Every file and directory in Linux has an owner and a set of access permission rules that determine who can read, modify, or execute it. This is one of the pillars of Linux security that distinguishes it from many other systems. Having understood users, groups, and sudo in the previous two chapters, you will now learn how to read the output of ls -l, change ownership with chown and chgrp, set access permissions with chmod, understand default values via umask, and also learn about special permissions such as SUID, SGID, and the sticky bit.
It is worth noting that since Ubuntu 26.04 LTS, the core commands used in this chapter, such as ls, chmod, chown, and chgrp, are actually provided by a new implementation called uutils coreutils, a rewrite of GNU coreutils in the Rust language that is installed by default for better memory safety. This implementation is designed to be a fully compatible drop‑in replacement for the original GNU version, so all the commands and example outputs in this chapter remain valid without any changes on Ubuntu 26.04 LTS. Fedora Workstation 44, on the other hand, still uses the GNU coreutils as usual.
Reading ls -l Output
The easiest way to view a file's permissions is to run ls -l. Consider the following example.
ls -l catatan.txt
-rw-r--r-- 1 anda anda 1024 Jul 20 09:00 catatan.txtThe leftmost column, -rw-r--r--, is the core of this entire chapter. This column consists of ten characters that can be broken down into several parts.
File Type
The first character indicates the file type.
| Character | File Type |
|---|---|
- | Regular file |
d | Directory |
l | Symbolic link |
b | Block device |
c | Character device |
s | Socket |
p | Named pipe (FIFO) |
For symbolic links specifically, you will always see the permission string lrwxrwxrwx in ls -l, no matter what permissions you actually set on it. This is not an error: the Linux kernel indeed ignores permissions on the symlink itself, and what actually applies are the permissions of the file or directory it points to (the target).
Permission Bits: rwxrwxrwx
The remaining nine characters are divided into three groups of three characters each, for owner, group, and others.
| Character | Meaning | For files | For directories |
|---|---|---|---|
r | Read | Read file contents | List directory contents |
w | Write | Modify file contents | Add or remove files in the directory |
x | Execute | Run the file | Enter the directory |
Thus, -rw-r--r-- means a regular file that is readable and writable by its owner, only readable by members of the group, and only readable by other users. This is the most common pattern for personal files.
Changing Ownership
File ownership includes both the owner and the group. The following two commands are used to change them.
chown: Changing the Owner
The chown (change owner) command changes the owner of a file, and can also change its group at the same time.
sudo chown budi catatan.txt
sudo chown budi:developer catatan.txt
sudo chown -R budi /home/budiThe -R option is useful for changing ownership recursively on an entire directory's contents. Changing the owner generally requires sudo because only root can do it.
chgrp: Changing the Group
The chgrp (change group) command changes the group ownership of a file. An ordinary user can use this command as long as they are a member of the target group.
chgrp developer catatan.txtChanging Permissions
The chmod (change mode) command changes the access permissions of a file or directory. There are two ways to specify permissions: the numeric (octal) method and the symbolic method.
Numeric (Octal) Method
In this method, each permission is given a numeric value, and these values are summed.
| Permission | Value |
|---|---|
r (read) | 4 |
w (write) | 2 |
x (execute) | 1 |
| No permission | 0 |
The three digits represent the owner, group, and others, in that order. The most common examples are 755 and 644.
chmod 755 script.sh
chmod 644 catatan.txt
chmod -R 755 /path/directoryThe value 755 means the owner has read, write, and execute (4+2+1), while the group and others have only read and execute (4+1). The value 644 means the owner has read and write, while the group and others have only read. Just like chown, the -R option with chmod is used to recursively change permissions on an entire directory's contents.
Symbolic Method
The symbolic method is easier to understand because you directly specify the party and the permission to change.
| Symbol | Meaning |
|---|---|
u | Owner (user) |
g | Group |
o | Others |
a | All (everyone) |
+ | Add permission |
- | Remove permission |
= | Set permission |
chmod u+x script.sh
chmod go-w catatan.txt
chmod a+r dokumen.txtThe first command adds execute permission for the owner, the second removes write permission for group and others, and the third adds read permission for everyone.
Default Permissions: umask
When you create a new file or directory, the system automatically assigns default permissions. These default values are set by umask, a value that subtracts from the base permissions. Run umask to see its value.
umaskA common umask value is 022. This means that the base permissions for files (666) minus 022 become 644, while the base permissions for directories (777) minus 022 become 755. Technically, the actual operation is not ordinary subtraction but a bitwise operation that clears the permission bits marked by the umask; however, for common umask values like 022, the result is exactly the same as the simple subtraction described above. You can change this value temporarily by running umask 077, or permanently by placing it in your shell configuration file such as ~/.bashrc.
Special Permissions
In addition to the three basic permission groups, there are three special permissions with their own uses.
SUID (Set User ID)
SUID is applied to executable files and makes the program run with the permissions of the file's owner, not the user who runs it. A classic example is the passwd command, which needs access to the /etc/shadow file. Thanks to SUID, ordinary users can change their own passwords without being given direct access to that file. SUID is given the value 4 and is written in front of the other permission values, e.g. 4755.
chmod u+s program
chmod 4755 programSGID (Set Group ID)
SGID has two roles. On executable files, SGID makes the program run with the permissions of the file's group. On directories, SGID makes any new file created inside inherit the group of that directory. SGID is given the value 2, e.g. 2755.
chmod g+s /path/directory
chmod 2755 /path/directorySticky Bit
The sticky bit is applied to shared directories such as /tmp. With the sticky bit set, any user can place files in that directory, but only the file's owner (or root) may delete or rename it. The sticky bit is given the value 1, so the /tmp directory has permissions 1777.
chmod +t /path/directory
chmod 1777 /path/directoryFile permissions and ownership are the foundation of Linux security that you will use all the time, whether as a desktop user or later when managing servers. Once you understand ls -l, chown, chgrp, chmod, umask, and the special permissions SUID, SGID, and the sticky bit, you have mastered one of the most fundamental concepts in system administration. The next chapter will bring you to an equally important topic: how software is managed through package managers.