Standard Linux File Permissions: Read, Write, Execute (chmod & chown)

At the core of Linux multi-user security is the POSIX file permission model. Every file, directory, socket, and block device on a Linux filesystem is bound to an owner user, an owner group, and an access mode that dictates who can read, modify, or execute the resource. For systems administrators, mastering permission manipulation via chmod and chown is critical for securing web servers, containers, databases, and user home directories.

The POSIX Triple Security Model

When you inspect files using ls -l or stat, permissions are displayed as a 10-character string (e.g. -rwxr-xr--):

Files vs Directories: The Critical Distinction for Execute (x)

The meaning of Read, Write, and Execute shifts fundamentally between files and directories:

• Regular Files:
  • Read (r): Open and view file contents (e.g. via cat, less).
  • Write (w): Modify, append to, or truncate file contents.
  • Execute (x): Execute the file as a compiled binary or interpreted script.
• Directories:
  • Read (r): Read the list of filenames inside the directory (e.g. ls).
  • Write (w): Create, delete, or rename files inside the directory (requires x as well).
  • Execute (x): Traverse or "enter" the directory (e.g. cd, access files inside).

Numeric (Octal) vs Symbolic Notation

Linux administrators modify permissions using the chmod utility via two distinct syntax modes:

1. Octal (Numeric) Representation

Each permission is assigned a base-2 binary weight: Read = 4, Write = 2, Execute = 1. Adding these values produces an octal digit (0 through 7) for each entity:

Common enterprise octal configurations:

# 644: Owner rw, Group r, Other r (standard web documents, configs)
chmod 644 /var/www/html/index.html

# 755: Owner rwx, Group rx, Other rx (standard directories and binaries)
chmod 755 /usr/local/bin/deploy.sh

# 600: Owner rw, Group none, Other none (SSH private keys, DB secrets)
chmod 600 ~/.ssh/id_ed25519

2. Symbolic Representation

Symbolic notation modifies specific bits without overwriting the entire permission mask:

• Targets: u (user/owner), g (group), o (others), a (all).
• Operators: + (add), - (remove), = (set explicitly).

# Add execute permission to the owner only
chmod u+x backup.sh

# Revoke write and execute permissions from other/world
chmod o-wx database.sqlite

# Grant group read and write
chmod g+rw /opt/app/shared.log

Managing Ownership with chown and chgrp

Only the superuser (root or a user with sudo privileges) can reassign file ownership in Linux:

# Change owner to www-data and group to www-data (Debian/Ubuntu web server)
sudo chown www-data:www-data /var/www/html -R

# On RHEL/Rocky/Fedora web servers (Apache runs as apache user)
sudo chown -R apache:apache /var/www/html

# Change owner only, preserving existing group
sudo chown deployuser /opt/myapp/bin

# Change group only
sudo chgrp developers /opt/myapp/code

Summary

The Linux file permission architecture enforces multi-tenant boundary integrity. By understanding the distinction between file and directory execution, selecting between octal and symbolic chmod, and assigning appropriate user and group ownership via chown, administrators build robust, defense-in-depth Linux systems.