Permissions, ownership, and umask · Linux

Every file on Linux has an owner, a group, and three sets of permission bits. Reading them correctly is the difference between “why is this script failing” and “ah, it’s missing the execute bit”.

The permission string

ls -l shows ten characters:

-rw-r----- 1 root adm  4321 Aug  9 11:11 /var/log/syslog

Position	What it is	Example above
1	File kind	`-` (regular file)
2-4	Owner permissions	`rw-` (read + write)
5-7	Group permissions	`r--` (read only)
8-10	Other permissions	`---` (none)

The three permission sets are evaluated in order: owner first; if the requesting user is not the owner, then group; if not a member of the group, then other.

Read-only / Safethree permission shapes— systemctl is world-readable and executable; shadow is restricted to the shadow group; /tmp has the sticky bit (t at the end) so users can only delete their own files.

$ ls -l /usr/bin/systemctl /etc/shadow /tmp

-rwxr-xr-x 1 root root 320K Aug  9 11:11 /usr/bin/systemctl
-rw-r----- 1 root shadow 1.8K Aug  9 11:11 /etc/shadow
drwxrwxrwt 1 root root  128 Aug  9 11:11 /tmp

Illustrative output

The numeric mode

Each permission bit has an octal value:

Bit	Value
Read (`r`)	4
Write (`w`)	2
Execute (`x`)	1

Sum the values for each set. chmod 0640 file is read-write for owner, read-only for group, nothing for other.

Common modes:

Mode	Meaning
0644	rw-r—r— — public-readable, owner-writable
0755	rwxr-xr-x — public-readable and executable, owner-writable
0600	rw------- — owner-only read/write
0640	rw-r----- — owner read/write, group read-only
0700	rwx------ — owner-only full access
0750	rwxr-x--- — owner full, group read+execute, no others

Configuration changechmod 0750— Owner full, group read+execute, others nothing. The standard 'application binary in a multi-tenant deploy' mode.

$ chmod 0750 /opt/myapp/bin/run; ls -l /opt/myapp/bin/run

-rwxr-x--- 1 root myapp 8.2K Aug  9 11:11 /opt/myapp/bin/run

Illustrative output

Symbolic mode

For ad-hoc changes, symbolic mode is often clearer than numeric:

Configuration changesymbolic chmod— u=user (owner), g=group, o=other, a=all. +/- add/remove, = set exactly. Capital X means 'execute only on directories and files that already have execute for someone' — useful when applying x recursively without making data files executable.

$ chmod u+rw,go+r file; chmod g-w file; chmod o=x file; chmod -R u+X .

Illustrative output

Special bits:

Bit	Symbolic	Meaning
setuid	`u+s`	Process runs as file owner
setgid	`g+s`	Process runs as file group; new files inherit directory’s group
sticky	`+t`	On a directory, only the file’s owner can delete or rename files inside

setuid is a security boundary

A setuid root binary runs as root regardless of who invokes it. A vulnerability in a setuid binary is a vulnerability in the entire system. Audit /usr/bin and /usr/sbin regularly with find /usr -perm /6000 -type f and confirm each setuid binary is from a vendor package and at the expected version.

Typical vendor setuid binaries: su, sudo, passwd, chfn, chsh, newgrp, gpasswd, mount, umount, plus filesystem helpers such as fusermount3.

Note what is not in that list. ping has not been setuid on Debian since 11, Ubuntu since 20.10, or RHEL since 8 — it uses the cap_net_raw=ep file capability, or none at all where net.ipv4.ping_group_range covers the caller’s groups. A “known good” list carried over from a decade-old runbook will flag fusermount3 as suspicious and wave through a ping that someone made setuid on purpose.

Build the baseline from your own vendor image rather than from a list in a document, and diff against it:

find / -xdev -perm /6000 -type f 2>/dev/null | sort
getcap -r / 2>/dev/null | sort

Capabilities are the second half of the audit. A binary with cap_setuid+ep is a root escalation with none of the setuid bit’s visibility, and find -perm /6000 will never show it.

umask — the default-permission mask

When a process creates a new file, the kernel applies the umask to the requested mode to derive the effective mode.

Requested	umask	Result
0666 (file default)	022	0644
0666	077	0600
0777 (directory default)	022	0755
0777	002	0775

Read-only / Safeumask— The default umask on most distributions is 022 — strip write from group and other. New files get 0644; new directories get 0755. Set /etc/profile or /etc/login.defs to enforce a stricter umask for interactive users.

$ umask

Illustrative output

Ownership with chown and chgrp

Configuration changechown / chgrp— chown user:group sets both owner and group. chgrp sets only the group. -R recurses — but be careful: it crosses mount points and can affect files you do not intend.

$ chown root:myapp /opt/myapp/config; chgrp myapp /opt/myapp/logs; chown -R myapp:myapp /opt/myapp

Illustrative output

Common production permission mistakes

World-writable files. find / -perm -o+w -type f -not -path '/proc/*' -not -path '/sys/*' should return very little. Anything it returns deserves investigation.
World-writable directories without sticky bit. /tmp has the sticky bit (1777); other shared scratch directories often should too.
Scripts lacking execute permission. chmod +x script.sh is the most-frequent fix when a daemon refuses to start.
Group ownership of sensitive files. /etc/shadow should be root:shadow mode 0640. Files readable by users or world that contain secrets are a vulnerability.
Files with setuid in unexpected places. find / -perm /4000 returns the setuid inventory. Anything outside /usr/bin or /usr/sbin deserves investigation.

The permission string

The numeric mode

Symbolic mode

umask — the default-permission mask

Ownership with chown and chgrp

Common production permission mistakes

Knowledge check