Permissions and Ownership: chmod, chown and sudo
Read Linux permissions in ls -l output, change them with chmod using letters or numbers, change ownership with chown, and use sudo safely.
On this page 11 sections
Introduction
Linux was designed for many users sharing one computer, so every file records who owns it and who may read, change or run it. This protects users from each other and protects the system from accidental damage. Understanding permissions explains a whole class of errors — and is essential for running websites and servers securely.
- How to read the permission string in ls -l output.
- What read, write and execute mean for files and folders.
- How to change permissions with chmod, using letters or numbers like 755.
- How ownership, groups and sudo work.
Reading ls -l
ls -lClick Run to see what this code prints.
Take the line for hello.sh piece by piece:
| Part | Meaning |
|---|---|
| - | Type: - is a file, d a directory, l a link |
| rw- | Owner (user) permissions: read, write, no execute |
| r-- | Group permissions: read only |
| r-- | Everyone else (others): read only |
| 1 | Number of links (you can ignore this) |
| priya priya | Owner, then group |
| 40 | Size in bytes |
| Oct 24 04:06 | Last modified |
Read, Write and Execute
| Permission | On a file | On a folder |
|---|---|---|
| r (read) | View the contents | List the files inside |
| w (write) | Change the contents | Create, delete and rename files inside |
| x (execute) | Run it as a program or script | Enter it with cd and reach the files inside |
Each of the three groups — user (u), group (g) and others (o) — gets its own r, w and x. A dash means the permission is missing.
Making a Script Executable
hello.sh is a small script, but it has no x permission, so Linux will not run it:
./hello.shClick Run to see what this code prints.
chmod (change mode) adds the permission. +x adds execute for everyone:
chmod +x hello.shls -l hello.sh./hello.shClick Run to see what this code prints.
The ./ means “the file in this folder”. For safety, Linux does not look in the current folder for commands unless you say so.
You can target specific groups with letters: u user, g group, o others, a all; + adds, - removes and = sets exactly. For example, give the owner read and write, the group read, and others nothing:
chmod u=rw,g=r,o= api-key.txtstat -c "%A %a %n" api-key.txtClick Run to see what this code prints.
Numeric Permissions
Permissions are often written as three digits, one each for user, group and others. Each digit adds up read (4), write (2) and execute (1):
| Number | Letters | Typical use |
|---|---|---|
| 755 | rwxr-xr-x | Scripts, programs and folders: everyone can use them, only the owner can change them |
| 644 | rw-r--r-- | Ordinary files such as web pages: everyone can read, only the owner can change |
| 600 | rw------- | Private files such as SSH keys and passwords: only the owner |
| 700 | rwx------ | Private folders such as ~/.ssh |
chmod 755 hello.shchmod 644 api-key.txtstat -c "%A %a %n" hello.sh api-key.txt websiteClick Run to see what this code prints.
A file containing a secret should be readable only by you:
chmod 600 api-key.txtls -l api-key.txtClick Run to see what this code prints.
A file has permissions 640. What can members of its group do?
Users and Groups
id shows who you are and which groups you belong to:
idClick Run to see what this code prints.
Groups let several users share access — for example, everyone in a web-developers group can edit the website files. Permissions are enforced between users. When another account, arjun, tries to read Priya’s private file (permissions 600), Linux refuses:
sudo -u arjun cat /home/priya/api-key.txtClick Run to see what this code prints.
sudo and Ownership
System folders such as /etc belong to root, the administrator account, so normal users cannot change them:
touch /etc/my-setting.confClick Run to see what this code prints.
sudo (“superuser do”) runs one command as root, if your account is allowed to. It normally asks for your own password the first time:
sudo touch /etc/my-setting.confls -l /etc/my-setting.confClick Run to see what this code prints.
The new file belongs to root. chown (change owner) changes the owner and group, written as user:group. Changing ownership also requires sudo:
sudo chown priya:priya /etc/my-setting.confls -l /etc/my-setting.confClick Run to see what this code prints.
sudo bypasses every permission check, so a mistake made with sudo can break the whole system. Use it only for commands that genuinely need it, never “just in case”, and read commands from the internet carefully before running them with sudo.
A website shows “Permission denied” when reading its config file. A forum post says to fix it with sudo chmod -R 777 /var/www. What is wrong with this advice?
Common Mistakes
- Fixing permission errors with chmod 777 instead of setting the right owner and permissions.
- Running everything with sudo, then finding files you cannot edit because root owns them.
- Leaving private keys or password files readable by others (use 600).
- Forgetting that folders need x for anyone to cd into them.
Frequently Asked Questions
root is the administrator account, which can do anything. On Ubuntu you normally never log in as root; you use sudo for individual commands instead.
SSH refuses private keys that other users could read. Fix it with chmod 600 on the key file and chmod 700 on the ~/.ssh folder.
umask sets the default permissions for new files. On Ubuntu it is usually 0002 or 0022, which is why new files start as 664 or 644 and new folders as 775 or 755.
Key Takeaways
- ls -l shows the type, then rwx permissions for user, group and others, then owner and group.
- chmod changes permissions with letters (u+x) or numbers (755, 644, 600).
- Scripts need execute permission (chmod +x) and are run as ./script.sh.
- chown user:group changes ownership; sudo runs a single command as root.
- Never use chmod 777 as a fix — set the correct owner and permissions instead.
Summary
You can now read, set and fix permissions, and use sudo responsibly. Next you will learn to find things: files by name, size or age with find, and text inside files with grep.