Who may touch this file
Nine little letters decide who can read, change and run every file. Learn to read them, grant exactly one missing bit, and see why chmod 777 is never the fix.
Linux was built for many people sharing one machine, and every file still carries the answer to one question: who may do what to me? ls -l shows it as ten characters at the start of each line:
-rwxr-xr-- 1 panda dev 64 Oct 30 09:00 deploy.shThe first character is the type (- a file, d a directory). The next nine are three groups of three, for three kinds of people:
| Letters | Who | In this example |
|---|---|---|
rwx |
the owner (panda) |
read, write and run it |
r-x |
the file’s group (dev) |
read and run, not change |
r-- |
everyone else | read only |
Each letter is a bit: r = 4, w = 2, x = 1. Add them per group and you get the three digits people type: rwxr-xr-- is 754.
- Every open, write or run starts the same check.
- If you own the file, the owner bits decide - and that is the end of it. If the owner has no r, the owner cannot read, even when everyone else can.
- Not the owner? If you belong to the file's group, the group bits decide.
- Otherwise, the bits for everyone else. Exactly one group of three is ever used.
Grant exactly what’s missing
chmod changes the bits, either as digits (chmod 754 deploy.sh) or as a change to make: who (u owner, g group, o others, a all), then +, - or =, then the letters. chmod u+x deploy.sh adds one bit, run-for-the-owner, and touches nothing else.
A file is -r--r--rw- and you own it. Can you write to it?
Linux picks one class first - owner, then group, then everyone else - and uses only its bits. You are the owner, so r-- decides: you can read but not write, even though a stranger could. (As the owner you could chmod u+w and then write.)
Folders have the same bits, with different meanings
On a directory, r lets you list the names in it, w lets you create, delete and rename entries in it, and x lets you go into it and reach anything inside.
That gives one surprise worth remembering: deleting a file needs write permission on the folder, not on the file. A read-only file in your own folder can still be deleted by you. A file you could rewrite completely can’t be deleted if you lack write permission on its folder.
Only who can chmod a file, whatever its current bits say?
Changing the mode is reserved for the file's owner and privileged processes. Write permission lets you change the contents, never the permissions - otherwise any rw-rw-rw- file could be made yours.
Everything above ran in your browser. Now try it in a real terminal: any Linux machine, a Mac's Terminal app, or Windows with WSL. Nothing to install beyond that.
On Linux, a Mac or WSL:
printf 'echo it runs\n' > hello.sh
ls -l hello.sh # -rw-r--r-- (or -rw-rw-r--): no x, nobody may run it
./hello.sh # Permission denied
echo $? # 126: found, but not executable
bash hello.sh # runs: bash only needs to READ the file
chmod u+x hello.sh && ./hello.sh
ls -l /etc/shadow # Linux/WSL: password hashes, unreadable to youSources
Missions and quizzes above earn their own XP. This marks the lesson done.