Files and permissions
Lesson 3 of 11
3Files and permissions
What the picture shows: Nine letters flip with each chmod command: three for the owner, three for the group, three for everyone else.
If you read rwxr-xr-x fluently, jump to the exercises. Everyone else starts at the picture.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Picture a notebook with three signs: one for its owner, one for the family, one for visitors. Each sign says: may you read it? write in it? use it? When the computer says "denied", it read the sign that applies to you and found that box empty.
Every file has an owner user, a group and others, and each has three permissions: r read, w write, x execute. They are written as numbers by adding 4, 2 and 1, so chmod 755 means rwxr-xr-x. chown changes the owner, and a script will not run as ./script.sh without x.
Before You Start
📟The shell lesson
You know cd, ls and touch.
👥The idea of a user
Everyone who logs into a machine has a username, and that user owns the files they create.
The Core Idea
1Three classes and three actions
Every file has one owner, a group of users, and everyone else, the "others". Each class has three actions: read r, write w, execute x.
Follow the picture, then run the code: stat -c %A prints the nine letters. A new file usually comes as rw-r--r--: the owner reads and writes, everyone else only reads.
chmod 600 made it the owner's alone, and chmod u+x added execute for the owner only. A dash means "no".
touch note.txt stat -c "%A" note.txt chmod 600 note.txt stat -c "%A" note.txt chmod u+x note.txt stat -c "%A" note.txt
Output:
-rw-r--r-- -rw------- -rwx------
2The numbers: r=4, w=2, x=1
Each class is one number, the sum of what it holds: 7 means rwx, 6 means rw-, 5 means r-x, 4 means r-- only. Three digits for the three classes.
644 is the ordinary file: owner reads and writes, the rest read. 755 is the program: everyone runs, only the owner edits. 600 is for secrets.
You can also write letters: u for owner, g for group, o for others, with + or -. Numbers are faster; letters are clearer for a small change.
3Why your file will not run
A text file full of commands does not become a program until it carries the execute permission. Without it the system refuses with Permission denied even when the file is perfectly correct.
test -x asks: can I run this? Run the code and watch the answer change after chmod u+x. This is the first thing to check when a script "does not work".
printf '#!/bin/bash\necho "it runs"\n' > run.sh test -x run.sh && echo "executable" || echo "not executable yet" chmod u+x run.sh test -x run.sh && echo "executable" || echo "not executable yet" ./run.sh
Output:
not executable yet executable it runs
4Protection works both ways
Take read permission away from your own file and you cannot read it until you give it back. A permission is a rule the system applies to everyone, owner included.
That is why Permission denied messages are not faults: they are the system doing what it was told. Read the permissions first before assuming another bug.
mkdir locked touch locked/secret.txt chmod 000 locked/secret.txt cat locked/secret.txt chmod 400 locked/secret.txt cat locked/secret.txt && echo "(empty file, readable again)"
Output:
cat: locked/secret.txt: Permission denied (empty file, readable again)
How It Works, Step by Step: What happens when you open a file
The program sends an open request to the kernel, saying what it wants: read or write.
The kernel checks who you are: the owner, in the group, or one of the others.
It compares your request with the three letters for your class.
It allows, or refuses with Permission denied. No exceptions except for the administrator, root.
Worked example
backup.sh and want you and your group colleagues to run it, nobody but you to edit it, and strangers not even to read it. The answer: chmod 750 backup.sh, that is rwx for the owner, r-x for the group, nothing for others.Myth vs Reality
| Myth | Reality |
|---|---|
| Permissions are for servers only. | Every file on your machine carries them right now, and they cause most of the refusals you will see while learning. |
| chmod 777 fixes any problem. | It fixes it by opening the file to everyone for reading, writing and running, which creates a bigger security problem. Give the least that is needed. |
| The owner can always do anything. | The owner can change the permissions, but is bound by them while they stand. Take read away from yourself and you cannot read. |
Try it yourself
A file has permissions rw-r-----. Who can read it?
The first three rw- are the owner's: read and write. The middle r-- is the group's: read only. The last --- is others: nothing. In numbers that is 640.
Quick review cards
rwx mean?chmod u+x fixes it.Check Your Understanding
What is the difference between chmod 644 and chmod 755?
The second adds execute for all three classes; the first is for ordinary files, the second for programs and scripts.
Why is 600 right for a file holding a password?
Because it stops the group and others from reading entirely, so only the owner sees it.
Is execute permission enough for a script to run?
It is enough to be allowed, but the script also needs a first line naming the program that runs it, which you will see in the script lesson.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Articles1
Done with this lesson?
Sign in to save your progress.