Linux Cheatsheet

Permissions and Ownership

Use this Linux reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

Permission Basics

Every file has three permission groups and three permission bits:

-rwxr-xr--  1  alice  staff  4096  Jan 1 12:00  script.sh
│└─┬──┘└─┬──┘└─┬──┘
│  │      │     └── other (world)
│  │      └──────── group
│  └─────────────── owner (user)
└────────────────── file type (- file, d dir, l symlink)

Bit	File	Directory
`r` (4)	read content	list contents
`w` (2)	write/modify	create/delete entries
`x` (1)	execute	enter (`cd`)

chmod — Change Mode

chmod 755 script.sh         # rwxr-xr-x (octal)
chmod 644 file.txt          # rw-r--r--
chmod 600 private.key       # rw------- (owner only)
chmod u+x script.sh         # add execute for owner
chmod g-w file.txt          # remove write for group
chmod o= file.txt           # clear all other perms
chmod a+r file.txt          # add read for all
chmod -R 755 dir/           # recursive

Common Octal Values

Octal	Symbolic	Use case
`700`	`rwx------`	private executables
`600`	`rw-------`	private files (SSH keys, secrets)
`644`	`rw-r--r--`	regular files
`664`	`rw-rw-r--`	group-editable files
`755`	`rwxr-xr-x`	executables, public dirs
`775`	`rwxrwxr-x`	group-writable dirs
`777`	`rwxrwxrwx`	avoid in production

chown — Change Owner

chown alice file.txt            # change owner
chown alice:staff file.txt      # change owner and group
chown :staff file.txt           # change group only
chown -R alice:staff dir/       # recursive

chgrp — Change Group

chgrp staff file.txt        # change group
chgrp -R devs project/      # recursive

Special Permission Bits

Bit	Octal	On file	On directory
setuid	4xxx	runs as file's owner	(rarely meaningful)
setgid	2xxx	runs as file's group	new files inherit group
sticky	1xxx	(legacy)	only owner can delete entries

chmod u+s /usr/bin/passwd   # setuid
chmod g+s /var/shared/      # setgid directory
chmod +t /tmp               # sticky bit
# numeric: prefix with extra digit
chmod 4755 binary           # setuid + rwxr-xr-x
chmod 1777 /tmp             # sticky + rwxrwxrwx

umask — Default Permission Mask

umask           # show current mask (e.g. 022)
umask 027       # set mask (temporary)

New files = 666 - umask; new dirs = 777 - umask.

umask	New file	New dir
`022`	`644`	`755`
`027`	`640`	`750`
`077`	`600`	`700`

Set permanently in ~/.bashrc or /etc/profile.

ACLs (Access Control Lists)

getfacl file.txt                        # view ACL
setfacl -m u:bob:rw file.txt            # grant bob rw
setfacl -m g:devs:rx dir/              # grant group devs rx
setfacl -R -m u:bob:rwx dir/           # recursive
setfacl -x u:bob file.txt              # remove bob's entry
setfacl -b file.txt                    # remove all ACL entries
# default ACL — inherited by new files in dir
setfacl -d -m u:bob:rw dir/

Viewing Permissions

ls -l file.txt              # standard view
stat file.txt               # full metadata including octal perms
namei -l /path/to/file      # show perms for each component of the path