Linux’s permission model is older than most of its users, dating back to early Unix, but it’s precisely because it’s so simple that it’s stayed relevant for decades. Understanding it fully takes about ten minutes and pays off for the rest of your career.
Reading Permission Strings
A permission string like -rwxr-xr-- breaks into four parts: the file type, then three permission triplets for owner, group, and others. Each triplet is Read, Write, Execute, and each can be represented numerically: r=4, w=2, x=1, summed per triplet.
ls -l script.sh # -rwxr-xr-- 1 alice devs 220 Aug 21 10:03 script.sh # owner=rwx(7) group=r-x(5) others=r--(4) # Set explicit permissions with chmod chmod 750 script.sh # owner: rwx, group: r-x, others: none chmod u+x,g+x deploy.sh # symbolic form: add execute for owner and group # Change ownership chown alice:devs script.sh chown -R alice:devs /srv/app # recursively for a whole directory tree
umask: Setting Defaults
umask controls the default permissions new files get. A umask of 022 subtracts write access for group and others from the default (666 for files, 777 for directories), which is why a newly created file is typically 644 rather than fully open.
umask # 0022 touch newfile.txt && ls -l newfile.txt # -rw-r--r-- (666 - 022 = 644)
The setuid, setgid, and Sticky Bits
Beyond the basic triplets, three special bits matter for specific cases: setuid runs a binary as its owner rather than the invoking user (how passwd updates a file it doesn’t otherwise have write access to), setgid on a directory makes new files inherit its group, and the sticky bit (seen on /tmp) restricts deletion to a file’s own owner even in a world-writable directory.