|$ curl https://forge-ai.dev/api/markdown?path=docs/linux/permissions
$cat docs/users-&-permissions.md
updated Recently·20 min read·published
Users & Permissions
Introduction
Linux is a multi-user operating system. Every file and directory is owned by a user and a group, and permissions control who can read, write, or execute. Misconfigured permissions are a common source of security vulnerabilities and deployment issues.
Reading Permissions
reading.sh
Bash
| 1 | ls -l app.py |
| 2 | # -rw-r--r-- 1 alice developers 1234 Jul 12 09:15 app.py |
| 3 | |
| 4 | # Breakdown: |
| 5 | # - file type (- = file, d = directory, l = symlink) |
| 6 | # rw- owner permissions |
| 7 | # r-- group permissions |
| 8 | # r-- others permissions |
| 9 | # alice owner user |
| 10 | # developers owner group |
Changing Permissions with chmod
chmod.sh
Bash
| 1 | # Numeric (octal) mode |
| 2 | chmod 755 script.sh # rwxr-xr-x |
| 3 | chmod 644 file.txt # rw-r--r-- |
| 4 | chmod 700 private.key # rwx------ |
| 5 | chmod 600 ~/.ssh/id_rsa # owner read/write only |
| 6 | |
| 7 | # Symbolic mode |
| 8 | chmod u+x script.sh # add execute for owner |
| 9 | chmod go-w file.txt # remove write for group and others |
| 10 | chmod a+r document.pdf # add read for all |
| 11 | chmod u=rwx,g=rx,o=rx dir # set exactly |
| Value | Binary | Permission |
|---|---|---|
| 7 | 111 | rwx |
| 6 | 110 | rw- |
| 5 | 101 | r-x |
| 4 | 100 | r-- |
| 0 | 000 | --- |
Changing Ownership
chown.sh
Bash
| 1 | # Change owner |
| 2 | sudo chown alice app.py |
| 3 | |
| 4 | # Change owner and group |
| 5 | sudo chown alice:developers app.py |
| 6 | |
| 7 | # Recursively change ownership |
| 8 | sudo chown -R alice:developers /var/www/app |
| 9 | |
| 10 | # Change only group |
| 11 | sudo chgrp developers app.py |
sudo & Privilege Escalation
sudo lets an authorized user run commands as root or another user. The list of allowed commands is configured in /etc/sudoers.
sudo.sh
Bash
| 1 | # Run a single command as root |
| 2 | sudo systemctl restart nginx |
| 3 | |
| 4 | # Edit a file as root |
| 5 | sudo nano /etc/hosts |
| 6 | |
| 7 | # Switch to root shell |
| 8 | sudo -i |
| 9 | |
| 10 | # Run as another user |
| 11 | sudo -u postgres psql |
⚠
warning
Never edit /etc/sudoers directly with a normal editor. Always use sudo visudo to validate syntax and avoid locking yourself out.
Special Permission Bits
special.sh
Bash
| 1 | # Setuid — run as file owner |
| 2 | chmod u+s /usr/bin/passwd |
| 3 | |
| 4 | # Setgid — run as file group; new files inherit group |
| 5 | chmod g+s /shared/projects |
| 6 | |
| 7 | # Sticky bit — only owner can delete files in directory |
| 8 | chmod +t /tmp |
| 9 | |
| 10 | # Octal examples |
| 11 | chmod 4755 script.sh # setuid |
| 12 | chmod 2750 shared/ # setgid |
| 13 | chmod 1777 /tmp # sticky |
Access Control Lists
ACLs extend traditional permissions by allowing per-user and per-group rules beyond the single owner/group/other model.
acl.sh
Bash
| 1 | # Grant read/write to a specific user |
| 2 | setfacl -m u:bob:rw report.txt |
| 3 | |
| 4 | # Grant read to a group |
| 5 | setfacl -m g:auditors:r report.txt |
| 6 | |
| 7 | # Remove an ACL entry |
| 8 | setfacl -x u:bob report.txt |
| 9 | |
| 10 | # View ACLs |
| 11 | getfacl report.txt |
| 12 | |
| 13 | # Make new files inherit default ACL |
| 14 | setfacl -d -m g:developers:rwX /shared/projects |