Linux File Permissions: chmod, chown, umask & ACLs

-rwxr-xr-- 1 alice devs 4096 Apr 12 10:00 deploy.sh
│└┬┘└┬┘└┬┘
│ │  │  └── others:  r-- (read only)
│ │  └───── group:   r-x (read + execute)
│ └──────── owner:   rwx (read + write + execute)
└────────── file type: - (regular file), d (directory), l (symlink)

Permission values:
  r (read)    = 4
  w (write)   = 2
  x (execute) = 1

Octal sum per group:
  rwx = 4+2+1 = 7
  r-x = 4+0+1 = 5
  r-- = 4+0+0 = 4
  → 754 in octal notation

# Common octal permission values
chmod 755 script.sh    # rwxr-xr-x — executable by everyone, writable by owner
chmod 644 config.yaml  # rw-r--r-- — readable by everyone, writable by owner
chmod 600 id_ed25519   # rw------- — owner only (SSH private keys)
chmod 700 .ssh/        # rwx------ — owner only (SSH directory)
chmod 666 shared.txt   # rw-rw-rw- — readable/writable by everyone (rarely correct)
chmod 400 secrets.env  # r-------- — read-only by owner

# Recursive — apply to all files and directories
chmod -R 755 /var/www/html/

# Symbolic format: [ugoa][+-=][rwxXsst]
# u=owner, g=group, o=others, a=all

# Add execute permission for the owner
chmod u+x deploy.sh

# Remove write permission from group and others
chmod go-w config.yaml

# Set exact permissions — owner rw, group r, others nothing
chmod u=rw,g=r,o= secret.conf

# Add execute only to directories (capital X)
chmod -R a+X /var/www/    # Adds execute to dirs but not files

# Make a file immutable to group write
chmod g-w important.log

# Multiple operations in one command
chmod u+rwx,g+rx,o-rwx deploy.sh

# Change owner
sudo chown alice deploy.sh

# Change owner and group
sudo chown alice:devs deploy.sh

# Change group only (note the colon)
sudo chown :devs deploy.sh

# Alternative: change group with chgrp
sudo chgrp devs deploy.sh

# Recursive — change ownership of all contents
sudo chown -R www-data:www-data /var/www/html/

# Common pattern: set web server ownership
sudo chown -R nginx:nginx /usr/share/nginx/html/

# View current umask
umask         # e.g., 0022
umask -S      # symbolic: u=rwx,g=rx,o=rx

# How umask works:
#   Files:       666 - 022 = 644 (rw-r--r--)
#   Directories: 777 - 022 = 755 (rwxr-xr-x)

# Common umask values
umask 022   # Default — files 644, dirs 755 (readable by all)
umask 027   # Restrictive — files 640, dirs 750 (no access for others)
umask 077   # Private — files 600, dirs 700 (owner only)

# Set in shell profile (~/.bashrc or ~/.zshrc) for persistence
echo 'umask 027' >> ~/.bashrc

# Temporary umask for a single command
(umask 077 && touch secret.key)  # Created with 600 permissions

# SUID — the 's' in owner execute position
chmod u+s /usr/bin/passwd
ls -l /usr/bin/passwd
# -rwsr-xr-x  ← 's' means SUID is set

# SGID on a directory — new files inherit group
chmod g+s /shared/projects/
ls -ld /shared/projects/
# drwxrwsr-x  ← 's' in group execute position

# Sticky bit — commonly set on /tmp
chmod +t /tmp/
ls -ld /tmp/
# drwxrwxrwt  ← 't' in others execute position

# Using octal — prepend the special bit
chmod 4755 program       # SUID + rwxr-xr-x
chmod 2775 shared-dir/   # SGID + rwxrwxr-x
chmod 1777 /tmp/         # Sticky + rwxrwxrwx

# Find all SUID files on the system (security audit)
find / -perm -4000 -type f 2>/dev/null

# View ACLs on a file
getfacl project/

# Grant read+write to a specific user
setfacl -m u:bob:rw project/report.txt

# Grant read to a specific group
setfacl -m g:auditors:r project/report.txt

# Set default ACL on a directory (inherited by new files)
setfacl -d -m g:devs:rwx /shared/code/

# Remove a specific ACL entry
setfacl -x u:bob project/report.txt

# Remove all ACLs (revert to standard permissions)
setfacl -b project/report.txt

# Recursive — apply ACL to all existing contents
setfacl -R -m g:devs:rwx /shared/code/

# The '+' in ls -l indicates ACLs are present
ls -l report.txt
# -rw-rw-r--+ 1 alice devs 1024 Apr 12 10:00 report.txt