Linux File Permissions: chmod, chown, chgrp, umask, SUID, SGID and Sticky Bit Explained

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a family photo album

Why do we need this?

Aai keeps the family album. She can look at it, add photos and remove them. The family (Baba, kids) can look at it and add photos, but not remove them. Guests can only look. The album on the living room table is shared, but each person may take out only the photos they put in.

What is it?

Aai = owner (user). Family = group. Guests = others. Look = read (r). Add or remove = write (w). Opening the album = execute (x) on a folder. Shared table rule = sticky bit, like /tmp.

How to do it (step by step)

2. ls -l: read the permission string

Why do we need this?

Every 'Permission denied' starts by reading these 10 characters.

What is it?

-rwxr-x--- means: type (- file, d folder, l link), then owner rwx, group r-x, others ---. Then the link count, owner, group, size, date and name. ls -ld FOLDER shows the folder itself, not its contents. ls -n shows numbers instead of names.

How to do it (step by step)

1. A script.

ls -l deploy.sh

Output:

-rwxr-x--- 1 ravi devs 812 Oct 25 10:10 deploy.sh

What it means: ravi full, devs read and run, others nothing.

2. A folder itself.

ls -ld /srv/shared

Output:

drwxrwsr-x 2 root devs 4096 Oct 25 10:12 /srv/shared

What it means: s in group x place = SGID (covered below).

3. Numbers, not names.

ls -ln deploy.sh

Output:

-rwxr-x--- 1 1001 3001 812 Oct 25 10:10 deploy.sh

What it means: Useful when a user was deleted.

3. r, w, x on files vs folders

Why do we need this?

People give r on a folder and wonder why cd fails. The meaning changes for folders.

What is it?

File: r read content, w change content, x run it as a program. Folder: r list names (ls), w create, delete or rename entries inside, x enter it and reach files inside (cd, open by path). To delete a file you need w on the FOLDER, not on the file.

How to do it (step by step)

1. Folder with r but no x.

chmod 744 box && sudo -u priya ls box; sudo -u priya cat box/a.txt

Output:

ls: cannot access 'box/a.txt': Permission denied
a.txt
cat: box/a.txt: Permission denied

What it means: She sees names but cannot open them.

2. Folder with x but no r.

chmod 711 box && sudo -u priya ls box; sudo -u priya cat box/a.txt

Output:

ls: cannot open directory 'box': Permission denied
hello

What it means: She cannot list, but can open a known name.

3. Deleting needs w on the folder.

ls -ld /etc && rm /etc/passwd-test

Output:

dr-xr-xr-x. ... root root /etc
rm: cannot remove '/etc/passwd-test': Permission denied

What it means: The file's own bits do not matter here.

4. chmod with numbers (octal)

Why do we need this?

Numbers set all three groups at once and are what docs and tickets use: 644, 755, 600.

What is it?

r=4, w=2, x=1. Add them per set: 7=rwx, 6=rw-, 5=r-x, 4=r--, 0=---. Three digits are owner, group, others. A fourth digit in front sets special bits (4 SUID, 2 SGID, 1 sticky). -R changes a whole tree (careful).

How to do it (step by step)

1. Make a key private.

chmod 600 ~/.ssh/id_ed25519 && ls -l ~/.ssh/id_ed25519

Output:

-rw------- 1 ravi ravi 411 Oct 25 id_ed25519

What it means: SSH refuses keys that others can read.

2. A script everyone can run.

chmod 755 backup.sh && ls -l backup.sh

Output:

-rwxr-xr-x 1 ravi ravi 540 Oct 25 backup.sh

What it means: 7 owner, 5 group, 5 others.

3. Config readable by the app group.

sudo chmod 640 /etc/billing/db.conf && ls -l /etc/billing/db.conf

Output:

-rw-r----- 1 root billing 210 Oct 25 db.conf

What it means: Others cannot see the DB password.

4. Never do this.

chmod -R 777 /var/www

Output:

(no output)

What it means: Anyone can change your site. Use 755 folders and 644 files.

5. chmod with letters (symbolic)

Why do we need this?

Often you want to add or remove one right without touching the rest, like making a script runnable.

What is it?

Who: u owner, g group, o others, a all. Action: + add, - remove, = set exactly. What: r w x, X (x only on folders or files already executable), s, t. You can combine: chmod u=rwx,g=rx,o= file.

How to do it (step by step)

1. Make a script runnable.

chmod u+x run.sh && ls -l run.sh

Output:

-rwxr--r-- 1 ravi ravi 120 Oct 25 run.sh

What it means: Only the owner gets x.

2. Remove rights for others.

chmod o-rwx salary.xlsx && ls -l salary.xlsx

Output:

-rw-r----- 1 hr hr 88K Oct 25 salary.xlsx

What it means: Others lose everything.

3. Set exactly.

chmod u=rw,g=r,o= report.pdf && stat -c '%A %a' report.pdf

Output:

-rw-r----- 640

What it means: = replaces old bits for that set.

4. Fix a web tree in one command.

chmod -R u=rwX,g=rX,o=rX /var/www/site

Output:

(no output)

What it means: Capital X gives x to folders only, so files stay 644 and folders 755.

ls -l plan.txt

-rw-r--r-- 1 arjun team 900 Oct 25 plan.txt

chmod g+w plan.txt && stat -c %a plan.txt

664

chmod 640 plan.txt && ls -l plan.txt

-rw-r----- 1 arjun team 900 Oct 25 plan.txt

chmod u=rw,g=r,o= plan.txt && stat -c %a plan.txt

640

6. stat: exact permissions and times

Why do we need this?

ls hides the number and some details. stat shows the octal mode, owner IDs and all three times.

What is it?

stat FILE prints size, inode, mode, UID/GID and access/modify/change times. stat -c '%a %U %G %n' prints a custom line: %a octal, %A letters, %U owner, %G group.

How to do it (step by step)

1. Full details.

stat /etc/passwd | sed -n '1p;4p'

Output:

  File: /etc/passwd
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

What it means: 0644 in numbers.

2. Short form for many files.

stat -c '%a %U:%G %n' /etc/shadow /etc/sudoers

Output:

0 root:root /etc/shadow
440 root:root /etc/sudoers

What it means: Great for audits.

7. chown: change owner and group

Why do we need this?

Files copied as root, uploads by the web server, or restored backups end up with the wrong owner and the app cannot write.

What is it?

sudo chown USER FILE changes owner. chown USER:GROUP FILE changes both. chown :GROUP FILE only group. -R for a tree. --reference=OTHER copies owner from another file. Only root can give files away.

How to do it (step by step)

1. Give the app folder to the app user.

sudo chown -R deploy:deploy /srv/app && ls -ld /srv/app

Output:

drwxr-xr-x 5 deploy deploy 4096 Oct 25 /srv/app

What it means: Everything inside now belongs to deploy.

2. Owner and group for uploads.

sudo chown nginx:www /srv/app/uploads

Output:

(no output)

What it means: The web server can write uploads.

3. Normal user cannot give away.

chown priya notes.txt

Output:

chown: changing ownership of 'notes.txt': Operation not permitted

What it means: Only root can change the owner.

4. Copy ownership from another file.

sudo chown --reference=/etc/nginx/nginx.conf /etc/nginx/conf.d/shop.conf

Output:

(no output)

What it means: Same owner and group as nginx.conf.

ls -l /srv/blog/index.html

-rw-r--r-- 1 root root 2.1K Oct 25 /srv/blog/index.html

sudo chown -v www-data:www-data /srv/blog/index.html

changed ownership of '/srv/blog/index.html' from root:root to www-data:www-data

sudo chown :editors /srv/blog/drafts && ls -ld /srv/blog/drafts

drwxrwxr-x 2 www-data editors 4096 Oct 25 /srv/blog/drafts

sudo chown -Rc www-data:www-data /srv/blog

changed ownership of '/srv/blog/drafts' from www-data:editors to www-data:www-data

8. chgrp: change only the group

Why do we need this?

A team folder must belong to the team group so all members get group rights.

What is it?

chgrp GROUP FILE changes the group. A normal user can do it if they own the file and are a member of the new group. -R for a tree.

How to do it (step by step)

1. Hand a report to finance.

chgrp finance q3.xlsx && ls -l q3.xlsx

Output:

-rw-r----- 1 ravi finance 40K Oct 25 q3.xlsx

What it means: Finance members can now read it.

2. Not a member.

chgrp hr q3.xlsx

Output:

chgrp: changing group of 'q3.xlsx': Operation not permitted

What it means: You must be in hr, or use sudo.

9. umask: default rights for new files

Why do we need this?

Files created by an app or a user get rights from umask. A wrong umask makes secrets world-readable, or team files unreadable.

What is it?

New files start from 666, folders from 777, and the umask bits are removed. umask 022 gives 644 files and 755 folders. umask 027 gives 640 and 750. umask 077 gives 600 and 700. umask -S shows letters. Set it in ~/.bashrc, /etc/login.defs or a systemd unit (UMask=).

How to do it (step by step)

1. Check your umask.

umask; umask -S

Output:

0022
u=rwx,g=rx,o=rx

What it means: The usual default.

2. See it in action.

umask 077; touch secret.txt; mkdir private; ls -ld secret.txt private

Output:

-rw------- 1 ravi ravi 0 secret.txt
drwx------ 2 ravi ravi 4096 private

What it means: Only you can touch them.

3. Team-friendly umask.

umask 002; touch shared.txt; ls -l shared.txt

Output:

-rw-rw-r-- 1 ravi devs 0 shared.txt

What it means: Group can write too.

4. Set it for a service.

sudo systemctl edit billing  # add: [Service] UMask=0027

Output:

(editor opens)

What it means: Files the service writes get 640.

10. SUID (4000): run as the file owner

Why do we need this?

passwd must write /etc/shadow, which only root can. SUID lets a normal user run it with root's power, only for that program.

What is it?

SUID on an executable makes it run with the owner's UID. It shows as s in the owner x place (S if x is missing). Set with chmod u+s or chmod 4755. It is ignored on scripts and on file systems mounted nosuid. Every extra SUID binary is an attack target: audit them.

How to do it (step by step)

1. The classic example.

ls -l /usr/bin/passwd

Output:

-rwsr-xr-x. 1 root root 32648 /usr/bin/passwd

What it means: s: it runs as root for every user.

2. Find all SUID files.

sudo find / -xdev -perm -4000 -type f 2>/dev/null | head -4

Output:

/usr/bin/passwd
/usr/bin/sudo
/usr/bin/su
/usr/bin/mount

What it means: Compare with a known-good list.

3. Remove SUID from a risky copy.

sudo chmod u-s /opt/tools/oldping && ls -l /opt/tools/oldping

Output:

-rwxr-xr-x 1 root root 7k oldping

What it means: No longer runs as root.

11. SGID (2000): group inheritance

Why do we need this?

In a team folder, files made by each person get their own group, and teammates cannot edit them. SGID on the folder fixes this.

What is it?

On a folder, SGID makes new files and folders inside take the folder's group (new sub-folders get SGID too). On a program, it runs with the file's group. Shows as s in the group x place. Set with chmod g+s or chmod 2775.

How to do it (step by step)

1. Create a team folder.

sudo mkdir /srv/devs && sudo chgrp devs /srv/devs && sudo chmod 2775 /srv/devs && ls -ld /srv/devs

Output:

drwxrwsr-x 2 root devs 4096 Oct 25 /srv/devs

What it means: s in the group part.

2. New files get the team group.

touch /srv/devs/plan.md && ls -l /srv/devs/plan.md

Output:

-rw-rw-r-- 1 ravi devs 0 Oct 25 plan.md

What it means: Group is devs, not ravi.

3. Pair with umask 002.

umask 002; echo hi > /srv/devs/notes.txt; ls -l /srv/devs/notes.txt

Output:

-rw-rw-r-- 1 ravi devs 3 notes.txt

What it means: Teammates can edit.

12. Sticky bit (1000): only owners delete

Why do we need this?

In a folder everyone can write, like /tmp, anyone could delete anyone's files. The sticky bit stops that.

What is it?

On a folder, sticky means only the file owner, the folder owner or root can delete or rename a file. Shows as t in the others x place. Set with chmod +t or chmod 1777.

How to do it (step by step)

1. See it on /tmp.

ls -ld /tmp

Output:

drwxrwxrwt. 18 root root 4096 Oct 25 /tmp

What it means: t at the end.

2. A shared upload folder.

sudo mkdir /srv/drop && sudo chmod 1777 /srv/drop

Output:

(no output)

What it means: Everyone can add, only owners can remove.

3. Try deleting someone else's file.

sudo -u priya rm /srv/drop/ravi.txt

Output:

rm: cannot remove '/srv/drop/ravi.txt': Operation not permitted

What it means: The sticky bit protected it.

13. Putting it together: safe permission recipes

Why do we need this?

Most real tasks are the same few patterns. Learn them once.

What is it?

Web root: owner deploy, group nginx, folders 2750, files 640. SSH: ~/.ssh 700, keys 600, authorized_keys 600. Secrets: 600 or 640 with an app group. Team share: SGID 2775 plus umask 002. Shared drop: 1777.

How to do it (step by step)

1. Fix SSH folder rights.

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys && stat -c '%a %n' ~/.ssh ~/.ssh/authorized_keys

Output:

700 /home/ravi/.ssh
600 /home/ravi/.ssh/authorized_keys

What it means: sshd ignores keys if these are too open.

2. Web root recipe.

sudo chown -R deploy:nginx /srv/www && sudo find /srv/www -type d -exec chmod 2750 {} + && sudo find /srv/www -type f -exec chmod 640 {} +

Output:

(no output)

What it means: nginx can read, only deploy can write.

3. Find world-writable files to fix.

sudo find /srv -xdev -type f -perm -o+w

Output:

/srv/www/config.php

What it means: Fix with chmod o-w.

14. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

15. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

16. Troubleshooting step by step

Why do we need this?

For 'Permission denied', walk the path from / to the file and check the user, the group and each bit.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Who is the process running as?

ps -o user,group,comm -C nginx

2. Check every folder on the path.

namei -l /srv/www/site/index.html

3. Exact mode and owner of the file.

stat -c '%A %a %U:%G' /srv/www/site/index.html

4. Is it a group problem?

id nginx

5. Test as that user.

sudo -u nginx cat /srv/www/site/index.html

6. Still denied? Check ACLs and SELinux.

getfacl /srv/www/site/index.html; ls -Z /srv/www/site/index.html

17. Lab 1: Build a team share

Why do we need this?

Create a folder where every devs member can create and edit files, but others cannot see it.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create users and group.

sudo groupadd -f devs && sudo useradd -m -G devs dev1 && sudo useradd -m -G devs dev2

Output:

(no output)

2. Create the folder with SGID.

sudo mkdir -p /srv/team && sudo chgrp devs /srv/team && sudo chmod 2770 /srv/team && ls -ld /srv/team

Output:

drwxrws--- 2 root devs 4096 Oct 25 /srv/team

3. dev1 creates a file.

sudo -u dev1 bash -c 'umask 002; echo v1 > /srv/team/plan.txt' && ls -l /srv/team

Output:

-rw-rw-r-- 1 dev1 devs 3 plan.txt

4. dev2 edits it.

sudo -u dev2 bash -c 'echo v2 >> /srv/team/plan.txt' && cat /srv/team/plan.txt

Output:

v1
v2

5. An outsider is blocked.

sudo -u nobody ls /srv/team

Output:

ls: cannot open directory '/srv/team': Permission denied

18. Lab 2: Numbers, letters, umask and special bits

Why do we need this?

Practise chmod both ways, see umask results, and find SUID and sticky bits.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Numbers.

mkdir -p ~/lab15 && cd ~/lab15 && touch a && chmod 640 a && stat -c '%A %a' a

Output:

-rw-r----- 640

2. Letters.

chmod u+x,g-r a && stat -c '%A %a' a

Output:

-rwx------ 700

3. umask 027.

(umask 027; touch b; mkdir c) && stat -c '%a %n' b c

Output:

640 b
750 c

4. Sticky folder.

mkdir d && chmod 1777 d && ls -ld d

Output:

drwxrwxrwt 2 ravi ravi 4096 d

5. SUID count.

sudo find /usr/bin -perm -4000 | wc -l

Output:

14

19. Frequently asked questions

20. Interview questions and answers

Beginner level

Mid level level

Senior level

21. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.