Linux File Permissions: Understanding chmod, chown, and ACLs

File permissions are a foundational Linux security control. Misreading one character in an rwx string can stop an application, block legitimate users, or expose write access much more broadly than intended.

Read permissions with ls -l

ls -l /var/www/example
-rw-r----- 1 deploy www-data 2840 Sep 18 10:30 config.php

The first character describes the object type. The next nine characters are split into permissions for the owner, group, and everyone else.

Permissions on files and directories

Use symbolic chmod modes

chmod u+x deploy.sh
chmod g-w config.php
chmod o= private.txt
chmod a+r README.md

Symbolic modes are easy to review: u, g, o, and a select users; +, -, and = add, remove, or set permissions.

Use numeric modes

Read is 4, write is 2, and execute is 1. Values are added for owner, group, and others:

• 640: owner reads/writes, group reads, others have no access.
• 750: owner has full access, group reads/traverses, others have no access.
• 644: common for public files writable only by their owner.
• 755: common for directories and public executables.

Do not use chmod -R 777 as a generic permission fix. It hides the underlying ownership problem and grants excessive access.

Change ownership with chown and chgrp

sudo chown deploy app.log
sudo chown deploy:www-data app.log
sudo chgrp www-data storage
sudo chown -R deploy:www-data /var/www/example

Review paths before recursive changes. A web process should receive write access only where the application genuinely needs it.

Inherit a group with setgid

sudo chgrp developers /srv/project
sudo chmod 2775 /srv/project

The leading 2 enables setgid so new entries inherit the directory group.

Use umask for defaults

umask
umask 027

A umask removes permissions from newly created objects. A mask of 027 commonly results in files using 640 and directories using 750, although the creating application also matters.

When should you use ACLs?

ACLs help when one additional user or group needs access without changing primary ownership:

getfacl report.csv
setfacl -m u:analyst:r report.csv
setfacl -m d:g:developers:rwx /srv/project
setfacl -x u:analyst report.csv

Inspect the ACL mask because it limits the effective permissions of named users and groups.

Troubleshooting Permission denied

1. Inspect every parent directory with namei -l.
2. Confirm the process user and groups.
3. Review mode bits and ownership.
4. Inspect ACLs with getfacl.
5. Check for read-only or noexec mounts.
6. Review AppArmor or SELinux policy when Unix permissions look correct.

References

• GNU Coreutils: Setting Permissions
• GNU Coreutils: chmod
• Linux manual: setfacl