# Debian Permissions

File permissions control who can read, write, and execute. Three types: owner (user), group, others. Each has three permissions: read (r=4), write (w=2), execute (x=1).

## Octal Notation

Permissions are summed: `rwx = 4+2+1 = 7`. Set with `chmod`:

```bash
chmod 755 file
```

This gives: owner 7 (rwx), group 5 (r-x), others 5 (r-x).

Common modes:
- `755` — owner full, others read+execute (programs)
- `644` — owner write, others read (files)
- `700` — owner only (private)
- `600` — owner read+write only (secrets)

## Symbolic Notation

More readable, no need to memorize numbers:

```bash
chmod u+x file          # add execute for owner
chmod g-w file          # remove write for group
chmod o-r file          # remove read for others
chmod a+r file          # add read for all
```

## Changing Ownership

```bash
chown owner:group file
chown -R owner:group directory   # recursive
```

## Directory Permissions

Execute (x) on a directory means you can enter it. Read (r) means you can list contents. Both often needed:

```bash
chmod 755 directory
```

## Default Permissions

`umask` sets defaults for new files (subtracted from 666 for files, 777 for dirs):

```bash
umask 0022
```

Result: files get 644 (666-022), directories get 755 (777-022). Set in `~/.bashrc` for persistence.

## Viewing Permissions

```bash
ls -l file
```

Output: `-rw-r--r-- 1 user group 1024 Jan 1 10:00 file`

First character is type (- for file, d for directory, l for link). Next 9 are permissions: owner, group, others.

## Special Permissions

- `setuid` (4000) — run as file owner, not executor
- `setgid` (2000) — new files inherit group
- `sticky` (1000) — only owner can delete (common on `/tmp`)

```bash
chmod 4755 file          # setuid + rwxr-xr-x
chmod 1777 /tmp          # sticky on /tmp
```

Always prefer explicit permissions over special bits when possible.