of a practice file with `chmod` and check the result with `ls -l`.
- Explain why giving a file the fewest permissions that still work is safer.
Every file on a Linux computer has rules about who may read it, change it or run it. These rules are why one person on a shared computer cannot read another person's letters, and why a mistake in your own account cannot easily damage the whole system. In this lesson you will learn to read those rules and to change them carefully on files you made yourself. The earlier lesson on permissions gave you the first look; here you go deeper.
Who are you to the computer?
Linux was designed from the start for many people to share one machine. So every program and every file belongs to someone. Each person has a user account with a name, such as amina, and a number called the user ID. The computer uses the number internally and shows you the name. On Ubuntu the first account you create gets the number 1000.
A group is a named list of users. Instead of giving access to people one by one, you give it to a group. Think of a school: a pupil has a name, and also belongs to a class. The teacher can say 'the class may use the library' without naming every pupil. On Ubuntu, each user also gets a private group with the same name as the user, and may belong to extra groups such as sudo, which allows use of administrator powers.
One special account is called Root. Its user ID is 0, and it may read, change or delete almost anything on the computer. It exists so that the system can be maintained, but it is also dangerous: a typing mistake made as root can break the whole system. Ubuntu keeps the root account locked for everyday use. Instead, a trusted user runs a single command with extra power by putting sudo in front of it.
Two safe commands tell you who you are. whoami prints your user name. id prints your user ID, your main group and all the groups you belong to. Neither changes anything. Type each one and press Enter.
- Marker 1: Prints your user name
- Marker 2: Prints your numbers and groups
- Marker 3: uid is your user ID; gid is your main group
- Marker 4: groups lists every group you belong to
Read this figure as text
A simulated terminal where whoami prints the user name amina and id prints the user ID, group ID and group list.
Simulated terminal, not a real one. The prompt shows amina@laptop in the home folder. Line 1 (marker 1): the learner types whoami and the computer prints amina. Line 2 (marker 2): the learner types id. The output is uid=1000(amina) gid=1000(amina) groups=1000(amina),4(adm),27(sudo),100(users). Marker 3 points at uid=1000(amina): your user number and name. Marker 4 points at the groups list: the groups this user belongs to, including sudo, which allows administrator commands. The values are made-up examples; yours will differ a little.
Every file has an owner, a group and everyone else
Every file and folder records three things: the user who owns it, the group it belongs to, and a set of permissions. The permissions are given separately to three kinds of person: the owner (called user, u), the group (g) and other (o), meaning everybody else who has an account on the computer.
For each of the three kinds of person, there are three possible permissions. Read (r) means you may look at the contents. Write (w) means you may change them. Execute (x) means you may run the file as a program or script. On a folder the meanings shift slightly: r lets you list what is inside, w lets you add, rename or delete items inside, and x lets you enter the folder with cd and reach the files in it.
The command ls -l (a lowercase L, for 'long') lists files with all this detail. You met it in the lesson on finding your way. The first column is the permission string. It has ten characters. The first character is the type: - for an ordinary file and d for a directory (folder). The next nine are three groups of three: owner, group, other. A dash in a slot means that permission is missing.
-TypeFile (d = folder)rwxOwnerRead, write, runr-xGroupRead and run---OtherNo accessRead this figure as text
The permission string -rwxr-x--- split into the file type, owner permissions, group permissions and other permissions.
The string -rwxr-x--- has four parts. The first character, a dash, is the type: an ordinary file (a d would mean a folder). The next three, rwx, are the owner's permissions: read, write and execute are all allowed. The next three, r-x, are the group's permissions: read and execute, but no write. The last three, a row of three dashes, are the permissions for other: nothing is allowed.
Here is a whole line of ls -l output, broken into columns: -rw-r--r-- 1 amina amina 42 Oct 24 10:12 notes.txt. Reading left to right: the permission string; the number of links (you can ignore it for now); the owner (amina); the group (amina); the size in bytes (42); the date and time it last changed; and the name. So notes.txt is a file that Amina may read and write, and that her group and everyone else may only read.
- Marker 1: -l asks for the long listing
- Marker 2: A script: owner can run it, group can read and run it, others nothing
- Marker 3: A text file: everyone reads, only the owner writes
- Marker 4: A folder: the d at the start
Read this figure as text
A simulated terminal showing ls -l output for a script, a text file and a folder, with the permission strings visible.
Simulated terminal, not a real one, in the folder ~/practice. The learner types ls -l (marker 1). The output starts with total 12. Then three lines. First: -rwxr-x--- 1 amina amina 30 Oct 24 10:15 hello.sh, a script the owner can run (marker 2). Second: -rw-r--r-- 1 amina amina 42 Oct 24 10:12 notes.txt, a file everyone can read but only the owner can change (marker 3). Third: drwxr-xr-x 2 amina amina 4096 Oct 24 10:10 reports, a folder, shown by the d at the start (marker 4).
Permissions as numbers
Permissions can also be written as numbers, because that is shorter to type. Give each permission a value: read is 4, write is 2, execute is 1. Add up the ones you want for each kind of person. Read plus write is 4 + 2 = 6. Read plus execute is 4 + 1 = 5. All three is 7. None is 0. Then write the three totals in the order owner, group, other.
| Number | Letters | Meaning | Typical use |
|---|---|---|---|
600 | rw------- | Only the owner can read and write | A private file |
644 | rw-r--r-- | Owner reads and writes; everyone else reads | An ordinary shared document |
700 | rwx------ | Only the owner can do anything | A private script or folder |
755 | rwxr-xr-x | Owner does everything; others read and run | A program or a folder others may enter |
750 | rwxr-x--- | Owner everything; group reads and runs; others nothing | A script shared with a group |
- See the contents of a file
- List the items in a folder
- Change a file
- Add or delete items in a folder
- Run a file as a program
- Enter a folder with cd
Example 644 = owner 6 (4+2), group 4, other 4
Read this figure as text
A comparison of the values 4, 2 and 1 for read, write and execute, and how they add up for owner, group and other in 644.
Three columns. Column one, Read (r): worth 4. Column two, Write (w): worth 2. Column three, Execute (x): worth 1. Add the values you want to allow. Example mode 644: the owner gets 6 (read 4 plus write 2), the group gets 4 (read only) and other gets 4 (read only). In letters that is rw-r--r--.
Changing permissions with chmod
The command chmod ('change mode') sets permissions. Only the owner of a file, or an administrator, may change them. There are two ways to write the change. The number form sets everything at once: chmod 600 notes.txt makes the file readable and writable by its owner only. The letter form adjusts one thing: chmod u+x hello.sh means 'for the user (owner), add execute'. You can use u, g, o or a (all), then + to add, - to remove or = to set exactly, then r, w or x.
Practise on a harmless file
Step 1: Make a practice folder and move into it
Type
mkdir -p ~/practice/permsand press Enter, thencd ~/practice/perms. The-poption means 'make parent folders as needed and do not complain if it exists'.You should see: No output. The prompt now ends with
~/practice/perms.Step 2: Create an empty file
Type
touch notes.txt. This creates an empty file with that name.You should see: No output. That is normal: Linux commands are quiet when they succeed.
Step 3: Look at its permissions
Type
ls -l notes.txt.You should see: A line starting
-rw-rw-r--or-rw-r--r--and showing your user name twice. The exact string depends on a setting called umask, so yours may differ.Step 4: Make it private
Type
chmod 600 notes.txtthenls -l notes.txt.You should see: The string now reads
-rw-------: only you may read or write the file.Step 5: Add execute for yourself with the letter form
Type
chmod u+x notes.txtthenls -l notes.txt.You should see: The string reads
-rwx------.Step 6: Remove it again
Type
chmod u-x notes.txtand check withls -l notes.txt.You should see: Back to
-rw-------.
- Marker 1: Before: group may write, others may read
- Marker 2: The change. No output means it worked
- Marker 3: After: only the owner has access
Read this figure as text
A simulated terminal where ls -l shows a file, chmod 600 is run, and ls -l shows the permissions have become rw-------.
Simulated terminal, not a real one, in ~/practice/perms. Marker 1: ls -l notes.txt prints -rw-rw-r-- 1 amina amina 0 Oct 24 10:20 notes.txt. Marker 2: the learner types chmod 600 notes.txt and nothing is printed, because success is quiet. Marker 3: ls -l notes.txt again prints -rw------- 1 amina amina 0 Oct 24 10:20 notes.txt. The only change is the permission string: the group and others lost their read access.
Why fewer permissions are safer
Security people use the idea of least privilege: give a person or program only the access it needs to do its job, and no more. If a file is private, a mistake or a piece of Malware running as another user cannot read or change it. If a script does not have the execute permission, it cannot be launched by accident. It is the same reason you do not hand your house keys to everyone who lives on your street.
This also explains the error Permission denied. It is not a fault. It is Linux telling you that the permission string does not allow what you tried. Do not reach for sudo at once. First ask: who owns this file, and what does ls -l say? Often the file belongs to the system and you should not be changing it at all. You can see this safely: type cat /etc/shadow. Linux keeps password information there and refuses to show it to normal users, printing cat: /etc/shadow: Permission denied. That refusal is the system protecting you.
- Is the file one you made, in your home folder?
- YesDo thisRun ls -l, find the missing permission and add it with chmod (for example u+w).
- NoIs it a system file or another person's file?
- YesDo thisThe protection is deliberate. Ask the owner, or learn what a sudo command does before using it.
- NoDo thisRun ls -l, find the missing permission and add it with chmod (for example u+w).
Read this figure as text
A decision tree that starts at Permission denied and asks whether the file is yours, whether it is in your practice folder and whether you really need to change it.
Start: you see Permission denied. Question 1: is the file one you made, in your home folder? If yes, run ls -l on it and check the permission string; use chmod to add the missing permission, for example u+w to be able to write. If no, Question 2: is it a system file? If yes, do not change it; the protection is deliberate, and if you truly need administrator work, learn what the command does before using sudo. If it is another person's file, ask them to share it.
Common mistakes
✖ Instead of: Fixing every Permission denied error with
sudoorchmod 777.✔ Do this: Read the error, run
ls -land add only the permission that is missing, on a file you own. Never usechmod -R 777.✖ Instead of: Reading the permission string from the wrong end, or forgetting the first character is the type.
✔ Do this: Skip the first character, then read three groups of three: owner, group, other.
✖ Instead of: Using
chmodon important system folders to 'tidy' things.✔ Do this: Practise only inside
~/practice. System files are protected for good reason.
If something goes wrong
chmod: cannot access 'notes.txt': No such file or directory- The file is not in the current folder or the name is misspelt. Run
pwdandlsto check where you are and what the file is called, then try again. chmod: changing permissions of 'file': Operation not permitted- You are not the owner of that file. Check the owner with
ls -l. Do not force it with sudo unless you understand why the file belongs to someone else. - My
ls -lshows a different permission string from the lesson. - New files get default permissions that depend on a setting called umask. A string such as
-rw-rw-r--or-rw-r--r--is normal. Usechmodto set exactly what you want.
Key terms
- User group
- A named collection of user accounts that can be given the same permissions together.
- Root
- The all-powerful account on Linux, or the top folder of the file system, depending on context.
- Permission
- A rule that says who may read, change or run a file or use a feature.
- Least privilege
- Giving a person or programme only the access it needs, and no more.
- sudo
- A command word that runs the next command with administrator power, after asking for your password.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Read and change permissions in your practice folder
On your laptop, open the Terminal. Make the folder ~/practice/perms, create two files in it with touch (call them plan.txt and secret.txt), and run ls -l. Write down the owner, group and permission string of each. Then run chmod 600 secret.txt and chmod 644 plan.txt, and run ls -l again. Finally run whoami and id and note which groups you belong to.
Challenge: decode and design modes
On paper, without the computer, do three things. First, write in letters what modes 640, 700 and 755 allow. Second, choose the numeric mode you would give a private diary file, a script you run yourself and a folder that others may open but not change, and explain each choice in one sentence. Third, explain what is wrong with mode 777 and why it is not a fix for Permission denied.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Every file has an owner, a group and permissions for owner, group and other.
- `ls -l` shows a ten-character string: type, then rwx for owner, group, other.
- Read is 4, write is 2, execute is 1; add them to get modes such as 644 and 755.
- `chmod` changes permissions; practise only in `~/practice` and never use `chmod -R 777`.
- Least privilege: give only the access that is needed.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Ubuntu Server documentation: users and groups (Canonical)
- chmod manual page (Ubuntu Manpages)