chmod (change permissions) in Linux CLI - Deep Dive

Overview - chmod (change permissions)

What is it?

chmod is a command in Linux and Unix systems used to change the access permissions of files and directories. Permissions control who can read, write, or execute a file. Using chmod, you can set these permissions for the file owner, group members, and others. This helps keep files secure and controls how they are used.

Why it matters

Without chmod, anyone could access or modify any file on a system, leading to security risks and accidental damage. It solves the problem of controlling access to files, ensuring only authorized users can read, change, or run them. This is crucial for protecting personal data, system files, and shared resources in multi-user environments.

Where it fits

Before learning chmod, you should understand basic Linux commands and the concept of users and groups. After mastering chmod, you can explore advanced file security topics like Access Control Lists (ACLs) and user management. chmod is a foundational skill for system administration and scripting.

Mental Model

Core Idea

chmod changes who can read, write, or run a file by setting permissions for owner, group, and others.

Think of it like...

chmod is like setting locks on different doors of a house, deciding who can enter, who can change things inside, and who can only look around.

Permissions structure:

  +---------------------------+
  |        File/Directory      |
  +---------------------------+
  | Owner | Group | Others    |
  | R W X | R W X | R W X    |
  +---------------------------+

R = Read, W = Write, X = Execute
chmod sets these R/W/X locks for each category.

Build-Up - 7 Steps

1

Foundation

Understanding Linux File Permissions

Concept: Files have three types of permissions: read, write, and execute, for three categories of users: owner, group, and others.

Every file and folder in Linux has permissions that control access. These permissions are shown as a string like rwxr-xr--. The first three letters are for the owner, the next three for the group, and the last three for others. 'r' means read permission, 'w' means write permission, and 'x' means execute permission.

Result

You can see who can read, change, or run a file by looking at its permission string.

Understanding the permission string is the foundation for controlling file access and using chmod effectively.

2

Foundation

Basic chmod Syntax and Usage

Concept: chmod changes file permissions using symbolic or numeric modes to specify who gets what permissions.

The basic syntax is: chmod [options] mode file Modes can be symbolic (like u+r to add read for owner) or numeric (like 755). For example, chmod u+x script.sh adds execute permission for the owner. Numeric mode uses three digits, each from 0 to 7, representing permissions for owner, group, and others.

Result

You can change file permissions to allow or restrict access as needed.

Knowing how to use chmod with symbolic and numeric modes lets you quickly set precise permissions.

3

Intermediate

Symbolic Mode Details and Operators

🤔Before reading on: do you think '+' adds permissions or replaces them? Commit to your answer.

Concept: Symbolic mode uses letters (u, g, o, a) and operators (+, -, =) to modify permissions without affecting others.

In symbolic mode, u = owner, g = group, o = others, a = all. Operators: '+' adds permission, '-' removes, '=' sets exactly. For example, chmod g-w file.txt removes write permission from group. This mode is flexible because it changes only specified permissions.

Result

You can add, remove, or set permissions precisely without changing unrelated permissions.

Understanding symbolic operators prevents accidental permission loss and allows fine control.

4

Intermediate

Numeric Mode Explained with Examples

🤔Before reading on: do you think numeric mode digits add or replace permissions? Commit to your answer.

Concept: Numeric mode uses three digits (0-7) representing read(4), write(2), and execute(1) summed for owner, group, and others.

Each digit is a sum of permissions: 4 for read, 2 for write, 1 for execute. For example, 7 means read+write+execute (4+2+1). chmod 755 file sets owner to 7 (all permissions), group and others to 5 (read+execute). This mode sets permissions exactly, replacing previous ones.

Result

You can set all permissions at once with a simple three-digit number.

Knowing numeric mode lets you quickly set common permission patterns without multiple commands.

5

Intermediate

Recursive Permission Changes

Concept: chmod can change permissions for directories and all their contents recursively using the -R option.

Using chmod -R mode directory changes permissions for the directory and everything inside it. For example, chmod -R 755 myfolder sets read, write, execute for owner and read, execute for group and others on all files and folders inside myfolder.

Result

You can update permissions for many files and folders at once.

Recursive changes save time but require caution to avoid unintended permission changes.

6

Advanced

Special Permissions: Setuid, Setgid, Sticky Bit

🤔Before reading on: do you think special permissions affect who can run or modify files? Commit to your answer.

Concept: Special permissions add extra behavior: setuid runs a file as owner, setgid runs as group, sticky bit restricts file deletion in directories.

Setuid (4xxx) lets users run a program with the file owner's permissions. Setgid (2xxx) runs with group permissions or forces new files to inherit group. Sticky bit (1xxx) on directories means only owners can delete their files. For example, chmod 4755 file sets setuid with normal permissions.

Result

You can control advanced access and execution behaviors for security and collaboration.

Special permissions enable powerful control but can cause security risks if misused.

7

Expert

Common Pitfalls and Security Implications

🤔Before reading on: do you think giving execute permission to everyone is always safe? Commit to your answer.

Concept: Incorrect permissions can expose files or allow unauthorized actions, causing security breaches or system issues.

Giving write or execute permissions to others can let attackers modify or run harmful code. Using setuid on scripts is risky. Recursive chmod can accidentally open sensitive files. Always check permissions with ls -l and understand the impact before changing them.

Result

You avoid security holes and system problems by applying permissions carefully.

Knowing risks helps prevent common security mistakes and maintain system integrity.

Under the Hood

Linux stores file permissions as bits in the inode metadata. Each file has a 12-bit mode field: 9 bits for owner/group/others permissions (read, write, execute) and 3 bits for special flags (setuid, setgid, sticky). When a user accesses a file, the kernel checks these bits against the user's identity and group membership to allow or deny actions.

Why designed this way?

This bit-based permission system is simple, fast, and fits well with Unix's multi-user design. It balances flexibility and performance. Alternatives like Access Control Lists (ACLs) offer more detail but are more complex. The traditional model remains widely used for its clarity and efficiency.

Permission bits layout:

+---------------------------+
| Special | Owner | Group | Others |
| s u i d | r w x | r w x | r w x |
+---------------------------+

Kernel checks bits in order:
User ID -> Group IDs -> Others
Permission bits determine allowed actions.

Myth Busters - 4 Common Misconceptions

Quick: Does chmod +x add execute permission for all users or just the owner? Commit to your answer.

Common Belief: chmod +x adds execute permission only for the file owner.

Reality: chmod +x adds execute permission for all categories: owner, group, and others.

Why it matters: Assuming it affects only the owner can lead to unintentionally allowing everyone to execute a file, causing security risks.

Quick: Does chmod 777 make a file completely safe to share? Commit to your answer.

Common Belief: chmod 777 is safe because it allows everyone full access.

Reality: chmod 777 gives read, write, and execute permissions to everyone, which is usually unsafe and can expose files to unauthorized changes or execution.

Why it matters: Using 777 can lead to data loss, malware execution, or system compromise.

Quick: Does removing execute permission from a directory prevent reading its files? Commit to your answer.

Common Belief: Removing execute permission from a directory stops users from listing or accessing files inside.

Reality: Execute permission on a directory controls entering it, while read permission controls listing files. Without execute, you cannot access files even if you can list them.

Why it matters: Misunderstanding directory permissions can cause confusion about access problems.

Quick: Does setuid work on scripts the same way as on binaries? Commit to your answer.

Common Belief: setuid works on scripts to run them as the file owner.

Reality: Most systems ignore setuid on scripts for security reasons; it only works reliably on binary executables.

Why it matters: Expecting setuid on scripts to work can cause security holes or unexpected behavior.

Expert Zone

1

chmod changes only permission bits, but ownership and ACLs also affect access; understanding their interaction is key for complex setups.

2

The sticky bit on directories is crucial for shared folders like /tmp to prevent users from deleting others' files, a subtle but vital security feature.

3

Numeric mode replaces all permissions for each category, so mixing symbolic and numeric changes without care can cause unintended permission loss.

When NOT to use

chmod is limited to basic permission bits and cannot express fine-grained access controls like ACLs or SELinux policies. For complex security needs, use setfacl or security modules instead.

Production Patterns

System administrators use chmod in scripts to set default permissions during deployments. They combine it with chown and umask for consistent environments. Recursive chmod is common but always paired with careful testing to avoid permission leaks.

Connections

Access Control Lists (ACLs)

builds-on

ACLs extend chmod's basic permissions by allowing detailed access rules for multiple users and groups, enhancing security control.

User and Group Management

depends-on

Understanding users and groups is essential to set meaningful permissions with chmod, as permissions apply differently based on ownership.

Physical Locks and Keys

similar pattern

Just like physical locks control who can enter rooms, chmod controls who can access files, showing how digital security mirrors real-world security concepts.

Common Pitfalls

#1 Giving execute permission to all files blindly.

Wrong approach:

chmod 777 *

Correct approach:

chmod 755 script.sh
chmod 644 document.txt

Root cause:

Misunderstanding that execute permission is only needed for programs or scripts, not all files.

#2 Using numeric mode without knowing what each digit means.

Wrong approach:

chmod 999 file.txt

Correct approach:

chmod 644 file.txt

Root cause:

Assuming any number sets permissions without understanding the 0-7 range and bit values.

#3 Applying recursive chmod without caution on sensitive directories.

Wrong approach:

chmod -R 777 /var/www

Correct approach:

chmod -R 755 /var/www
chmod -R 644 /var/www/html/*.html

Root cause:

Not realizing recursive changes affect all files and folders, potentially exposing sensitive data.

Key Takeaways

chmod controls file and directory access by setting read, write, and execute permissions for owner, group, and others.

Permissions can be changed using symbolic modes for precise adjustments or numeric modes for quick, exact settings.

Special permissions like setuid, setgid, and sticky bit add advanced behaviors but require careful use to avoid security risks.

Understanding the permission bits and their effects is essential to maintain system security and proper file access.

Always verify permission changes and avoid overly permissive settings to protect your system and data.

Practice

1. What does the chmod 755 filename command do in Linux?

easy

A. Removes all permissions from everyone

B. Sets read and write for owner; execute for group and others

C. Sets read, write, execute for owner; read and execute for group and others

D. Only changes the file owner

Solution

1. Step 1: Understand numeric permission 755

   The digits 7, 5, 5 represent permissions for owner, group, and others respectively. 7 means read(4)+write(2)+execute(1)=7, 5 means read(4)+execute(1)=5.

2. Step 2: Apply permissions to file

   Owner gets full permissions (rwx), group and others get read and execute (r-x). This matches the description in Sets read, write, execute for owner; read and execute for group and others.

3. Final Answer:

   Sets read, write, execute for owner; read and execute for group and others -> Option C

4. Quick Check:

   chmod 755 = rwxr-xr-x [OK]

Hint: Remember 7=rwx, 5=rx, 6=rw [OK]

Common Mistakes:

• Confusing numeric codes with letters
• Thinking 755 removes permissions
• Assuming chmod changes ownership

2. Which of the following is the correct syntax to add execute permission for the user on a file named script.sh?

easy

A. chmod +x u script.sh

B. chmod script.sh u+x

C. chmod x+u script.sh

D. chmod u+x script.sh

Solution

1. Step 1: Recall chmod symbolic syntax

   The correct format is chmod [who][operator][permission] filename. Here, 'u' means user, '+' adds permission, 'x' is execute.

2. Step 2: Match syntax to options

   chmod u+x script.sh matches the correct syntax: chmod u+x script.sh. Other options have incorrect order or misplaced arguments.

3. Final Answer:

   chmod u+x script.sh -> Option D

4. Quick Check:

   chmod u+x filename adds execute for user [OK]

Hint: Use chmod [u/g/o][+/-][r/w/x] filename [OK]

Common Mistakes:

• Placing permissions before user
• Putting filename before options
• Using spaces inside symbolic mode

3. What will be the output of ls -l file.txt after running chmod 640 file.txt on a file owned by user 'alice' and group 'staff'?

medium

A. -rw-r----- 1 alice staff 0 date file.txt

B. -rwxr-xr-x 1 alice staff 0 date file.txt

C. -rw-rw-r-- 1 alice staff 0 date file.txt

D. -r--r----- 1 alice staff 0 date file.txt

Solution

1. Step 1: Decode chmod 640 permissions

   6 = read(4)+write(2) for owner, 4 = read(4) for group, 0 = no permissions for others.

2. Step 2: Translate to ls -l format

   Owner: rw-, Group: r--, Others: ---. So the permission string is '-rw-r-----'. The rest shows ownership and file info.

3. Final Answer:

   -rw-r----- 1 alice staff 0 date file.txt -> Option A

4. Quick Check:

   chmod 640 = rw-r----- [OK]

Hint: Match digits to rwx: 6=rw-, 4=r--, 0=--- [OK]

Common Mistakes:

• Mixing group and others permissions
• Assuming execute permission is set
• Confusing numeric values

4. You ran chmod 777 myfile but ls -l myfile still shows -rw-r--r--. What is the most likely reason?

medium

A. You forgot to run the command as root or with sudo

B. The file system is mounted as read-only

C. The chmod command syntax is incorrect

D. The file is a directory, not a file

Solution

1. Step 1: Understand chmod effect and file system state

   chmod 777 should set full permissions. If permissions don't change, it may be due to file system restrictions like read-only mount.

2. Step 2: Evaluate other options

   Running as root is not always required for own files. Syntax is correct. File type does not prevent permission changes. Read-only file system blocks changes.

3. Final Answer:

   The file system is mounted as read-only -> Option B

4. Quick Check:

   Read-only FS blocks chmod changes [OK]

Hint: Check if filesystem is read-only if chmod fails [OK]

Common Mistakes:

• Assuming sudo always needed
• Blaming syntax without checking
• Ignoring file system mount options

5. You want to set permissions so that the owner can read and write, the group can only read, and others have no permissions on a file named data.txt. Which command achieves this?

hard

A. chmod 640 data.txt

B. chmod 750 data.txt

C. chmod 664 data.txt

D. chmod 600 data.txt

Solution

1. Step 1: Translate desired permissions to numeric code

   Owner: read+write = 6, Group: read only = 4, Others: no permissions = 0. So numeric code is 640.

2. Step 2: Match numeric code to options

   chmod 640 data.txt is chmod 640 data.txt, which matches the desired permissions exactly.

3. Final Answer:

   chmod 640 data.txt -> Option A

4. Quick Check:

   Owner=rw, Group=r, Others=none = 640 [OK]

Hint: Use chmod 640 for rw-r----- permissions [OK]

Common Mistakes:

• Using 750 which gives execute permission
• Using 664 which allows others read
• Using 600 which denies group read