Users & Permissions

Published on:

Most important commands to remember

  • id — see your user identity and groups.
  • ls -l — read file ownership and permission bits.
  • chmod MODE FILE — change a file’s permission bits.

Commands and flags

These commands appear in the short example below.

Command Meaning
id Show user ID (uid), primary group ID (gid), and group memberships.
mktemp Create an empty temporary file with a unique name and owner-only access.
ls -l "$permission_file" -l shows a detailed listing, including permissions, owner, and group.
chmod 640 "$permission_file" Give the owner read/write access, the group read access, and others no access.
rm "$permission_file" Remove only the example’s temporary file.

Bash syntax: permission_file=$(…) saves a command’s output; "$permission_file" inserts that saved path as one argument.

The concepts that matter

1. Processes access files using an identity

Linux processes run with a user identity and group memberships. Access checks use those credentials. A service account is a user too, even if no person logs in with it.

A successful read from your own terminal does not prove a service can read the same file. The service may run as a different user with different groups.

2. Ownership determines which permission category applies

Each file has an owner, an owning group, and permission bits for owner, group, and others.

For ordinary mode-bit checks, Linux uses owner permissions if the process’s user owns the file. Otherwise it uses group permissions if a process group matches; otherwise it uses others. It does not add the three categories together.

In an ls -l listing, the first name is the owner and the second is the group. These are separate identities even when their names happen to match.

3. Read, write, and execute mean specific things

For a regular file, r permits reading, w permits changing contents, and x permits execution. In a mode such as -rw-r-----, the initial - means regular file; the remaining characters form three groups: rw-, r--, and ---.

Numeric modes express the same bits: read = 4, write = 2, execute = 1. Add them within each category. Mode 640 therefore means owner 6 (read + write), group 4 (read), others 0 (none). Execute permission does not turn arbitrary data into a valid program.

4. Directory permissions control the path

For a directory, read permits listing names, write permits changing entries, and execute permits traversal and access by name. Creating or removing entries normally requires both write and execute permissions on the containing directory.

A readable file can still be unreachable if a parent directory blocks traversal. Conversely, deleting a filename is primarily controlled by its directory, not the file’s own write bit. Additional rules can apply.

Use the access the application needs. Mode bits are one layer: ACLs, security policies, and read-only mounts can also affect access. Widening permissions indiscriminately can expose data without resolving the actual cause.

One small example

Optional: use one Bash terminal as an ordinary Linux user. Run the lines separately and continue only if mktemp succeeds:

id
permission_file=$(mktemp)
ls -l "$permission_file"
chmod 640 "$permission_file"
ls -l "$permission_file"
rm "$permission_file"

In the first listing, expect owner-only permissions, normally -rw-------. After chmod, look for -rw-r-----: the group gained read access, while ownership stayed the same. Your user, group, filename, and timestamp will vary. This inspects the mode change; it does not test access as another account.

chmod and the final removal normally print nothing on success. The file stays empty and is deleted by the last line. No existing files or accounts are changed.

Keep this idea: check who the process runs as, who owns the file, and which permissions apply along the path.