Understanding Linux File Permissions: A Deep Dive into chmod, chown, and Linux Security

-rwsr-xr-x 1 root root 59640 /usr/bin/passwd ↑ s = setuid bit set

2. Setgid (Set Group ID) - 2xxx

On files: Program runs with the group permissions of the file.
On directories: New files inherit the directory's group (not the creator's group).

chmod g+s /shared/directory   # Symbolic
chmod 2775 /shared/directory  # Numeric (2 = setgid)

💡 Collaborative Directories

Setgid on directories is perfect for team projects. All new files automatically belong to the group, making sharing easier.

3. Sticky Bit - 1xxx

On directories: Only the file owner, directory owner, or root can delete or rename files in the directory, even if others have write permission.

chmod +t /tmp                 # Symbolic
chmod 1777 /tmp               # Numeric (1 = sticky bit)

Example: The /tmp directory uses the sticky bit so users can create files there, but can't delete each other's files.

drwxrwxrwt 15 root root 4096 /tmp ↑ t = sticky bit set

Special Permission Notation Summary

Permission	Numeric	Symbolic	Display
Setuid	4000	u+s	s in owner execute position
Setgid	2000	g+s	s in group execute position
Sticky Bit	1000	+t	t in others execute position

⚠️ Security Implications

Setuid and setgid are powerful but dangerous. A setuid root program with a vulnerability can give attackers full system access. Only set these bits when absolutely necessary and on well-audited programs.

Default Permissions and umask

When you create a new file or directory, it gets default permissions determined by your umask (user file-creation mode mask).

Understanding umask

The umask subtracts permissions from the default maximum:

Files default maximum: 666 (rw-rw-rw-)
Directories default maximum: 777 (rwxrwxrwx)

umask                         # Display current umask
umask 0022                    # Set umask to 022

Common umask Values

umask	Files Created	Directories Created
`0022`	644 (rw-r--r--)	755 (rwxr-xr-x)
`0002`	664 (rw-rw-r--)	775 (rwxrwxr-x)
`0077`	600 (rw-------)	700 (rwx------)
`0000`	666 (rw-rw-rw-)	777 (rwxrwxrwx)

📝 Setting Permanent umask

To make your umask permanent, add it to your ~/.bashrc or ~/.profile file:
umask 0022

Access Control Lists (ACLs)

Traditional Unix permissions have limitations: you can only set permissions for one owner, one group, and everyone else. Access Control Lists (ACLs) provide more granular control.

Viewing ACLs

getfacl file.txt              # View ACLs for a file
ls -l file.txt                # Files with ACLs show + at the end

Setting ACLs

# Give user bob read and write access
setfacl -m u:bob:rw file.txt

# Give group developers read and execute
setfacl -m g:developers:rx directory/

# Remove ACL for user bob
setfacl -x u:bob file.txt

# Remove all ACLs
setfacl -b file.txt

# Apply recursively
setfacl -R -m u:bob:rw directory/

💡 When to Use ACLs

Use ACLs when you need to give specific permissions to multiple users or groups without changing the file's basic ownership structure. They're perfect for complex permission requirements.

Common Permission Scenarios and Solutions

Scenario 1: Web Server Files

Problem: Setting up a web server directory.

# Directories need execute to be traversable
find /var/www/html -type d -exec chmod 755 {} \;

# Files should be readable but not executable
find /var/www/html -type f -exec chmod 644 {} \;

# Set proper ownership
chown -R www-data:www-data /var/www/html

Scenario 2: SSH Key Permissions

Problem: SSH refuses to use your private key due to permissions.

# Private keys must be readable only by owner
chmod 600 ~/.ssh/id_rsa

# Public keys can be readable by all
chmod 644 ~/.ssh/id_rsa.pub

# SSH directory should be secure
chmod 700 ~/.ssh

# authorized_keys file
chmod 600 ~/.ssh/authorized_keys

Scenario 3: Shared Project Directory

Problem: Team members need to collaborate on files.

# Create group for the team
sudo groupadd developers

# Add users to the group
sudo usermod -aG developers alice
sudo usermod -aG developers bob

# Create and configure shared directory
sudo mkdir /shared/project
sudo chown root:developers /shared/project
sudo chmod 2775 /shared/project  # setgid + group write

# Set umask for proper file creation
umask 0002

Scenario 4: Making Files Immutable

Problem: Prevent any modifications to critical files.

# Make file immutable (even root can't modify)
sudo chattr +i important_file.txt

# View file attributes
lsattr important_file.txt

# Remove immutable attribute
sudo chattr -i important_file.txt

Troubleshooting Permission Issues

Permission Denied When Reading

# Check current permissions
ls -l file.txt

# Check if you can read
cat file.txt

# Add read permission for yourself
chmod u+r file.txt

Permission Denied When Executing

# Scripts need execute permission
chmod +x script.sh

# Or use interpreter directly
bash script.sh
python3 script.py

Can't Delete Files in Directory

# Need write permission on the directory
ls -ld directory/

# Check if sticky bit prevents deletion
# You can only delete if you own the file

Finding Permission Issues

# Find files with specific permissions
find /path -type f -perm 777

# Find world-writable files (security risk)
find /path -type f -perm -002

# Find setuid files
find / -type f -perm -4000 2>/dev/null

# Find files owned by specific user
find /path -user username

# Find files with no owner (security concern)
find / -nouser 2>/dev/null

Security Best Practices

Principle of Least Privilege

Always grant the minimum permissions necessary for the task. Start restrictive and add permissions only when needed.

✅ Good Practice

chmod 640 config.txt

Owner can edit, group can read, others have no access

❌ Bad Practice

chmod 777 config.txt

Everyone can do everything - major security risk

Regular Security Audits

# Find world-writable files
find / -type f -perm -002 ! -path "/proc/*" 2>/dev/null

# Find world-writable directories
find / -type d -perm -002 ! -path "/proc/*" 2>/dev/null

# Check for suspicious setuid/setgid files
find / -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null

# Find files modified in last 24 hours
find /etc -type f -mtime -1 -ls

Important Files to Protect

File/Directory	Recommended Permissions	Reason
`/etc/passwd`	644	Readable by all, writable only by root
`/etc/shadow`	640 or 000	Contains password hashes
`~/.ssh/`	700	SSH private keys directory
`~/.ssh/id_rsa`	600	Private SSH key
`/root`	700	Root user home directory
`/etc/sudoers`	440	Sudo configuration

Quick Reference Commands

# View permissions
ls -l file.txt                    # Detailed listing
stat file.txt                     # Detailed file status
getfacl file.txt                  # View ACLs

# Change permissions
chmod 755 file.txt                # Numeric method
chmod u+x file.txt                # Symbolic method
chmod -R 755 directory/           # Recursive

# Change ownership
chown user file.txt               # Change owner
chown user:group file.txt         # Change owner and group
chgrp group file.txt              # Change group only

# Special permissions
chmod u+s file                    # Set setuid
chmod g+s directory/              # Set setgid
chmod +t directory/               # Set sticky bit

# Default permissions
umask                             # View current umask
umask 0022                        # Set umask

Permission Quick Reference Chart

What You Want	Command
Make script executable	`chmod +x script.sh`
Private file only you can read/write	`chmod 600 file.txt`
Private directory only you can access	`chmod 700 directory/`
Public readable file	`chmod 644 file.txt`
Public readable directory	`chmod 755 directory/`
Group collaborative directory	`chmod 2775 directory/`
Protect file from accidental deletion	`chattr +i file.txt`

Conclusion: Mastering Permissions

Understanding Linux file permissions is fundamental to system security and proper administration. While it might seem complex at first, permissions follow consistent logical rules that become intuitive with practice.

Remember these key principles:

Start restrictive: Grant minimal permissions and add only what's needed
Think before using 777: It's rarely the right solution and often a security disaster
Use groups effectively: They're powerful tools for managing multi-user access
Protect private keys: SSH and GPG keys should always be 600 or more restrictive
Audit regularly: Periodically check for permission issues and anomalies
Document your changes: Keep notes on why you set specific permissions

🎓 Keep Learning

Practice on a test system before applying permission changes to production. Create dummy files and directories, experiment with different permission combinations, and observe the results. Hands-on experience is the best teacher!

File permissions are your first line of defense in Linux security. By understanding and properly implementing them, you protect your data, maintain system integrity, and ensure smooth multi-user operations. Whether you're a system administrator, developer, or power user, permission management is a skill that will serve you throughout your Linux journey.

Now that you understand the theory and practice of Linux permissions, you're equipped to secure your systems effectively and troubleshoot access issues with confidence. Happy securing! 🔒