Learn › Linux Foundations › Permissions, Ownership and Users
Part 1 of 3: the mode in ls -l and stat, chmod with letters and with numbers, read, write and execute on a directory, umask, and the setuid, setgid and sticky bits (Sections 20.1 to 20.6). No machine test here; it completes on the final step. The chapter lab waits at the end of Part 3.
This chapter covers the following topics:
This is Part 1 of 3. It covers Sections 20.1 to 20.6: how the permissions of a file are written, how to change them, what they mean on a directory, the mode a new file gets, and three special bits. Part 2 covers Sections 20.7 to 20.10, groups and owners. Part 3 covers Sections 20.11 to 20.15, accounts, and ends in the chapter lab, which covers all fifteen sections.
What you already know: Section 2.4 showed the ten characters at the start of every ls -l line and asked you only to recognize them, and Section 5.9 printed the same facts with stat. Section 7.12 met a file only root may read. This chapter explains those ten characters and changes them.
Objectives
After this part you can:
Select Start machine in the adjacent workspace and wait for its Terminal. The guided commands run on a real Debian server; chmod changes real files under ~/access for this session. The later attempt on root-owned /etc/hostname is refused. This part has no separate graded lab; it completes on its final step. The chapter assessment starts a fresh machine after Part 3 and checks file, account and group state and the commands you run.
Five questions before the material. A wrong answer costs nothing: the explanation states the fact and names the section that teaches it.
>>> After the type come three groups of three characters: the owner rw-, the group r--, everybody else ---. The owner may read and write, members of the group may read, and every other account may do nothing. Section 20.1.
>>> u names the owner, + adds, x is execute. A bit the command does not name stays exactly as it was. Section 20.2.
>>> Each digit is one class, owner first, then group, then others. Each digit is a sum: read 4, write 2, execute 1. 6 is 4 plus 2, read and write. Section 20.3.
>>> On a directory, read lets you read the list of names, and execute lets you pass through the directory to what the names point at. Section 20.4.
>>> A new file starts from 666, read and write for everyone, and the umask removes the bits it names. 022 removes write from the group and from others, which leaves 644. Section 20.5.
A permission is the right to do one thing with a file: read it, write it or run it. Linux keeps the permissions of every file in its mode, a small number stored with the file that also records what kind of thing the file is.
Every file has one owner, an account, and one group, a named set of accounts (Section 4.5 read the list of groups). The mode gives separate rights to three classes: the owner, the members of the group, and everybody else, called others.
This chapter adds one directory to the server, access, under your home directory. It holds the practice files of all three parts, one directory per topic, and lab, the targets of the chapter lab. You are in your home directory. Print access/README.txt:
prompt: admin@server1:~$ answer: cat access/README.txt ||| cat ~/access/README.txt output: access: practice files for Chapter 20 (Permissions, Ownership and Users) ======================================================================== modes/ files and a directory with different permissions (20.1) symbolic/ files to change with chmod and letters (20.2) numeric/ files to change with chmod and numbers (20.3) dirs/ directories for the r, w and x experiments (20.4) umask/ empty; Section 20.5 creates its files here groups/ files for groups, chgrp and chown (20.7 to 20.9) lab/ one target for each objective of the chapter lab
/srv/handoff holds three files owned by admin in a directory owned by root. The sudo rules on this server let you give them to another owner. hint: Section 5.1. The printing command from Chapter 5, then the path access/README.txt (or ~/access/README.txt from anywhere).
One directory per section of this part and of the next, and lab for the chapter lab. The lessons never touch lab, so its files are in the state the lab expects. /srv/handoff is a directory outside your home that Section 20.9 uses.
ls -l prints the mode as ten characters. The first is the type: - for a regular file, d for a directory, l for a symbolic link. The other nine are three groups of three, one group per class, in a fixed order: owner, group, others.
Each group has three positions, always in the same order: r read, w write, x execute. A letter means the permission is granted; a dash in its place means it is not. For a regular file, read lets you see the contents, write lets you change them, and execute lets you run the file as a program.
{ "height": 170, "caption": "The mode -rw-r----- split into the type and the three classes. Click a part for its meaning.", "nodes": [ { "id": "t", "label": "-", "x": 0, "y": 50, "detail": "Character 1, the type: - for a regular file, d for a directory, l for a symbolic link." }, { "id": "u", "label": "rw-", "x": 120, "y": 50, "detail": "Characters 2 to 4, the owner: read and write, no execute." }, { "id": "g", "label": "r--", "x": 260, "y": 50, "detail": "Characters 5 to 7, the group: read only." }, { "id": "o", "label": "---", "x": 400, "y": 50, "detail": "Characters 8 to 10, others: every account that is not the owner and not in the group. Nothing at all." } ], "edges": [ { "from": "t", "to": "u", "kind": "plain" }, { "from": "u", "to": "g", "kind": "plain" }, { "from": "g", "to": "o", "kind": "plain" } ] }
For these mode bits, Linux selects one permission class. If you own the file, the owner permissions decide. Otherwise, if you belong to the file's owning group, the owning-group permissions decide. Otherwise, the other permissions decide. If the selected class denies an action, Linux does not try another class. Section 20.7 shows the check step by step.
You are in your home directory. The directory access/modes holds five entries with five different modes. List it in long form:
prompt: admin@server1:~$ answer: ls -l access/modes ||| ls -l access/modes/ ||| ls -l ~/access/modes output: total 20 -rwxr-xr-x 1 admin admin 114 Jan 15 2026 cleanup.sh -rw-r--r-- 1 admin admin 109 Jan 15 2026 notes.txt -rw-r----- 1 admin admin 57 Jan 15 2026 payroll.csv drwxr-xr-x 2 admin admin 4096 Jan 15 2026 reports -rw------- 1 admin admin 27 Jan 15 2026 token.txt hint: Section 2.4. The listing command with its long option -l, then the path access/modes (or ~/access/modes from anywhere).
Read the first ten characters of each line. cleanup.sh is -rwxr-xr-x: a regular file that the owner may read, change and run, and that everyone else may read and run. notes.txt is -rw-r--r--: the owner may read and change it, everyone else may read it; this is the most common mode for a text file.
payroll.csv is -rw-r-----: members of the group may read it and others get nothing. reports starts with d, a directory; Section 20.4 explains what r, w and x mean there. token.txt is -rw-------: the owner only, the usual mode for a secret. The owner and the group of all five are admin.
Section 5.9 printed the status of a file with stat and used -c with a format to print single fields. Two format codes print the mode. %A prints the ten characters exactly as ls -l shows them. %a prints the same permissions as an octal number, a number written with the digits 0 to 7. %U and %G print the names of the owner and the group, and %n the name of the file.
You are in your home directory. Print the mode of access/modes/payroll.csv in both forms, with its owner and group:
prompt: admin@server1:~$ answer: stat -c '%A %a %U %G %n' access/modes/payroll.csv ||| stat -c "%A %a %U %G %n" access/modes/payroll.csv ||| stat --format='%A %a %U %G %n' access/modes/payroll.csv ||| stat -c '%A %a %U %G %n' ~/access/modes/payroll.csv output: -rw-r----- 640 admin admin access/modes/payroll.csv hint: Section 20.1. The status command with -c and the format '%A %a %U %G %n' in single quotes, then the path access/modes/payroll.csv (or ~/access/modes/payroll.csv from anywhere).
The same permissions twice: -rw-r----- and 640. The first digit is the owner's rw-, the second the group's r--, the third the others' ---. Section 20.3 shows how each digit is counted. Listings show the letters and commands often take the number, so you need to read both. Then come the owner, admin, the group, admin, and the name exactly as you typed it.
chmod, change mode, sets the permissions of a file. The owner of a file may change its mode, and so may root; no other account may.
The symbolic form of chmod names a class, an operation and one or more permissions, with no spaces. The class is u for the owner (the user), g for the group, o for others, or a for all three. The operation is + to add, - to remove, or = to set exactly. The permissions are r, w and x. So g-w means: from the group, remove write.
You are in your home directory. The directory access/symbolic holds five files for this section. List it in long form before changing anything:
prompt: admin@server1:~$ answer: ls -l access/symbolic ||| ls -l access/symbolic/ ||| ls -l ~/access/symbolic output: total 20 -rw-rw-rw- 1 admin admin 141 Jan 15 2026 index.html -rw------- 1 admin admin 51 Jan 15 2026 menu.txt -rw-r--r-- 1 admin admin 34 Jan 15 2026 notes.txt -rw-r--r-- 1 admin admin 113 Jan 15 2026 report.sh -rw-rw-r-- 1 admin admin 75 Jan 15 2026 shared.txt hint: Section 2.4. The long listing -l, then the path access/symbolic (or ~/access/symbolic from anywhere).
Five starting points. index.html may be changed by every account, -rw-rw-rw-. menu.txt is the owner's alone. notes.txt and report.sh have the common -rw-r--r--, and shared.txt lets the group write, -rw-rw-r--. No file has an x anywhere, although report.sh is a program. The next exercises change one class of one file each.
A script is a text file of commands that the shell runs as a program. To run a program by its path, your class needs the x bit on it. report.sh has none. You are in your home directory. Run access/symbolic/report.sh by typing its path on its own:
prompt: admin@server1:~$ answer: access/symbolic/report.sh ||| ~/access/symbolic/report.sh ||| ./access/symbolic/report.sh output: bash: access/symbolic/report.sh: Permission denied hint: Section 20.2. Type the path of the script, access/symbolic/report.sh (or ~/access/symbolic/report.sh from anywhere), with no command in front of it.
The message starts with bash: the shell was asked to start the file as a program, and the system refused because no class you belong to has x. The file is readable, so cat would print it; running it is a separate right. Section 10.4 would read the exit status of this line as 126, the number bash uses for a program it may not run.
u+x adds execute for the owner and changes nothing else. You are in your home directory. Add it to access/symbolic/report.sh:
prompt: admin@server1:~$ answer: chmod u+x access/symbolic/report.sh ||| chmod u+x ~/access/symbolic/report.sh output: hint: Section 20.2. The mode command with the owner letter u, a plus sign and the execute letter x, then the path access/symbolic/report.sh (or ~/access/symbolic/report.sh from anywhere).
Silent, like every successful chmod. The mode is now -rwxr--r--; Exercise 20-12 prints it.
You are in your home directory. Run the script by its path again, this time as ~/access/symbolic/report.sh, the form that works from any directory:
prompt: admin@server1:~$ answer: ~/access/symbolic/report.sh ||| access/symbolic/report.sh ||| ./access/symbolic/report.sh output: report: 3 pages, 1 stylesheet, 1 script hint: Section 20.2. The path of the script on its own, ~/access/symbolic/report.sh, now that the owner has execute.
The script ran and printed its one line. Only the owner gained the right: the group and others still have r-- and would get the refusal of Exercise 20-5. Section 8.7 ran programs by their bare name through PATH; a program outside PATH is run by its path, as here.
shared.txt is -rw-rw-r--: members of the group may change it. You are in your home directory. Remove write permission for the group from access/symbolic/shared.txt, and leave the rest as it is:
prompt: admin@server1:~$ answer: chmod g-w access/symbolic/shared.txt ||| chmod g-w ~/access/symbolic/shared.txt ||| chmod g=r ~/access/symbolic/shared.txt output: hint: Section 20.2. The group letter g, a minus sign and the write letter w, then the path access/symbolic/shared.txt (or ~/access/symbolic/shared.txt from anywhere).
Silent. The group keeps read; only its write is gone, so the mode is now -rw-r--r--.
Every account on the server can read notes.txt. You are in your home directory. Remove read permission for others from access/symbolic/notes.txt:
prompt: admin@server1:~$ answer: chmod o-r access/symbolic/notes.txt ||| chmod o-r ~/access/symbolic/notes.txt ||| chmod o= ~/access/symbolic/notes.txt output: hint: Section 20.2. The others letter o, a minus sign and the read letter r, then the path access/symbolic/notes.txt (or ~/access/symbolic/notes.txt from anywhere).
Silent. The owner and the group can still read the notes, and every other account cannot: -rw-r-----.
menu.txt is -rw-------, readable by its owner alone. The letter a names all three classes at once. You are in your home directory. Add read permission for all three classes to access/symbolic/menu.txt:
prompt: admin@server1:~$ answer: chmod a+r access/symbolic/menu.txt ||| chmod a+r ~/access/symbolic/menu.txt ||| chmod ugo+r access/symbolic/menu.txt output: hint: Section 20.2. The letter a for all three classes, a plus sign and r, then the path access/symbolic/menu.txt (or ~/access/symbolic/menu.txt from anywhere).
Silent. Every class gained read; write is still the owner's alone, so the mode is -rw-r--r--. ugo+r means the same as a+r.
= sets the classes it names to exactly the permissions listed, whatever they were before. Several changes can be joined in one argument with commas and no spaces. index.html is -rw-rw-rw-: any account may change the page. You are in your home directory. Set the owner of access/symbolic/index.html to read and write, and the group and others to read only:
prompt: admin@server1:~$ answer: chmod u=rw,go=r access/symbolic/index.html ||| chmod u=rw,go=r ~/access/symbolic/index.html ||| chmod u=rw,g=r,o=r access/symbolic/index.html output: hint: Section 20.2. Two changes joined by a comma: u=rw for the owner and go=r for the group and others, then the path access/symbolic/index.html (or ~/access/symbolic/index.html from anywhere).
Silent. u=rw gives the owner rw- and would remove an x if there were one. go=r gives the group and others r--, which removes their write. The result is -rw-r--r--. = is the safe choice when you know the mode you want and not the mode that is there.
stat accepts several paths at once. A * in a path is a wildcard: the shell replaces access/symbolic/* with the name of every file in that directory, in sorted order, before stat runs. You are in your home directory. Print the mode of all five files:
prompt: admin@server1:~$ answer: stat -c '%A %a %U %G %n' access/symbolic/* ||| stat -c "%A %a %U %G %n" access/symbolic/* ||| stat -c '%A %a %U %G %n' ~/access/symbolic/* output: -rw-r--r-- 644 admin admin access/symbolic/index.html -rw-r--r-- 644 admin admin access/symbolic/menu.txt -rw-r----- 640 admin admin access/symbolic/notes.txt -rwxr--r-- 744 admin admin access/symbolic/report.sh -rw-r--r-- 644 admin admin access/symbolic/shared.txt hint: Section 20.1. The same stat format as Exercise 20-3, then the wildcard path access/symbolic/* (or ~/access/symbolic/* from anywhere).
Compare with Exercise 20-4. index.html
Practice Chapter 20, Part 1. Permissions, Ownership and Users: ls -l, stat, chmod, umask and the special bits in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.