File Permissions & ACLs

chmod, chown, umask, SUID/SGID/sticky bit, and POSIX ACLs for fine-grained access control.

Overview

Understanding permissions is non-negotiable for DevOps. Every SSH key must be 600. Every script needs +x. Every shared directory needs SGID. Get this wrong and you get 'Permission denied' with no obvious fix — or worse, a security hole.

Reading ls -l Output

Every ls -l line starts with 10 characters: drwxr-xr-x - Position 1: file type (-=file, d=directory, l=symlink, b=block device) - Positions 2-4: owner permissions (r/w/x) - Positions 5-7: group permissions (r/w/x) - Positions 8-10: others permissions (r/w/x)

The 4-2-1 Rule

Octal permissions are three digits, each a sum of: 4=read, 2=write, 1=execute. - 7 = 4+2+1 = rwx (full access) - 6 = 4+2+0 = rw- (read/write, no execute) - 5 = 4+0+1 = r-x (read and execute, no write) - 4 = 4+0+0 = r-- (read only)

Memoise the pairs: 755 (web server), 644 (config files), 700 (~/.ssh), 600 (private keys).

File permissions are the foundation of Linux security. Every file and directory has an owner (user), an owning group, and permission bits split into three sets: owner, group, and others.

Octal vs symbolic chmod notation: chmod 755 is identical to chmod u=rwx,g=rx,o=rx. Octal maps directly: 4=read, 2=write, 1=execute, so 7=rwx, 6=rw-, 5=r-x, 4=r--.

umask: The user file-creation mask subtracts permissions from the default. Default umask 022 means new files get 644 (666 minus 022) and directories get 755 (777 minus 022). Change with umask 027 to give group read-only and no other access.

SUID bit (4000): When set on an executable, the process runs as the file's owner, not the calling user. /usr/bin/passwd uses SUID to let any user write to /etc/shadow (owned by root). Set with chmod u+s or chmod 4755.

SGID bit (2000): On executables, runs as the file's group. On directories, new files created inside inherit the directory's group rather than the creator's primary group — essential for shared project directories. Set with chmod g+s.

Sticky bit (1000): On directories like /tmp, only the file owner (or root) can delete files even if the directory is world-writable. Set with chmod +t.

POSIX ACLs: Standard permissions support only one user and one group. getfacl shows ACLs, setfacl -m u:alice:rw file grants alice read/write without changing the owning group. setfacl -m d:u:alice:rw dir sets default ACL for new files in a directory. ACL entries are stored as extended attributes.

Key concepts

chmod octal vs symbolic: chmod 755 == chmod u=rwx,g=rx,o=rx. Octal: 4=r, 2=w, 1=x. Symbolic: u/g/o/a and +/-/= operators.
umask: Mask subtracted from default permissions on creation. umask 022 → files 644, dirs 755. umask 027 → files 640, dirs 750.
SUID/SGID/sticky bit: SUID (4xxx): execute as file owner. SGID (2xxx): execute as file group; on dirs, new files inherit group. Sticky (1xxx): on dirs, only owner can delete.
POSIX ACL (getfacl/setfacl): Extends standard ugo model to grant per-user and per-group permissions. setfacl -m u:alice:rw file; getfacl shows current ACL. Default ACLs apply to new files inside directories.

When to use it

Hardening file access on multi-user systems
Setting up shared directories with SGID for consistent group ownership
Granting fine-grained access without creating new groups (ACLs)
Security audits — finding world-writable or SUID files

Interview questions

Explain the difference between octal permissions 755 and 700, and when you would use each.
What is the SUID bit, where is it legitimately used, and what security risk does it pose?