Linux file permissions explained: ls -l, chmod and chown (with diagrams)

"Permission denied" is one of the first walls everyone hits in the terminal. The fix is rarely hard. What makes it feel hard is that the output of ls -l looks like noise until someone explains it once, column by column.

So let's do exactly that. By the end you will be able to read any permission string, and fix it with chmod and chown.

Why Unix has users and groups at all

Back when computers were expensive, a university might have one computer with many terminals wired to it: one for the physics department, one for maths, one for administration. Inside physics alone there would be teachers and students, each needing their own files, and some shared ones.

One machine, many people. Unix solved this with users (every person has an account) and groups (a set of users who share access). That multi-user design is still how every Linux server, Mac and cloud VM works today.

You can see who you are and which groups you belong to:

id -gn prints your primary group. Every user belongs to at least one group, and that primary group matters, as you will see in a second.

Read the output of ls -l, column by column

Ownership: who owns a new file?

When you create a file, you become its owner, and your primary group becomes its group. Everyone else on the system is called others.

So every file has exactly three audiences:

1. User (the owner)
2. Group (members of the file's group)
3. Others (everyone else)

Permissions: read, write, execute

Each audience can have three permissions:

• r (read): see the contents of the file.
• w (write): modify the file. Deleting also needs write permission.
• x (execute): run the file as a program. In Unix everything is a file, including programs like ls itself, and you need x to run one.

Now the nine characters make sense. They are three blocks of three: user, then group, then others. A letter means the permission is granted, a dash means it is not.

Change ownership with chown

The syntax is chown user:group path. Let's try to hand a file to root:

You cannot give your file away as a normal user, so you run it with sudo. After that, ls -l shows root everyone for that file.

Change only one of the two:

sudo chown bob file.txt          # only the user
sudo chown :developers file.txt  # only the group
sudo chown -R www-data:www-data /var/www/html   # a whole directory, recursively

Change permissions with chmod (symbolic mode)

chmod means "change mode". The symbolic form is: who (u user, g group, o others), then =, + or -, then the permissions.

Here is a real session. Notice how each command changes one part of the string:

chmod u=rwx file-1      # user gets exactly read, write, execute
chmod u+w file-1        # add write for the user
chmod o-r file-1        # remove read from others
chmod o+x file-1        # add execute for others
chmod u=rw,go=r file-1  # several changes in one go

Why would you add x? Because without it, running a script fails:

The shortcut: octal numbers like 755 and 400

Writing u=rwx,g=rx,o=rx every time gets old. Each block of three permissions is really a 3-bit binary number, and that number fits in a single octal digit:

So chmod takes three digits: user, group, others.

You don't need to memorise every combination. 755, 644, 600, 700 and 400 cover nearly everything you will meet.

Fixing "Permission denied" in four steps

1. Run ls -l file and read the three blocks.
2. Run id to see your user and groups. Which block applies to you?
3. Need to run it? You need x. Need to edit it? You need w.
4. Fix it with chmod, or sudo chown if the file belongs to someone else.

Learn the command line properly

Permissions are one section of CLI Mastery, a 57-lesson course that takes you from "what is a terminal" to writing shell scripts and configuring a web server over SSH on AWS. Every concept is drawn out first, like the diagrams above, then done live in the terminal.

Not sure yet? Watch a lesson first: Absolute Path vs Relative Path is free, no account needed.