2.3 Users, Permissions, and sudo

Linux is a multi-user system. Even if you are the only human using a machine, the system may contain many service users such as www-data, mysql, or nginx. Permissions decide who can read, write, and execute which files.

Reading ls -l

-rwxr-xr-- 1 leaf dev 120 Jun 11 10:00 deploy.sh

Break it apart:

• First character: file type. - is a regular file, d is a directory.
• Next 9 characters: permissions, three groups of three.
• leaf: owner.
• dev: group.
• 120: file size.
• The end shows time and filename.

The three permission groups are owner, group, and other. Each group has r, w, and x:

• r: read. For directories, list directory entries.
• w: write. For directories, create, delete, or rename entries inside.
• x: execute. For directories, enter/traverse the directory.

Two chmod styles

Symbolic style:

chmod u+x deploy.sh
chmod g-w report.txt
chmod o-r secrets.txt

Symbolic style can be read as three parts: who + how to change + which permission.

• u means owner, g means group, o means other, and a means all three groups.
• + adds a permission, - removes a permission, and = replaces the group with exactly the listed permissions.
• r is read, w is write, and x means execute for files or enter/traverse for directories.

So the three commands above mean:

• chmod u+x deploy.sh: add execute permission for the owner of deploy.sh. This is common when a script can be read and edited but cannot be run with ./deploy.sh yet.
• chmod g-w report.txt: remove write permission from the group on report.txt. Group members may still be able to read it, but they cannot modify it.
• chmod o-r secrets.txt: remove read permission from others on secrets.txt. Users who are neither the owner nor in the file's group cannot read its contents.

Numeric style:

chmod 755 deploy.sh
chmod 644 report.txt
chmod 600 secrets.txt

The digits come from r=4, w=2, and x=1. So 7=4+2+1 means rwx, and 5=4+1 means r-x.

chown, groups, and sudo

whoami
groups
sudo command
sudo chown leaf:dev file.txt

chown changes owner and group; groups shows which groups the current user belongs to; sudo runs a command with elevated privilege.

sudo is powerful and risky. It lets you bypass normal user limits, so stop and confirm before deleting, overwriting, changing permissions, or installing services.

Common permission diagnosis

• Permission denied: missing permission, or a directory lacks x.
• Script will not run: it may need execute permission, such as chmod u+x script.sh.
• Service cannot read a file: owner/group may not match the service user.
• Uploaded files have odd permissions: umask, copy method, or deployment tooling may be involved.

Do not solve every permission problem with chmod 777. That makes the file readable, writable, and executable by everyone, which is usually a security problem.