Linux Permissions & Ownership Guide

Listing Files & System Identity

ls Command Variations

ls Shows visible files and directories.
ls -a Also shows hidden files (starting with `.`).
ls -l Detailed view: permissions, owner, group, size, modification time.
ls -la Combines detailed view with hidden files.
ls -ld Lists directory entries of the specified directory, not its contents.

System Account Files

/etc/passwd Contains user account details.
/etc/group Contains group information.
/etc/shadow Stores password-related data and is protected.

Deconstructing the `ls -l` Output

A long listing gives exactly 7 columns of information for each file or directory. Here is a typical example:

-rwxr-xr-- 1 shad shared 4096 Oct 24 10:30 example.txt

1. Permission String

10 characters detailing file type and user/group/other access rights.

2. Link Count

Number of links. For directories, it's sub-directories + 2 (itself and parent).

3. Owner

The user account that owns the file.

4. Group

The group that owns the file.

5. Size

The size of the file or directory in bytes.

6. Date & Time

The date and time the file was created or last modified.

7. Name

The actual name of the file or directory.

Permissions Basics

Linux permissions are expressed with r, w, and x, and they apply separately to the owner, group, and others. Numeric permissions use octal values.

Read

Value: 4

Write

Value: 2

Execute

Value: 1

Reading an 11-character permission string -rwxr-xr--. :

- : Regular file (d for directory)
rwx : Owner can read, write, and execute (7)
r-x : Group can read and execute (5)
r-- : Others can only read (4)
. : Access method (period for SELinux, + for alternate access methods like ACLs)

Effective Permissions (How Linux Decides)

When you try to access a file, Linux calculates your effective permissions in a strict top-down order:

Are you the Owner? If yes, it applies the User permissions and stops checking.
Are you in the Group? If not the owner, but in the group, it applies the Group permissions and stops checking.
Everyone Else: If you are neither, it applies the Others permissions.

Numeric	Symbolic	Meaning / Typical Use Case
644	-rw-r--r--	Owner can read/write; group/others can read only. Used for normal files.
750	-rwxr-x---	Owner has full access; group can read/execute; others have no access.
700	-rwx------	Only the owner has full access. Used for private scripts or keys.

Modifying Permissions & Ownership

Changing Permissions: `chmod`

The chmod command changes file or directory permissions.

1. Character Mode

Use characters to Add (+), Subtract (-), or explicitly Set (=) permissions.

chmod u+w file.txt # Adds Write to User

chmod g-x script.sh # Removes Execute from Group

chmod u=rwx,g=rx app # Explicitly sets perms

chmod u+w,g-x,o+x app # Chain multiple changes

2. Numeric Mode

Add the values (Read=4, Write=2, Execute=1) for each user level.

chmod 755 app # u=7(rwx), g=5(rx), o=5(rx)

chmod 644 doc # u=6(rw), g=4(r), o=4(r)

Options

-R: Modify recursively

-v: Verbose (diagnostic entry for every file)

-c: Report changes

-f: Hide most error messages

Note: Only the owner (or root) can change permissions.

Changing Ownership: `chown` & `chgrp`

Every file has both an owner user and an owner group. Changing them usually requires sudo.

chown user file Changes the owner of a file.
chown user:group file Changes both owner and group simultaneously.
chown user: file Changes owner and automatically sets group to user's login group.
chown :group file Shortcut to change only the group.
chgrp group file Dedicated command to change only the group.

Note: Add the -R flag to recursively change ownership through a directory structure.

sudo chown chris notes.txt

sudo chown chris:developers script.sh

sudo chown :developers data.csv

Default Permissions & `umask`

When you create a new file or directory, Linux automatically assigns default permissions based on a starting "base" permission minus a subtractive mask known as the umask.

Base Permissions

Files: Start at 0666 (Read/Write for everyone)
Directories: Start at 0777 (Read/Write/Execute for everyone)

Typical User Defaults

Root User: umask 0022 → Files 644, Dirs 755
Regular User: umask 0002 → Files 664, Dirs 775

Calculating effective defaults (Base 666 - Umask 002):

Base File: 666 (rw-rw-rw-)

Subtract Umask: 002 (-------w-)

Result: 664 (rw-rw-r--)

Configuring Umask

Running umask by itself displays your current mask. Running umask 0027 changes it for the current session. To make the change permanent, it must be added to a configuration file:

System-wide: Set in /etc/profile, /etc/bash.bashrc, or /etc/pam.d/common-session
User-specific: Add umask 0027 to the bottom of your ~/.bashrc (which gets its initial copy from /etc/skel).

Special Permissions (SUID, SGID, Sticky Bit)

Special permissions are used in place of the execute permission (x). They allow users or groups to execute files with privileges they wouldn't normally have, or provide special restrictions on directories.

"Thinking of it as a 'role' is the exact right mindset for a DevOps engineer. You are not just getting the ability to run the file; you are temporarily putting on the 'ID badge' of the file's owner (SUID) or the file's group (SGID) for the exact duration of that program. Once the program finishes, you go right back to being your normal user."

SUID (Set Owner User ID)

Applied to the Owner. When an executable file has SUID set, a user executing it temporarily inherits the permissions of the file's owner.

Command: chmod u+s file
Appearance: Replaces the user's x with an s (e.g., -rwsr-xr-x).
Real-world Use: The passwd command is owned by root and has SUID set. This allows normal users to temporarily gain root privileges just long enough to change their password in the protected /etc/shadow file.
Note: Linux completely ignores SUID on directories.

SGID (Set Group ID)

Applied to the Group. Can be used on files (similar to SUID but for group permissions) but is considered a DevOps Superpower when applied to directories.

Command: chmod g+s directory
Appearance: Replaces the group's x with an s (e.g., drwxrws---).
Real-world Use: Setting SGID on a shared team folder ensures that any new files created inside it automatically inherit the directory's group ownership (e.g., devteam) rather than the creator's primary personal group. This guarantees the whole team can collaborate on new files without permission issues.

Sticky Bit

Applied to Others. Used almost exclusively on directories that give write access to everyone, to prevent users from deleting each other's work.

Command: chmod o+t directory
Appearance: Replaces others' x with a t (e.g., drwxrwxrwt).
Real-world Use: The /tmp directory has the sticky bit set. Anyone can write files to it, but you are only permitted to delete or rename files that you personally own.

Broken Permissions: Lowercase vs. Uppercase

If you ever see a capital S (or T for sticky bit) instead of a lowercase one, it is a visual warning from Linux that the configuration is broken. It means the special permission was applied, but the underlying execute (x) permission is missing. Special execution rules cannot work if the file isn't allowed to be executed in the first place!

File Attributes: `lsattr` & `chattr`

While permissions control who can access a file, attributes control how the operating system manages the file. Attributes can override standard permissions. For example, an attribute can make a file completely undeletable, even by users who otherwise have full write permissions.

lsattr

Lists the attributes of files or directories.

lsattr [ -RVadv ] [files]

-R: Recursively list attributes
-a: List all files (including hidden)
-d: List directories like files

chattr

Changes the attributes of files or directories.

chattr {+|-|=}[attrs] [files]

+: Add attributes
-: Remove attributes
=: Set exactly these attributes

The Immutable Flag (`i`)

This is the most critical attribute for a DevOps engineer to know. When the immutable flag is set on a file, it cannot be modified, deleted, renamed, or linked to. This applies even if the file's standard permissions give you write access.

It is heavily used to protect critical configuration files from accidental or malicious modification. Modifying this attribute requires root privileges (using sudo).

# Make a configuration file immutable

sudo chattr +i config.yaml

# Verify the attribute (you will see an 'i' in the output)

lsattr config.yaml ----i---------e---- config.yaml

# Make it editable again

sudo chattr -i config.yaml

Other Notable Attributes

Attribute	Name	Description
e	Block extents	File is stored using block extents (contiguous data blocks). Often enabled by default on modern filesystems.
a	Append only	File can only be opened for writing in append mode. Existing data cannot be overwritten. Excellent for log files.
s	Secure deletion	If deleted, its data is overwritten with zeroes (secure wipe).
u	Undeletable	When deleted, contents are saved to allow for later undeletion using recovery tools.

File Systems & Standard Directories

File Systems & Mount Points

Similar to how a dresser uses drawers to organize clothing, a hard drive uses directories to organize files. Drives are divided into partitions, and each partition contains a file system (a method for storing files).

lsblk Lists all disks and partitions.
lsblk -f Shows the different file systems and mount points in the drives.
/ The root directory. Every directory is a subdirectory of the root. A mount point is a directory through which we access the space on a partition.

System Directories

Standard directories in the root belong to the OS and are protected.

/bin Essential command line utilities and binaries.
/dev Hardware and software device drivers.
/etc Basic configuration files.
/lib Shared program libraries required by the kernel and binaries.
/media Access to temporary and removable file systems (CD-ROMs, etc).
/sbin Binaries for booting and root user administration.
/var System logs, printer spools, network service configs.

User Directories

Each user has an assigned folder in /home named with their user account.

/home/user Area where the user can create subdirectories and work with files. Other users cannot access it by default.
Desktop/ Directory representing the desktop environment for the user.
Documents/ Default save location for most applications.
Downloads/ Default directory for files downloaded from the Internet.

Identity Management (Users & Groups)

The root User

Every Linux system has at least one system administrator whose job is to maintain the system and make it available to users. This user is the root user. The root user can perform any task on the Linux system without restrictions. System administrators are also responsible for adding new users to the system and for setting up their initial environment.

Core Concepts

id Displays UID, GID, and group memberships.
sudo Runs a permitted command with elevated privileges, usually as root.
Primary Group: The user's default group (GID in passwd entry).
Supplementary Group: Additional group memberships shown by id.

Management Commands

useradd -m Creates a new user and sets up their home directory.
groupadd Creates a local group.
groupdel Removes a local group.
usermod -aG Appends a supplementary group without replacing existing groups.

Creating User Accounts

A user account is a collection of information that defines a user on a system. It includes the username, password, groups, and access rights. When an account is created, it is assigned a unique User ID (UID). Usernames and UIDs must be completely unique on the computer. By default, a User Private Group (UPG) is also created with the same name as the user.

useradd vs adduser

useradd
A low-level utility. It creates the user and private group, but by default it does not create a home directory or prompt for a password. (An account with no password is disabled).
adduser
A high-level, interactive script. It automatically sets up the home directory, prompts you to set a password, and asks for optional contact information.

Special / Daemon Accounts

Some accounts aren't intended for real people, but are instead used by services or daemons (like a backup service).

They typically have a UID less than 1000 (e.g., 998).
They usually do not have a home directory.

sudo useradd -r backup_account

The -r flag creates a system account.

Default System Accounts

Numerous user accounts are created by default upon system installation to manage various background services. Some of the main default accounts include:

root bin daemon ftp sshd nfsnobody apache rpc gnome

Danger: Editing /etc/passwd directly

Linux allows adding users by editing /etc/passwd, but this is highly discouraged. Accidentally corrupting this file can prevent all logins, including the root user, requiring a full system reinstall to fix.

Deleting Users & Groups

The userdel command removes a user from the system. By default, it deletes the user account and the user private group, but does not delete the home directory.

Standard Deletion

userdel username

Retains the user's home directory. This is useful when an employee leaves, but you want to keep their files.

Complete Wipe

userdel -r username

Adding the -r option forces the removal of the user's home directory and mail spool.

Safely Deleting a User (Best Practices)

Before completely wiping a user, DevOps engineers often follow a safe off-boarding process:

Lock the account: Prevent new logins (usermod -L username).
Kill running processes: You cannot delete a user who is currently logged in.
Archive their home directory: Use the tar command to compress and save their data.
tar -czvf /archive/user_backup.tar.gz /home/username
Track Orphan Files: Files outside the home directory owned by the user will become "orphaned" (showing a raw UID instead of a name). Find them using:
find / -uid [USER_ID] -ls
Delete the user: Finally run userdel -r username.

Deleting Groups

The groupdel command removes a group. However, Linux has a safety mechanism: You cannot delete a group if it is the primary group of any existing user.

$ groupdel devteam
groupdel: cannot remove the primary group of user 'shad'

To fix this, you must either delete the user first, or assign the user to a different primary group using usermod -g newgroup shad.

Modifying User Accounts

Before modifying users, it is often helpful to view their current account information using identity utilities.

Viewing Identity Info

id or id user_name

Shows the UID, primary GID, and a list of all supplementary groups to which the user belongs.
finger user_name

Displays the user's login name, full name, home directory, and their default shell.
chage -l user_name

Lists the account and password expiration details.

Making Modifications (`usermod`)

The usermod utility requires root access (sudo) and takes various flags to modify specific properties of an account.

usermod -l new_name old_name Changes the user's login name.
usermod -d /path/to/dir user Changes the user's home directory.
usermod -c "Full Name" user Updates the comments field (often the full name).
usermod -e YYYY-MM-DD user Sets an account expiration date (useful for contractors).
usermod -G group user Adds the user to the specified group (use -aG to append without replacing).
usermod -L user or passwd -l user
Locks a user's login temporarily to prevent unauthorized usage.

Password Aging & Expiration (`chage`)

The chage command manages password aging and account expiration. Running it with no options (chage user_name) launches an interactive prompt. You can also pass flags for direct modification:

Option	Purpose
-d {date}	Sets the date of the last password change.
-E {date}	Sets the date when the account should expire.
-m {days}	Minimum password age. 0 allows changing immediately.
-M {days}	Maximum password age. 99999 means never expire.
-I {days}	Number of days the account will be inactive after expiration before being locked.
-W {days}	Warning period before password expiration.

Password Management & Security

passwd

The passwd command is used to set or change user passwords. User accounts created without a password are locked automatically to prevent unauthorized access.

Regular users can change their own password by simply running passwd (passwords do not echo to the screen).
Root users can change any user's password using passwd user_name.
Setting a password to a dictionary word will yield a warning, though root can bypass this.

/etc/passwd File

Historically stored passwords, but now only stores account info. Contains 7 colon-separated fields:

Username
Password (usually x indicating it's in shadow, stored in /etc/shadow)
User ID (UID)
Group ID (GID)
Comment (Full Name, Phone, etc)
Home Directory
Login Shell

/etc/shadow File

Created to securely store encrypted passwords. It is readable only by the root user. Contains 9 colon-separated fields:

Username
Encrypted Password
Last changed (days since epoch)
Minimum password age (may)
Maximum password age (must)
Warning period (warn)
Inactivity period (expire)
Account disable date
Reserved

Group Management & Security

A group is a collection of system users having the same access rights. Every user must be a member of at least one group (their primary group) and can optionally join multiple supplementary groups. This simplifies assigning access rights to files and resources. By default, when a user is created, a User Private Group (UPG) is also created exclusively for that user.

Group Commands

groupadd {group}

Creates a new group. Use -g {GID} to explicitly set the Group ID.

groupdel {group}

Deletes an existing group from the system.

groupmod -g {GID} {group}

Modifies an existing group, for example, changing its numeric ID.

usermod -aG {group} {user}

The safest way to append a user to a group without manually editing files.

/etc/group File

The group database. It lists all groups, with each line containing 4 colon-separated fields:

Group Name
Group Password (Encrypted, typically an x. Encrypted passwords are actually in /etc/gpasswd)
GID (Group Identifier. Default GIDs often start at 500 or 1000)
Members (Comma-separated list of usernames in the group)

Standard System Groups

Many groups are created by default during installation (with GIDs usually < 100):

root (0) bin (1) daemon (2) sys (3) adm (4) tty (5) disk (6) lp (7) mem (8) kmem (9) wheel (10) nobody (99) users (100)