Users, groups, and ownership
Every process runs as a user and one or more groups. Every filesystem object has an owner user and an owner group. Permissions are evaluated against those identities.
This is why running a command with sudo changes what it can access: the process is running with elevated identity, usually root, for that command.
Read, write, and execute
Linux permissions are commonly shown as three sets: owner, group, and others. Each set can have read, write, and execute bits.
The meaning changes slightly between files and directories. Execute on a file means run it as a program. Execute on a directory means traverse it, which is required to access names inside it.
| Permission | On files | On directories |
|---|---|---|
| read | Read file contents | List directory names if execute is also available |
| write | Modify file contents | Create, delete, or rename entries inside |
| execute | Run as a program or script | Enter/traverse the directory |
Numeric permissions: 644, 755, 600, 700
Numeric modes add read as 4, write as 2, and execute as 1. Each digit represents owner, group, or others. 7 means read/write/execute. 6 means read/write. 5 means read/execute. 0 means no permission.
Common modes are 644 for regular readable files, 755 for executable directories and programs, 600 for private files, and 700 for private directories.
| Mode | Meaning | Common use |
|---|---|---|
| 644 | Owner read/write; group and others read | Normal public files |
| 755 | Owner read/write/execute; group and others read/execute | Directories and executable programs |
| 600 | Owner read/write only | Private keys or sensitive files |
| 700 | Owner full access only | Private directories |
chmod, chown, and chgrp
chmod changes permission bits. chown changes owner. chgrp changes group. They solve different problems and are often used together.
Avoid chmod 777 as a universal fix. It makes files writable by everyone, which can turn a small permission issue into a security issue.
chmod u+x deploy.shchmod 600 ~/.ssh/id_ed25519sudo chown -R www-data:www-data /var/www/siteumask
umask controls which permission bits are removed from newly created files and directories. It is a default safety filter applied at creation time.
A common umask of 022 makes new directories 755 and new files 644. A stricter umask of 077 makes new files and directories private to the owner.
Special bits: setuid, setgid, and sticky bit
Special bits modify normal permission behavior. setuid lets an executable run with the file owner's identity. setgid can make executables run with group identity or make directories inherit group ownership. The sticky bit on a shared directory prevents users from deleting each other's files.
The classic sticky-bit example is /tmp: many users can create files there, but they should not be able to delete files owned by other users.
| Bit | Common display | Typical use |
|---|---|---|
| setuid | s in owner execute position | Carefully audited privilege helper programs |
| setgid | s in group execute position | Shared project directories or group-privileged executables |
| sticky | t in others execute position | Shared writable directories such as /tmp |
Security implications and practical examples
Permissions are one of Linux's main security boundaries. They are not the only boundary, but they stop ordinary users and services from reading or changing files they do not own.
Good permission practice means giving each service only the access it needs, keeping secrets private, avoiding world-writable paths, and preferring group-based collaboration over broad access.