Retired Techie

Introduction

Linux file permissions and ownership differ from Windows access controls, which can be confusing for newcomers. But it is important to understand who owns a file and who can access it. Learning how permissions and ownership work is an not only an important part of transitioning from Windows to Linux, but can make the whole experience much less frustrating.

In Linux, each file and directory has an owner, and permissions determine who can access or change it. These rules may seem confusing at first, especially when an action is blocked because you do not have permission.

You may also hear the phrase “everything is a file” used to describe Linux. It is a shorthand for the way many system resources are accessed through file-like interfaces, as well as ordinary documents and folders. Because files are such a central part of the system, understanding ownership and permissions is useful well beyond managing personal documents.

This article introduces the basics of Linux file ownership and permissions, helping you make sense of how access works and feel more confident as you get familiar with Linux.

An Overview

Linux permissions control who can read, modify, or execute files, and who can access directories. They are assigned to three classes: owner, group, and others. Every file and directory has an owner and is associated with a group; “others” refers to everyone else.

A group is a collection of users who may need similar access, for example, to work with shared files. Permissions also work differently for files and directories. For a file, they determine whether it can be read, modified, or executed. For a directory, they control whether users can list its contents, create or remove entries, and access items within it. Deleting or renaming a file is generally controlled by permissions on the directory that contains it, rather than on the file itself.

This article covers common Linux permissions and ownership, including how to view and change them. It is a practical introduction for everyday users, not an in-depth guide to every aspect of Linux access control. Linux also supports more advanced controls and settings for permissions assigned to newly created files and directories. Most average users will never use them, so they are out of scope here.

User Classes

Linux permissions are assigned to three classes: owner, group, and other. Each class can be granted permissions such as read, write, and execute.

• Owner: The user account that owns the file or directory. The owner is not necessarily the person who created it; ownership can be changed.
• Group: The group associated with the file or directory. A user has a primary group and may also belong to additional groups. If the user is not the owner but belongs to the associated group, the group permissions apply.
• Other: Everyone who is neither the owner nor a member of the associated group. Their access is determined by the permissions assigned to this class.

Linux uses user and group information to determine which permissions apply. The root user, also called the superuser, can usually access or modify most files, regardless of ordinary file permissions. The root group is separate: belonging to it does not grant the privileges of the root user. Other security controls may also restrict what root can do.

Permission Types

Each permission class; owner, group, and others, can be granted three basic permissions: read, write, and execute. These permissions work differently for files and directories. For some operations, the permissions on the parent directory, not the file itself, determine what you can do.

• Read (r): For a file, this allows someone to view its contents, provided they can also access the file’s location. For a directory, it allows someone to list its entries; though directory execute permission is also needed to access them.
• Write (w): For a file, this allows someone to modify its contents. For a directory, write permission, typically together with execute permission, allows someone to create, delete, or rename entries. These actions are generally controlled by permissions on the directory, not by write permission on the files themselves.
• Execute ( x ): For a file, this allows someone to run it as a program or script, if the system can execute it. For a directory, it allows someone to traverse it and access entries by name.

Viewing Permissions

Use ls -l to view file and directory permissions. Most file managers also display permissions in an item’s Properties window, though the presentation varies. This guide focuses on the command line because its output is consistent, and understanding it can help you interpret permission settings in graphical file managers.

In a long listing from ls -l, each entry begins with a ten-character string showing its type and permissions. For example, in -rwxr-xr–:

• Character 1 indicates the entry type. Common values are – for a regular file, d for a directory, and l for a symbolic link.
• Characters 2–4 show the owner’s permissions, in the order read (r), write (w), and execute (x).
• Characters 5–7 show the group’s permissions in the same order.
• Characters 8–10 show the permissions for others; everyone who is neither the owner nor a member of the file’s group.

A dash (–) means the corresponding permission is not set. For example, r-x means read and execute permissions are set, but write permission is not.

Other Views

Permissions can also be represented numerically. For each class; owner, group, and other. Read is assigned the value 4, write 2, and execute 1. Add the values for the permissions that are set to get that class’s digit.

Permissions	Value	Read	Write	Execute
---	0	0	0	0
--x	1	0	0	1
-w-	2	0	2	0
-wx	3	0	2	1
r--	4	4	0	0
r-x	5	4	0	1
rw-	6	4	2	0
rwx	7	4	2	1

For example, `rwxr-xr–` becomes `754`: the owner has `rwx` (7), the group has `r-x` (5), and others have `r–` (4).

Checking Owners and Groups

The ideas of owner and others are straightforward. Groups can be less familiar, so let’s start with how to see which groups are associated with your account. At the command line, run:

groups

Groups help control which files and resources users can access. Some systems use groups such as sudo or wheel for administrative access. Other groups may provide access to things like printers or removable drives, depending on your system.

You can view local account entries with:

cat /etc/passwd

A line in the file might look like this:

rt:×:1000:1000:Retired Techie:/home/rt:/bin/bash

The fields are separated by colons. Here, rt is the login name; x indicates that password information is stored separately; the first 1000 is the user ID (UID); and the second is the primary group ID (GID). The remaining fields give the account’s descriptive name, home directory, and login shell.

On many systems, low UIDs and GIDs are used for system accounts and groups, while regular users have higher numbers. The exact ranges vary by distribution, though 1000 is a common break point on Arch and Debian based Distros.

To view local group entries, read /etc/group:

cat /etc/group

A line might look like this:

Wheel:×:10:rt

The fields show the group name, a password placeholder, the group ID (GID), and any members listed in the group. Member names are separated by commas. The list may not include users who have that group as their primary group, so it may not show everyone associated with it.

On a typical home computer, these files usually contain the accounts and groups you’ll need to know about. Some computers connected to larger organizations also use network accounts, which may not appear in these local files.

Groups Controlling Access

Creating a group changes system account information, so it usually requires administrator privileges. On a home computer with multiple user accounts, a group can make it easier to share files: you can give the group permission to read, change, or run them.

To create a group, run:

sudo groupadd <group name>

Replace group name with the name you want, and don’t type the angle brackets. To check that a local group was added, run:

cat /etc/group

After creating a group, add the users who should belong to it. If you want to use the group yourself, add your account too:

sudo usermod -aG <group name> <user>

Replace <group name> with the group’s name and username with the user’s login name (no angle brackets). The -G option specifies supplementary groups, and -a appends the new group without removing the user from their other groups. You’ll need administrator privileges. The change usually takes effect after the user logs out and back in.

Once users belong to a group, you can assign that group to files and directories you own. If you don’t own them, then sudo will be required. Use chgrp to change only the group; chown user:group changes both the owner and the group.

chgrp <group> <file>
chown <user>:<group> <file>

Replace <group> and <file> with the group and file you want. If you own the file and belong to that group, you usually won’t need sudo. If you don’t own it, you’ll generally need an administrative permissions to make the change.

If you are changing the group or owner of a directory, you can use the -R (recursive) option. Be careful, as this affects every file and sub-directory underneath that directory.

Next, set the file’s permissions. Suppose you own a regular, non-executable file and want both yourself and your group to be able to read and edit it. You want other users to have no access.

The permission string is: rw-rw—-

The first three characters are the owner’s permissions, the next three are the group’s, and the final three are for everyone else. In numeric notation, read is 4, write is 2, and no permission is 0. So the owner’s rw- adds up to 6, the group’s rw- also adds up to 6, and others — is 0.

chmod 660 <file>

Replace <file> with the file name. Since you own the file, you usually won’t need sudo.

You can also use letters to set permissions. In this format, u means the file’s owner, g means the group, and o means others. The operators are + to add permissions, – to remove them, and = to set them exactly. Separate each change with a comma:

chmod u=rw,g=rw,o-rwx <file>

This sets the owner’s and group’s permissions to read and write, and removes all permissions for others. This produces the same permissions as chmod 660 filename.

At this point you can read and write your file, your group can read and write your file, and everyone else cannot even open it. Just remember, root can still open your file.

Conclusion

This has been a basic introduction to Linux file ownership and permissions. There’s more to learn, but these fundamentals cover many common tasks a home user is likely to encounter.

You now know how ownership and groups work, how permissions apply to the owner, group, and other users, and how to view and change them.

Linux permissions aren’t difficult, but they work differently from permissions in Windows. Understanding the basics can help you avoid confusion and troubleshoot access problems. In my experience, file ownership and permissions are among the first things worth checking when a new Linux user can’t access a file or directory.