[{"data":1,"prerenderedAt":979},["ShallowReactive",2],{"guide-linux-file-permissions":3},{"id":4,"title":5,"body":6,"date":966,"description":967,"extension":968,"meta":969,"navigation":973,"path":974,"readingTime":975,"seo":976,"stem":977,"__hash__":978},"guides\u002Fguides\u002Flinux-file-permissions.md","Linux File Permissions Explained: Owners, Groups, and Others",{"type":7,"value":8,"toc":939},"minimark",[9,14,18,21,25,30,38,41,86,90,93,96,118,121,125,128,132,135,191,198,201,205,212,220,227,273,276,289,293,296,300,303,338,341,371,374,378,381,415,418,422,429,459,462,490,494,567,571,574,577,637,640,655,658,670,680,691,695,699,732,736,739,758,762,765,826,830,833,846,850,853,873,877,902,906,915,919,935],[10,11,13],"h2",{"id":12},"how-linux-permissions-work","How Linux Permissions Work",[15,16,17],"p",{},"Every file and directory on a Linux system has an owner, a group, and a set of permission bits. These three elements together determine who can do what with that file. The system checks permissions in a strict order: first the owner, then the group, then others. As soon as a matching rule is found, the check stops.",[15,19,20],{},"This means that even if \"others\" have full access, the owner's permissions take priority. A file owned by root with mode 700 is inaccessible to everyone else, regardless of group or other permissions.",[10,22,24],{"id":23},"the-three-user-classes","The Three User Classes",[26,27,29],"h3",{"id":28},"owner-user","Owner (User)",[15,31,32,33,37],{},"The owner is typically the account that created the file. The owner can change the file's permissions and ownership (with ",[34,35,36],"code",{},"chown","). Only root can change ownership to another user.",[15,39,40],{},"Check ownership with:",[42,43,48],"pre",{"className":44,"code":45,"language":46,"meta":47,"style":47},"language-bash shiki shiki-themes github-light github-dark","ls -l \u002Fetc\u002Fpasswd\n# -rw-r--r-- 1 root root 2847 May 28 10:00 \u002Fetc\u002Fpasswd\n#              ^^^^  ^^^^\n#              owner group\n","bash","",[34,49,50,67,74,80],{"__ignoreMap":47},[51,52,55,59,63],"span",{"class":53,"line":54},"line",1,[51,56,58],{"class":57},"sScJk","ls",[51,60,62],{"class":61},"sj4cs"," -l",[51,64,66],{"class":65},"sZZnC"," \u002Fetc\u002Fpasswd\n",[51,68,70],{"class":53,"line":69},2,[51,71,73],{"class":72},"sJ8bj","# -rw-r--r-- 1 root root 2847 May 28 10:00 \u002Fetc\u002Fpasswd\n",[51,75,77],{"class":53,"line":76},3,[51,78,79],{"class":72},"#              ^^^^  ^^^^\n",[51,81,83],{"class":53,"line":82},4,[51,84,85],{"class":72},"#              owner group\n",[26,87,89],{"id":88},"group","Group",[15,91,92],{},"Every file belongs to one group. Users who are members of that group receive the group-level permissions. This is useful for collaboration — you can give a team read-write access to shared files without opening them to everyone.",[15,94,95],{},"Add a user to a group:",[42,97,99],{"className":44,"code":98,"language":46,"meta":47,"style":47},"sudo usermod -aG developers alice\n",[34,100,101],{"__ignoreMap":47},[51,102,103,106,109,112,115],{"class":53,"line":54},[51,104,105],{"class":57},"sudo",[51,107,108],{"class":65}," usermod",[51,110,111],{"class":61}," -aG",[51,113,114],{"class":65}," developers",[51,116,117],{"class":65}," alice\n",[15,119,120],{},"After adding a user to a group, they must log in again for the change to take effect on existing sessions.",[26,122,124],{"id":123},"others","Others",[15,126,127],{},"Others means everyone who is neither the owner nor in the file's group. This is the most restrictive category by default. Public web files, for example, give others read access so the web server can serve them.",[10,129,131],{"id":130},"file-vs-directory-permissions","File vs Directory Permissions",[15,133,134],{},"The same permission bits have different effects depending on whether the target is a file or a directory. This is a common source of confusion.",[136,137,138,154],"table",{},[139,140,141],"thead",{},[142,143,144,148,151],"tr",{},[145,146,147],"th",{},"Permission",[145,149,150],{},"File",[145,152,153],{},"Directory",[155,156,157,169,180],"tbody",{},[142,158,159,163,166],{},[160,161,162],"td",{},"r (read)",[160,164,165],{},"View contents with cat, less, etc.",[160,167,168],{},"List filenames with ls",[142,170,171,174,177],{},[160,172,173],{},"w (write)",[160,175,176],{},"Modify or delete file contents",[160,178,179],{},"Create, delete, or rename files inside",[142,181,182,185,188],{},[160,183,184],{},"x (execute)",[160,186,187],{},"Run the file as a program",[160,189,190],{},"Enter the directory with cd, access files inside",[15,192,193,194,197],{},"Key insight: read on a directory lets you list names, but without execute you cannot ",[34,195,196],{},"cd"," into it or access the files' metadata. Execute on a directory is almost always needed alongside read for practical use.",[15,199,200],{},"Conversely, execute without read lets you access a file inside the directory if you know its exact name, but you cannot list the directory contents.",[10,202,204],{"id":203},"viewing-permissions","Viewing Permissions",[15,206,207,208,211],{},"The ",[34,209,210],{},"ls -l"," command shows permissions as a 10-character string:",[42,213,218],{"className":214,"code":216,"language":217},[215],"language-text","-rwxr-xr-- 1 alice developers 4096 May 28 10:00 report.txt\n","text",[34,219,216],{"__ignoreMap":47},[15,221,222,223,226],{},"Breaking down ",[34,224,225],{},"-rwxr-xr--",":",[136,228,229,239],{},[139,230,231],{},[142,232,233,236],{},[145,234,235],{},"Position",[145,237,238],{},"Meaning",[155,240,241,249,257,265],{},[142,242,243,246],{},[160,244,245],{},"1",[160,247,248],{},"File type (- = regular file, d = directory, l = symlink)",[142,250,251,254],{},[160,252,253],{},"2-4",[160,255,256],{},"Owner permissions (rwx)",[142,258,259,262],{},[160,260,261],{},"5-7",[160,263,264],{},"Group permissions (r-x)",[142,266,267,270],{},[160,268,269],{},"8-10",[160,271,272],{},"Others permissions (r--)",[15,274,275],{},"For a comprehensive view including ACLs:",[42,277,279],{"className":44,"code":278,"language":46,"meta":47,"style":47},"getfacl report.txt\n",[34,280,281],{"__ignoreMap":47},[51,282,283,286],{"class":53,"line":54},[51,284,285],{"class":57},"getfacl",[51,287,288],{"class":65}," report.txt\n",[10,290,292],{"id":291},"special-permission-bits","Special Permission Bits",[15,294,295],{},"Beyond the standard rwx bits, Linux supports three special permissions that change behavior in specific ways.",[26,297,299],{"id":298},"setuid-4xxx","setuid (4xxx)",[15,301,302],{},"When set on an executable, the program runs as the file's owner, not as the user who launched it.",[42,304,306],{"className":44,"code":305,"language":46,"meta":47,"style":47},"# The passwd command runs as root regardless of who calls it\nls -l \u002Fusr\u002Fbin\u002Fpasswd\n# -rwsr-xr-x 1 root root 68208 May 28 10:00 \u002Fusr\u002Fbin\u002Fpasswd\n#   ^\n#   setuid bit (s replaces x)\n",[34,307,308,313,322,327,332],{"__ignoreMap":47},[51,309,310],{"class":53,"line":54},[51,311,312],{"class":72},"# The passwd command runs as root regardless of who calls it\n",[51,314,315,317,319],{"class":53,"line":69},[51,316,58],{"class":57},[51,318,62],{"class":61},[51,320,321],{"class":65}," \u002Fusr\u002Fbin\u002Fpasswd\n",[51,323,324],{"class":53,"line":76},[51,325,326],{"class":72},"# -rwsr-xr-x 1 root root 68208 May 28 10:00 \u002Fusr\u002Fbin\u002Fpasswd\n",[51,328,329],{"class":53,"line":82},[51,330,331],{"class":72},"#   ^\n",[51,333,335],{"class":53,"line":334},5,[51,336,337],{"class":72},"#   setuid bit (s replaces x)\n",[15,339,340],{},"Setting setuid:",[42,342,344],{"className":44,"code":343,"language":46,"meta":47,"style":47},"chmod u+s \u002Fusr\u002Flocal\u002Fbin\u002Fmyapp\n# Or numerically:\nchmod 4755 \u002Fusr\u002Flocal\u002Fbin\u002Fmyapp\n",[34,345,346,357,362],{"__ignoreMap":47},[51,347,348,351,354],{"class":53,"line":54},[51,349,350],{"class":57},"chmod",[51,352,353],{"class":65}," u+s",[51,355,356],{"class":65}," \u002Fusr\u002Flocal\u002Fbin\u002Fmyapp\n",[51,358,359],{"class":53,"line":69},[51,360,361],{"class":72},"# Or numerically:\n",[51,363,364,366,369],{"class":53,"line":76},[51,365,350],{"class":57},[51,367,368],{"class":61}," 4755",[51,370,356],{"class":65},[15,372,373],{},"Security risk: setuid binaries owned by root are a common privilege escalation target. Audit them regularly.",[26,375,377],{"id":376},"setgid-2xxx","setgid (2xxx)",[15,379,380],{},"On an executable, it runs with the file's group. On a directory, new files inside inherit the directory's group instead of the creator's primary group.",[42,382,384],{"className":44,"code":383,"language":46,"meta":47,"style":47},"# Shared project directory — all new files get the developers group\nchmod g+s \u002Fprojects\u002Fwebapp\n# Numerically:\nchmod 2775 \u002Fprojects\u002Fwebapp\n",[34,385,386,391,401,406],{"__ignoreMap":47},[51,387,388],{"class":53,"line":54},[51,389,390],{"class":72},"# Shared project directory — all new files get the developers group\n",[51,392,393,395,398],{"class":53,"line":69},[51,394,350],{"class":57},[51,396,397],{"class":65}," g+s",[51,399,400],{"class":65}," \u002Fprojects\u002Fwebapp\n",[51,402,403],{"class":53,"line":76},[51,404,405],{"class":72},"# Numerically:\n",[51,407,408,410,413],{"class":53,"line":82},[51,409,350],{"class":57},[51,411,412],{"class":61}," 2775",[51,414,400],{"class":65},[15,416,417],{},"setgid on directories is extremely useful for shared workspaces. Without it, new files default to the creator's group, breaking collaboration.",[26,419,421],{"id":420},"sticky-bit-1xxx","Sticky Bit (1xxx)",[15,423,424,425,428],{},"On a directory, the sticky bit prevents users from deleting files they do not own. This is essential for shared writable directories like ",[34,426,427],{},"\u002Ftmp",".",[42,430,432],{"className":44,"code":431,"language":46,"meta":47,"style":47},"ls -ld \u002Ftmp\n# drwxrwxrwt 10 root root 4096 May 28 10:00 \u002Ftmp\n#            ^\n#            sticky bit (t replaces x)\n",[34,433,434,444,449,454],{"__ignoreMap":47},[51,435,436,438,441],{"class":53,"line":54},[51,437,58],{"class":57},[51,439,440],{"class":61}," -ld",[51,442,443],{"class":65}," \u002Ftmp\n",[51,445,446],{"class":53,"line":69},[51,447,448],{"class":72},"# drwxrwxrwt 10 root root 4096 May 28 10:00 \u002Ftmp\n",[51,450,451],{"class":53,"line":76},[51,452,453],{"class":72},"#            ^\n",[51,455,456],{"class":53,"line":82},[51,457,458],{"class":72},"#            sticky bit (t replaces x)\n",[15,460,461],{},"Setting the sticky bit:",[42,463,465],{"className":44,"code":464,"language":46,"meta":47,"style":47},"chmod +t \u002Fshared\u002Fuploads\n# Numerically:\nchmod 1777 \u002Fshared\u002Fuploads\n",[34,466,467,477,481],{"__ignoreMap":47},[51,468,469,471,474],{"class":53,"line":54},[51,470,350],{"class":57},[51,472,473],{"class":65}," +t",[51,475,476],{"class":65}," \u002Fshared\u002Fuploads\n",[51,478,479],{"class":53,"line":69},[51,480,405],{"class":72},[51,482,483,485,488],{"class":53,"line":76},[51,484,350],{"class":57},[51,486,487],{"class":61}," 1777",[51,489,476],{"class":65},[26,491,493],{"id":492},"special-bits-summary","Special Bits Summary",[136,495,496,515],{},[139,497,498],{},[142,499,500,503,506,509,512],{},[145,501,502],{},"Bit",[145,504,505],{},"Octal",[145,507,508],{},"Symbol",[145,510,511],{},"On File",[145,513,514],{},"On Directory",[155,516,517,534,551],{},[142,518,519,522,525,528,531],{},[160,520,521],{},"setuid",[160,523,524],{},"4000",[160,526,527],{},"u+s",[160,529,530],{},"Runs as owner",[160,532,533],{},"No effect",[142,535,536,539,542,545,548],{},[160,537,538],{},"setgid",[160,540,541],{},"2000",[160,543,544],{},"g+s",[160,546,547],{},"Runs as group",[160,549,550],{},"New files inherit group",[142,552,553,556,559,562,564],{},[160,554,555],{},"Sticky",[160,557,558],{},"1000",[160,560,561],{},"+t",[160,563,533],{},[160,565,566],{},"Only owner can delete",[10,568,570],{"id":569},"understanding-umask","Understanding umask",[15,572,573],{},"The umask controls default permissions for newly created files and directories. It subtracts bits from the system defaults (777 for directories, 666 for files).",[15,575,576],{},"Common umask values:",[136,578,579,593],{},[139,580,581],{},[142,582,583,586,588,590],{},[145,584,585],{},"umask",[145,587,150],{},[145,589,153],{},[145,591,592],{},"Use Case",[155,594,595,609,623],{},[142,596,597,600,603,606],{},[160,598,599],{},"022",[160,601,602],{},"644 (rw-r--r--)",[160,604,605],{},"755 (rwxr-xr-x)",[160,607,608],{},"Default on most systems",[142,610,611,614,617,620],{},[160,612,613],{},"027",[160,615,616],{},"640 (rw-r-----)",[160,618,619],{},"750 (rwxr-x---)",[160,621,622],{},"More restrictive, shared servers",[142,624,625,628,631,634],{},[160,626,627],{},"077",[160,629,630],{},"600 (rw-------)",[160,632,633],{},"700 (rwx------)",[160,635,636],{},"Maximum privacy, single-user",[15,638,639],{},"Check your current umask:",[42,641,643],{"className":44,"code":642,"language":46,"meta":47,"style":47},"umask\n# 0022\n",[34,644,645,650],{"__ignoreMap":47},[51,646,647],{"class":53,"line":54},[51,648,649],{"class":61},"umask\n",[51,651,652],{"class":53,"line":69},[51,653,654],{"class":72},"# 0022\n",[15,656,657],{},"Set umask temporarily:",[42,659,661],{"className":44,"code":660,"language":46,"meta":47,"style":47},"umask 027\n",[34,662,663],{"__ignoreMap":47},[51,664,665,667],{"class":53,"line":54},[51,666,585],{"class":61},[51,668,669],{"class":61}," 027\n",[15,671,672,673,676,677,428],{},"Set it permanently by adding the command to ",[34,674,675],{},"~\u002F.bashrc"," or ",[34,678,679],{},"\u002Fetc\u002Fprofile",[15,681,682,683,686,687,690],{},"Important: umask does not affect files you copy (",[34,684,685],{},"cp"," preserves source permissions by default). Use ",[34,688,689],{},"cp --no-preserve=mode"," to apply umask.",[10,692,694],{"id":693},"permission-troubleshooting","Permission Troubleshooting",[26,696,698],{"id":697},"permission-denied-when-running-a-script","\"Permission denied\" when running a script",[42,700,702],{"className":44,"code":701,"language":46,"meta":47,"style":47},"# Check if execute bit is set\nls -l script.sh\n# Fix:\nchmod +x script.sh\n",[34,703,704,709,718,723],{"__ignoreMap":47},[51,705,706],{"class":53,"line":54},[51,707,708],{"class":72},"# Check if execute bit is set\n",[51,710,711,713,715],{"class":53,"line":69},[51,712,58],{"class":57},[51,714,62],{"class":61},[51,716,717],{"class":65}," script.sh\n",[51,719,720],{"class":53,"line":76},[51,721,722],{"class":72},"# Fix:\n",[51,724,725,727,730],{"class":53,"line":82},[51,726,350],{"class":57},[51,728,729],{"class":65}," +x",[51,731,717],{"class":65},[26,733,735],{"id":734},"cannot-cd-into-a-directory","Cannot cd into a directory",[15,737,738],{},"The directory likely lacks the execute bit for your user class.",[42,740,742],{"className":44,"code":741,"language":46,"meta":47,"style":47},"# Fix:\nchmod o+x \u002Fshared\u002Fproject\n",[34,743,744,748],{"__ignoreMap":47},[51,745,746],{"class":53,"line":54},[51,747,722],{"class":72},[51,749,750,752,755],{"class":53,"line":69},[51,751,350],{"class":57},[51,753,754],{"class":65}," o+x",[51,756,757],{"class":65}," \u002Fshared\u002Fproject\n",[26,759,761],{"id":760},"web-server-returns-403-forbidden","Web server returns 403 Forbidden",[15,763,764],{},"The web server user (often www-data or nginx) needs read access to files and read+execute on directories.",[42,766,768],{"className":44,"code":767,"language":46,"meta":47,"style":47},"# Common fix for web roots:\nfind \u002Fvar\u002Fwww -type d -exec chmod 755 {} +\nfind \u002Fvar\u002Fwww -type f -exec chmod 644 {} +\n",[34,769,770,775,804],{"__ignoreMap":47},[51,771,772],{"class":53,"line":54},[51,773,774],{"class":72},"# Common fix for web roots:\n",[51,776,777,780,783,786,789,792,795,798,801],{"class":53,"line":69},[51,778,779],{"class":57},"find",[51,781,782],{"class":65}," \u002Fvar\u002Fwww",[51,784,785],{"class":61}," -type",[51,787,788],{"class":65}," d",[51,790,791],{"class":61}," -exec",[51,793,794],{"class":65}," chmod",[51,796,797],{"class":61}," 755",[51,799,800],{"class":65}," {}",[51,802,803],{"class":65}," +\n",[51,805,806,808,810,812,815,817,819,822,824],{"class":53,"line":76},[51,807,779],{"class":57},[51,809,782],{"class":65},[51,811,785],{"class":61},[51,813,814],{"class":65}," f",[51,816,791],{"class":61},[51,818,794],{"class":65},[51,820,821],{"class":61}," 644",[51,823,800],{"class":65},[51,825,803],{"class":65},[26,827,829],{"id":828},"new-files-have-wrong-group","New files have wrong group",[15,831,832],{},"The directory probably lacks the setgid bit.",[42,834,836],{"className":44,"code":835,"language":46,"meta":47,"style":47},"chmod g+s \u002Fshared\u002Fproject\n",[34,837,838],{"__ignoreMap":47},[51,839,840,842,844],{"class":53,"line":54},[51,841,350],{"class":57},[51,843,397],{"class":65},[51,845,757],{"class":65},[26,847,849],{"id":848},"changes-not-taking-effect","Changes not taking effect",[15,851,852],{},"If you added a user to a group but they still lack access, they need to log in again. Group membership is evaluated at login time.",[42,854,856],{"className":44,"code":855,"language":46,"meta":47,"style":47},"# Quick check without re-login:\nsg developers \"ls \u002Fproject\"\n",[34,857,858,863],{"__ignoreMap":47},[51,859,860],{"class":53,"line":54},[51,861,862],{"class":72},"# Quick check without re-login:\n",[51,864,865,868,870],{"class":53,"line":69},[51,866,867],{"class":57},"sg",[51,869,114],{"class":65},[51,871,872],{"class":65}," \"ls \u002Fproject\"\n",[10,874,876],{"id":875},"key-takeaways","Key Takeaways",[878,879,880,884,887,890,893,896,899],"ul",{},[881,882,883],"li",{},"Linux checks owner, then group, then others — the first match wins",[881,885,886],{},"Execute on directories means \"enter,\" not \"run\"",[881,888,889],{},"setuid, setgid, and sticky bits extend the basic model for specific scenarios",[881,891,892],{},"Use setgid on shared directories so new files inherit the correct group",[881,894,895],{},"Always set the sticky bit on world-writable directories",[881,897,898],{},"umask subtracts from default permissions — choose 027 or 077 for better security",[881,900,901],{},"When troubleshooting, check the exact user class the process runs as",[10,903,905],{"id":904},"try-it-yourself","Try It Yourself",[15,907,908,909,914],{},"Test different permission combinations and see their effects instantly with our ",[910,911,913],"a",{"href":912},"\u002Ftools\u002Fchmod-calculator","chmod calculator",". It handles numeric, symbolic, and special bits — including setuid, setgid, and sticky bit.",[10,916,918],{"id":917},"related-guides","Related Guides",[878,920,921,928],{},[881,922,923,927],{},[910,924,926],{"href":925},"\u002Fguides\u002Fchmod-guide","Chmod Guide"," — syntax and examples for the chmod command itself",[881,929,930,934],{},[910,931,933],{"href":932},"\u002Fguides\u002Funix-permissions-reference","Unix Permissions Reference"," — quick reference for format conversion, ACLs, and security best practices",[936,937,938],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":47,"searchDepth":69,"depth":69,"links":940},[941,942,947,948,949,955,956,963,964,965],{"id":12,"depth":69,"text":13},{"id":23,"depth":69,"text":24,"children":943},[944,945,946],{"id":28,"depth":76,"text":29},{"id":88,"depth":76,"text":89},{"id":123,"depth":76,"text":124},{"id":130,"depth":69,"text":131},{"id":203,"depth":69,"text":204},{"id":291,"depth":69,"text":292,"children":950},[951,952,953,954],{"id":298,"depth":76,"text":299},{"id":376,"depth":76,"text":377},{"id":420,"depth":76,"text":421},{"id":492,"depth":76,"text":493},{"id":569,"depth":69,"text":570},{"id":693,"depth":69,"text":694,"children":957},[958,959,960,961,962],{"id":697,"depth":76,"text":698},{"id":734,"depth":76,"text":735},{"id":760,"depth":76,"text":761},{"id":828,"depth":76,"text":829},{"id":848,"depth":76,"text":849},{"id":875,"depth":69,"text":876},{"id":904,"depth":69,"text":905},{"id":917,"depth":69,"text":918},"2026-05-28","Deep dive into the Linux permission model: owners, groups, others, special bits, umask, and troubleshooting common permission problems.","md",{"keywords":970},[971,972],"chmod-calculator","linux-file-permissions",true,"\u002Fguides\u002Flinux-file-permissions",null,{"title":5,"description":967},"guides\u002Flinux-file-permissions","qOeaMFo5rwCHQ473BnE7o9qyGk7IqejBELgm4IvGC6M",1780401328435]