File permissions control who can read, write, and execute. Three types: owner (user), group, others. Each has three permissions: read (r=4), write (w=2), execute (x=1).

Permissions are summed: rwx = 4+2+1 = 7. Set with chmod:

chmod 755 file

This gives: owner 7 (rwx), group 5 (r-x), others 5 (r-x).

Common modes: - 755 — owner full, others read+execute (programs) - 644 — owner write, others read (files) - 700 — owner only (private) - 600 — owner read+write only (secrets)

More readable, no need to memorize numbers:

chmod u+x file          # add execute for owner
chmod g-w file          # remove write for group
chmod o-r file          # remove read for others
chmod a+r file          # add read for all

chown owner:group file
chown -R owner:group directory   # recursive

Execute (x) on a directory means you can enter it. Read ® means you can list contents. Both often needed:

chmod 755 directory

umask sets defaults for new files (subtracted from 666 for files, 777 for dirs):

umask 0022

Result: files get 644 (666-022), directories get 755 (777-022). Set in ~/.bashrc for persistence.

ls -l file

Output: -rw-r--r-- 1 user group 1024 Jan 1 10:00 file

First character is type (- for file, d for directory, l for link). Next 9 are permissions: owner, group, others.

• setuid (4000) — run as file owner, not executor
• setgid (2000) — new files inherit group
• sticky (1000) — only owner can delete (common on /tmp)

chmod 4755 file          # setuid + rwxr-xr-x
chmod 1777 /tmp          # sticky on /tmp

Always prefer explicit permissions over special bits when possible.