Understanding File Permissions in Linux (chmod, chown Explained)

Every "permission denied" error on a Linux system traces back to this model — worth understanding properly instead of reflexively running chmod 777.

The three permission types

• r (read) — view a file's contents, or list a directory's contents.
• w (write) — modify a file, or create/delete files within a directory.
• x (execute) — run a file as a program, or cd into a directory (directories need x to be traversable at all, which surprises people).

The three "who" categories

Every file has permissions for three separate groups: the owner (a single user), the group (a set of users), and others (everyone else). Running ls -la shows all nine permission bits at once:

$ ls -la script.sh
-rwxr-xr--  1 daniel  staff  1240 Jul 20 10:15 script.sh

Reading rwxr-xr-- in three chunks of three: rwx (owner: read, write, execute), r-x (group: read, execute, no write), r-- (others: read only, no write, no execute).

chmod with numeric codes

Each permission has a value: r=4, w=2, x=1. Add them up per category to get a three-digit code.

chmod 755 script.sh   # owner: rwx, group: r-x, others: r-x — typical for an executable script
chmod 644 file.txt     # owner: rw-, group: r--, others: r-- — typical for a regular file
chmod 600 secrets.env  # owner: rw-, group: none, others: none — typical for sensitive files

chmod with symbolic notation

For targeted changes without recalculating the whole number:

chmod +x script.sh       # add execute for everyone
chmod u+w file.txt        # add write for the owner (u = user/owner)
chmod g-w file.txt        # remove write for the group
chmod o-rwx secrets.env   # remove all permissions for others

u, g, o (and a for all) combined with +, -, = and the permission letters — useful when you want to change one thing without touching the rest.

chown — changing who owns the file

chmod controls what each category can do; chown controls who is in the owner/group categories in the first place.

chown daniel file.txt           # change the owner
chown daniel:staff file.txt      # change owner and group together
chown -R daniel:staff /var/www   # recursive — apply to a directory and everything inside it

A very common real-world case: a file gets created by a root-owned process (e.g., inside Docker, or via sudo) and a regular user can no longer edit it. chown back to the right user is usually the actual fix — not chmod 777, which papers over an ownership problem with an overly permissive one.

The rule of thumb

If you find yourself reaching for chmod 777 (or chmod -R 777 on a whole directory), stop and ask who specifically needs access, and use the narrowest chmod/chown combination that grants it. It's rarely more than a couple of extra seconds of thought, and it avoids leaving a door open that outlives the reason you opened it.