Understand and change Linux file permissions

Set up a practice area

This guide works on Ubuntu 24.04 LTS and AlmaLinux 9. Log in as an ordinary user and create a new folder in your home directory. If that folder already exists, choose a different name before continuing. The examples change only files you own.

The id command shows your user and group memberships. Files created in this exercise should belong to your account; you do not need sudo to change their mode.

id
mkdir "$HOME/glws-permissions-lab"
cd "$HOME/glws-permissions-lab"
printf 'Private practice note\n' > notes.txt
ls -l notes.txt

Read the permission string

A long listing might begin with -rw-r--r--. The first character identifies the file type: - means a regular file and d means a directory. The next three groups describe the owner, the file's group, and everyone else.

Each group uses r for read, w for write, and x for execute; a dash means that permission is absent. For a regular file, execute permits running it as a program. For a directory, read permits listing names, execute permits traversing the path, and write permits creating or removing directory entries.

Make the note private

The mode 600 grants read and write to the owner and no permissions to the group or others. After changing notes.txt, expect its listing to start with -rw-------. It remains readable by you. Privileged administrators can still access it.

Numeric modes add read=4, write=2, and execute=1 for each of the three groups. Thus 6 means read plus write. Another common regular-file mode is 644, which allows other users to read the file.

chmod 600 notes.txt
ls -l notes.txt
cat notes.txt

Choose directory access separately

Create a private directory with mode 700. Its owner can list, enter, and modify it, while other ordinary users receive no access through these mode bits. A typical shared-readable directory uses 755 instead.

Symbolic changes are useful when you want to alter one permission without replacing all the others. The example adds owner execute to a small script. Run it through the path shown and expect a single OK line.

mkdir private
chmod 700 private
printf '#!/bin/sh\nprintf "OK\\n"\n' > check.sh
chmod u+x check.sh
./check.sh
ls -ld private

Diagnose permission denied

Check both the file and each containing directory: a readable file is inaccessible if you cannot traverse its parent. Match permissions to the account actually using the file, such as a web-service account. Additional controls, including ACLs and AlmaLinux SELinux policy, can also deny access even when basic mode bits look correct.

ls -ld .
ls -l notes.txt