Permissions

By the end of this lesson you can read the permission letters in ls -l, change them with chmod in both its forms, say who owns a file, make a script runnable, and decide when sudo is the right tool and when it is not.

This lesson is about Linux (and macOS, which works the same way). Windows has a different permission system, so terminals on Windows, such as Ubuntu Terminal, do not behave like this.

Users and groups

Linux was built for many people sharing one computer, so every file has an owner and every program runs as someone.

• A user is an account, such as sam. Each user has a number, the user ID (UID).
• A group is a named set of users, such as developers. A user can be in several groups. Most users also have a group of their own with the same name.
• root is the administrator account, UID 0. It can read, change and delete anything.

Ask the system who you are:

sam@laptop:~$ whoami
sam
sam@laptop:~$ id
uid=1000(sam) gid=1000(sam) groups=1000(sam),4(adm),27(sudo)

groups= lists your groups. Being in sudo (called wheel on Fedora and Arch) is what lets you run commands as root.

Read ls -l

ls -l shows the permissions in the first column. Make a small script and look at it:

sam@laptop:~/practice$ printf '#!/bin/bash\necho "Hello from $(whoami)"\n' > hello.sh
sam@laptop:~/practice$ ls -l hello.sh
-rw-rw-r-- 1 sam sam 40 Nov  9 17:44 hello.sh

Every part of that line means something:

-rw-rw-r--  1  sam  sam  40  Nov  9 17:44  hello.sh
│└┬┘└┬┘└┬┘  │  │    │    │   │             └─ name
│ │  │  │   │  │    │    │   └─ last modified
│ │  │  │   │  │    │    └─ size in bytes
│ │  │  │   │  │    └─ group
│ │  │  │   │  └─ owner (user)
│ │  │  │   └─ number of links (you can ignore it)
│ │  │  └─ others: r--
│ │  └─ group: rw-
│ └─ owner: rw-
└─ type: - file, d folder, l link

• Type: - is a file, d is a folder (directory), l is a link (a shortcut to another file).
• Then three sets of three letters, for three kinds of people: the owner (u), the file's group (g), and others, meaning everyone else (o).
• Each set is r, w and x in that order, or a - where that permission is missing.

Letter	On a file	On a folder
r read	See what is inside	List the names inside
w write	Change it	Create, rename and delete files inside
x execute	Run it as a program	Go into it with cd

So -rw-rw-r-- reads: a file; the owner sam can read and write; the group sam can read and write; everyone else can only read. Nobody can run it.

Try to run it and Linux refuses:

sam@laptop:~/practice$ ./hello.sh
bash: ./hello.sh: Permission denied

Change permissions with chmod

chmod (change mode) has two ways of saying the same thing.

Symbolic: who, plus or minus, what

chmod  u+x  hello.sh
       │││
       ││└─ what: r, w or x
       │└── + add, - remove, = set exactly
       └─── who: u owner, g group, o others, a all three

sam@laptop:~/practice$ chmod u+x hello.sh
sam@laptop:~/practice$ ls -l hello.sh
-rwxrw-r-- 1 sam sam 40 Nov  9 17:44 hello.sh
sam@laptop:~/practice$ ./hello.sh
Hello from sam

More examples: chmod go-w file removes write for group and others; chmod a+r file lets everyone read; chmod o= file takes every permission away from others.

Numeric: three digits

Each permission has a value, and you add them up for each set:

r = 4    w = 2    x = 1

  rwx = 4+2+1 = 7      rw- = 4+2 = 6      r-x = 4+1 = 5      r-- = 4      --- = 0

Three digits, one each for owner, group and others:

Number	Letters	Typical use
755	rwxr-xr-x	Programs and scripts: everyone can run, only the owner can change
644	rw-r--r--	Ordinary files: everyone can read, only the owner can change
700	rwx------	A private folder or script
600	rw-------	Private files: SSH keys, passwords, .env files

sam@laptop:~/practice$ chmod 755 hello.sh
sam@laptop:~/practice$ ls -l hello.sh
-rwxr-xr-x 1 sam sam 40 Nov  9 17:44 hello.sh

stat -c '%a %A %n' hello.sh prints both forms side by side, 755 -rwxr-xr-x hello.sh, if you want to check your arithmetic.

Owners and chown

chown (change owner) sets who owns a file: chown alex report.txt, or owner and group together with chown alex:developers report.txt. Add -R to change a whole folder.

Only root can give a file away, so as a normal user you will see:

sam@laptop:~/practice$ chown root hello.sh
chown: changing ownership of 'hello.sh': Operation not permitted

You mostly need chown to fix files that were created as root by mistake, for example with sudo chown -R sam:sam ~/project.

sudo: borrowing root

sudo (substitute user, do) runs one command as root, after asking for your password:

sam@laptop:~$ cat /etc/shadow
cat: /etc/shadow: Permission denied
sam@laptop:~$ sudo apt update
[sudo] password for sam:

/etc/shadow holds the system's password hashes, so only root may read it. That Permission denied is the system working as intended.

Use sudo for changing the system: installing and removing software, editing files under /etc, starting and stopping system services.

Do not use sudo for:

• Your own files in your home folder. If you need sudo there, something went wrong earlier; fix the owner with chown instead.
• Running programs you do not trust, or commands you copied without understanding. With sudo they can change anything on the machine.
• "Making an error go away." Permission denied is a question: should I be doing this? Answer it before you reach for sudo.

The terminal remembers your password for a few minutes, so a second sudo soon after may not ask again.

Make a script runnable

You have already done the two things a script needs:

1. A shebang line. The first line of hello.sh is #!/bin/bash. #! followed by a path tells Linux which program should read the rest of the file. A Python script starts with #!/usr/bin/env python3.
2. The execute permission, with chmod +x hello.sh (the same as a+x) or chmod u+x.

Then run it with a path: ./hello.sh. The ./ means "the file called hello.sh here". Typing only hello.sh makes the shell look for a program with that name in its list of program folders instead; Installing software explains that list, called PATH.

Without the execute permission you can still run a script by handing it to its program: bash hello.sh.

Stay safe

• Never use chmod 777. It lets every user and every program on the machine change or replace the file. If something "only works with 777", the real problem is usually the owner; fix that with chown.
• Keep secrets at 600. SSH private keys, .env files and password files should be readable by you alone. SSH refuses to use a private key that others can read.
• Be careful with -R. chmod -R and chown -R change every file below a folder. Check the path, and never run them on / or a system folder.
• No curl … | sudo bash. Piping a script from the internet straight into a root shell runs code you have not read with full control of your machine. Download it, read it, then decide.
• Do not work as root. Use sudo for one command at a time rather than a root shell, so every step with full control is a deliberate one.

Try it in a Dhiva Labs app

• SysVitals is installed by making a downloaded script executable with chmod +x sysvitals.py, then running ./sysvitals.py. It shows full drive health only when started with sudo, which is a good example of a tool that needs root for one specific thing.
• DhivaLabs Shell on Windows treats sudo differently: typing sudo on its own opens a separate administrator Bash window after the Windows consent prompt.
• When you set up SSH keys with DhivaLabs Shell or SecureShell Go, keep the private key private, as above.

Check yourself

QuizPermissions

Question 1 of 6

ls -l shows -rw-r----- 1 sam staff 120 notes.txt. Who can read the file?

Score: 0

What you learned

• Every file has an owner, a group and permissions for owner, group and others.
• r, w and x mean read, write and execute; on a folder, x lets you enter it.
• chmod u+x and chmod 755 are two ways of setting permissions; r is 4, w is 2, x is 1.
• chown changes the owner, and only root can do it.
• sudo is for changing the system, one command at a time, never to silence an error.
• A script needs a shebang line and the execute permission, and runs as ./script.

Next steps

• Lesson 4: Processes and ports
• Install SysVitals