Linux Basics: Understanding File Permission Bits

Linux files have permission bits for their owner, their group, and everyone else. Practice with a file you create yourself before changing permissions on anything important.

Use Bash on Debian or Ubuntu. Run these examples in order in the same shell:

practice=$(mktemp -d) && cd "$practice"

Continue only if that command succeeds. All changes below apply only to the new practice file.

Start with a known mode

printf 'Practice notes\n' > notes.txt
chmod 600 notes.txt
stat -c '%A %a %n' notes.txt

-rw------- 600 notes.txt

The first character, -, identifies a regular file. The remaining characters form three groups: owner, group, and others. r means read, w means write, and x means execute. A dash means that bit is absent.

Here, the owner can read and write; the group and others have no permission bits set.

Add one permission

chmod g+r notes.txt
stat -c '%A %a %n' notes.txt

-rw-r----- 640 notes.txt

g+r adds group read permission without replacing the other ordinary permission bits. u selects the owner and o selects others.

Each numeric digit adds read (4), write (2), and execute (1). Thus 6 means read plus write, and 4 means read only.

Remove it again

chmod g-r notes.txt
stat -c '%A %a %n' notes.txt

-rw------- 600 notes.txt

chmod changes mode bits, not ownership. Avoid broad recursive changes or 777 as a shortcut for fixing an access problem.

Directory permissions work differently: execute allows searching or traversing a directory. Parent directories, access-control lists, and privileged processes can also affect actual access. These mode bits alone are not a complete security check.

The temporary directory remains private, so adding group read to this file does not by itself make the directory accessible to the group.

Clean up

rm -- notes.txt
cd / && rmdir -- "$practice"
unset practice

References

Debian chmod manual

Debian stat manual

Acknowledgements

This post was created with assistance from AI.

Linux Basics — lesson 24 of 25. Series index

Previous: Filtering and Totaling Fields with awk · Next: Writing a Small Bash Script