# Users & permissions

File permissions & ownership

How Linux's read/write/execute permission model works, and how to change it with chmod and chown.

Reading ls -l output

ls -l shows permissions as ten characters, e.g. -rwxr-xr--: the file type, then three groups of rwx for the owner, the group, and everyone else.

bash

ls -l /etc/passwd
# -rw-r--r-- 1 root root 2371 Jan  1 00:00 /etc/passwd

chmod and octal notation

Each permission is a bit: read=4, write=2, execute=1. Add them per group to get one digit — 7 (rwx), 6 (rw-), 5 (r-x), and so on. chmod 644 is the standard for a regular file, 755 for a script or directory.

bash

chmod 644 index.html   # owner rw, everyone else read-only
chmod 755 deploy.sh    # owner rwx, everyone else rx
chmod +x deploy.sh     # add execute without touching the rest

Changing ownership

chown changes the owning user and/or group. -R applies it recursively through a directory tree — needed constantly after copying files in as root that a service account then needs to read.

bash

chown deploy:deploy app.js
chown -R www-data:www-data /var/www/site

umask: the default for new files

umask sets which permission bits are stripped from newly created files by default (typically 022, giving 644 for files and 755 for directories). It's per-shell-session; set it in .bashrc to make it stick.

bash

umask
umask 027   # more restrictive: group/other lose write and, for dirs, execute