How to Use chmod and chown - Linux File Permissions Guide

2025-01-11 Reading time: About 12 min Difficulty: Beginner

What you'll learn:

• Diagnose issues by reading ls -l output.
• Choose between chmod and chown, then apply the right fix.
• Stop using "sudo for everything".

Target Audience: Beginners starting to work with Ubuntu servers.

Note: Some steps need sudo.

Key term: A permissionThe read / write / execute access rules set on a file or directory. is a setting that says who may read, write, or run a file. People also call it an access right. This article uses the word permission.

rootThe special administrator account allowed to do anything on the system. is the administrator account that can do anything. sudo means "run just this one command as root". A group is a named set of users.

Decision Flow (Quick Reference)

Conclusion: On Permission denied, read ls -l first. Then pick chmod, chown, or sudo.

When you see "Permission denied", check this table from top to bottom.

The -d in ls -ld shows the directory itself. Without it you get a listing of what is inside.

First, Learn to Read ls -l (Most Important)

Conclusion: 90% of permission issues show their cause in ls -l. Learn to read it first.

90% of permission issues can be diagnosed with ls -l. Once you can read this, you can stop guessing with sudo.

$ ls -l sample.txt

-rw-r--r-- 1 user user  1234 Dec 17 12:00 sample.txt

Why this order?: A permission error is about who can do what. This order lets you split the problem into those two parts.

Understand rwx as "Decision Criteria"

Conclusion: What you can do depends on your role. Use that role as your decision rule.

The letter r means read. The letter w means write. The letter x means run. These three letters repeat three times, for owner, group, and other.

Example: rw-r--r--

Figure 1: Linux checks owner, then group, then other, and applies only the first set of rwx that matches. Once you match as owner, the group and other bits are never consulted. The diagram shows which set applies, not whether that set grants anything — if the matched set is ---, you can do nothing.

chmod: Start with Symbolic Notation (Accident Prevention)

Conclusion: Use symbolic notation such as u+w by default. Use numbers only when you can explain them.

Basic Usage

$ chmod u+w sample.txt

The name chmod is short for change mode. It changes the permissions of a file.

Meaning:

• u means the owner.
• w means write.
• The + adds that permission.

Why symbolic notation is safer: It shows exactly what changed. chmod u+w states the intent better than chmod 644. That makes mistakes easier to catch in review.

$ chmod 777 sample.txt

What happens if you get it wrong: chmod never changes the contents of a file. Even so, there is no "undo one step" command. Save the ls -l output before you run it, and restore that exact state if you need to go back.

How to try this safely: Practice inside your own directory, such as ~/perm-test. System files stay untouched.

Why is chmod 777 dangerous?

777 means "anyone can read, write, and execute".

Real-World Incident

The -R option applies the same setting to everything inside a directory. A production web server had /var/www/html set to chmod -R 777. This is what happened.

• An attacker uploaded a PHP file.
• That PHP file ran, and the server was taken over.
• Customer data leaked, and the service went down.

Why the Attack Succeeded

777 gives w (write) and x (execute) to other, which means everyone. So a file could be placed through the web server and then run.

Safe Alternatives

How to read numeric notation: r=4, w=2, x=1 summed together. For example, 755 = rwx(7) + r-x(5) + r-x(5) = owner has all permissions, group and others can only read and execute.

Watch Out for Directory Execute Permission

Conclusion: Without x on a directory you cannot cd into it. Check with ls -ld, then add only the minimum.

drwxr-xr-x 2 user user 4096 Dec 17 12:10 mydir

On a directory, x decides whether you can enter it. In other words, it decides whether cd works. The r bit alone is not enough. You can list the names, but you cannot go inside.

chown: Change Ownership Carefully

Conclusion: Change ownership only when you can explain why. The -R flag can break a running service.

Basic Usage

$ sudo chown user:user sample.txt

The name chown is short for change owner. It changes who owns a file.

Why sudo is required: Changing ownership is a system task. It would be unsafe if any user could claim someone else's files.

What happens if you get it wrong: chown has no undo command. To restore the old owner, you must know the old owner name.

How to try this safely: Save the ls -l output before you run chown. With that name recorded, the same command puts it back.

How chown -R broke production (with recovery)

What Happened

$ sudo chown -R myuser:myuser /var/www/html

Someone wanted to edit their own files. This is what happened.

• Apache and Nginx run as the www-data user.
• After the ownership change, the web server could not read the files.
• The site returned 403 Forbidden.

Recovery

$ sudo chown -R www-data:www-data /var/www/html

Correct Approach

If you only want to edit files, you do not need to change ownership. Pick one of these instead.

• Add yourself to the www-data group.
• Or edit with sudo -u www-data vim file.php.

sudo Is Not Magic

Conclusion: sudo hides the real cause. Diagnose with ls -l first, then use sudo only when you can explain why.

The sudo command simply runs something as root. It can hide a design problem in your permissions.

$ sudo chmod 777 ...

Real incidents from sudo abuse

Incident Pattern 1: Can't edit file anymore

$ sudo vim config.yaml

Later you try to edit it normally with vim config.yaml, and you see this.

E45: 'readonly' option is set (add ! to override)

Cause: Opening with sudo made the file root-owned. A .swp file may also have been created as root.

Solution

• Run sudo chown $USER:$USER config.yaml to restore ownership.
• Or use sudoedit config.yaml (sudo -e) from the start.

Incident Pattern 2: Home directory becomes root-owned

$ sudo chown -R root:root ~

After this you cannot log in. Your .bashrc cannot be read, and your SSH keys stop working.

Recovery: From another root session, run chown -R user:user /home/user.

Common Permission Denied Troubleshooting

Conclusion: Read ls -l to find the owner and the permissions. Decide your role, then apply the fix.

Case 1: Cannot Write to File

The >> symbol appends text to the end of a file. So the command below is a write operation.

$ echo "test" >> /etc/hosts

-bash: /etc/hosts: Permission denied

Diagnosis

$ ls -l /etc/hosts

-rw-r--r-- 1 root root 221 Dec 17 10:00 /etc/hosts

Cause

• The owner is root.
• You are in the other role, so you get r--, which is read only.

Common Misconception

"Just use sudo" is half right and half wrong. The file /etc/hosts is a system file, and it is writable only by root on purpose. Editing it with sudo is the correct fix. Still, understand why it is protected before you do it.

Fix

$ sudoedit /etc/hosts

To append only, this also works.

$ echo "test" | sudo tee -a /etc/hosts

Why sudo echo "test" >> /etc/hosts fails: the shellAn interactive program that reads the commands you type and runs them. handles >>, and it runs outside sudo. Only echo gets root, so the write still happens as your normal user and is refused.

Case 2: Cannot Execute Script

$ ./deploy.sh

-bash: ./deploy.sh: Permission denied

Diagnosis

$ ls -l deploy.sh

-rw-r--r-- 1 user user 1234 Dec 17 11:00 deploy.sh

Cause

• The permissions are rw-r--r--, so the execute bit x is missing.
• You own the file, yet you still cannot run it.

Fix

$ chmod u+x deploy.sh
$ ./deploy.sh

Why this is safe: u+x grants the execute bit to the owner only. Other users are not affected, so the change stays minimal.

Case 3: Cannot Enter Directory

$ cd /var/log/nginx

-bash: cd: /var/log/nginx: Permission denied

Diagnosis

$ ls -ld /var/log/nginx

drwxr-x--- 2 www-data adm 4096 Dec 17 10:00 /var/log/nginx

Cause

• The permissions are rwxr-x---, so other gets nothing.
• You are not www-data, and you are not in the adm group.

Fix Options

1. sudo cd does not work, because cd is a shell built-in. Use sudo ls /var/log/nginx to view the contents.
2. Add yourself to the adm group with sudo usermod -aG adm $USER, then log in again. Group information is loaded at login time.

Permission Diagnosis Checklist

Conclusion: Confirm your role with whoami and groups. Then read ls -l and pick the right fix.

When you see "Permission denied", check the following in order.

Step 1: Verify Your Identity

• Checked your username with whoami.
• Checked your group memberships with groups.

Step 2: Check File/Directory Status

• Checked permissions and owner with ls -l filename.
• Decided whether you are the owner, in the group, or other.
• Verified that the permission you need (r/w/x) is granted for your role.

Step 3: Choose Resolution Method

• If a permission is missing, add it with chmod.
• If the owner is different, change it with chown, which needs sudo.
• If it is a system file, use sudoedit or sudo.

Step 4: Verify Changes

• Confirmed the change with ls -l again.
• Verified that the intended operation now succeeds.
• Confirmed that no excessive permission, such as 777, was granted.

Practice Exercise (5 min)

Conclusion: Remove the write bit, hit the error, then recover. That is how the fix sticks.

Run this in your own practice directory. System files are never touched, so nothing breaks if you make a mistake.

$ mkdir ~/perm-test
$ cd ~/perm-test
$ touch a.txt
$ ls -l
$ chmod u-w a.txt
$ echo "test" > a.txt

Expected Result:

• You get "Permission denied".
• You can read ls -l and say that you own the file but the w bit is missing.

Recovery:

$ chmod u+w a.txt
$ echo "test" > a.txt
$ cat a.txt

test

Next Reading

Conclusion: Practice permission commands in the virtual terminal so the pattern sticks.

Once you have learned the decision pattern in this article, practice it hands-on at Penguin Gym Linux.

Command Quick Reference

• Permissions (Advanced) - Decision patterns
• How to Fix Permission Denied
• Top 10 Essential Commands