ENGIMY.IO - CHEATSHEET
LINUX × QUICK REFERENCE
PERM
LINUX REFERENCE

LINUX
PERMISSIONS CHEATSHEET.

A comprehensive reference for Linux file permissions – owner, group, others, chmod, chown, special permissions, and hardening. All in one place.

REFERENCE v1.0

Linux Permissions Quick Reference

Everything you need day‑to‑day – ownership, permissions, and hardening.

Understanding Permissions

Permission Types
  • r – read
  • w – write
  • x – execute
  • File: read = view content, write = modify, execute = run
  • Directory: read = list contents, write = create/delete, execute = cd into
Permission Classes
  • u – user (owner)
  • g – group (owning group)
  • o – others (everyone else)
  • a – all (u+g+o)

Permission Representation

// ls -l output
-rwxr-xr-- 1 alice users 1024 Jan 15 10:30 file.txt

// Breakdown
- rwx r-x r--
│ │   │   │
│ │   │   └─ Others: read (r--)
│ │   └───── Group: read + execute (r-x)
│ └───────── Owner: read + write + execute (rwx)
└─────────── File type: - (file), d (directory), l (symlink), c (char), b (block)

Numeric (Octal) Permissions

Value Permission Binary
0 --- 000
1 --x 001
2 -w- 010
3 -wx 011
4 r-- 100
5 r-x 101
6 rw- 110
7 rwx 111

Common Permission Modes (Numeric)

Mode User Group Others Use Case
755 rwx r-x r-x Scripts, executable files
644 rw- r-- r-- Configuration files, text
700 rwx --- --- Private scripts (owner only)
600 rw- --- --- Private files (SSH keys)
750 rwx r-x --- Group‑shared scripts
640 rw- r-- --- Group‑shared config
755 rwx r-x r-x Directories (execute needed to enter)
644 rw- r-- r-- Directories (read list only)
777 rwx rwx rwx World‑writable (insecure, avoid)

Changing Permissions

chmod – Change Mode

// Symbolic method
chmod u+x file          // Add execute for owner
chmod g-w file          // Remove write for group
chmod o=r file          // Set read-only for others
chmod a=rwx file        // Full permissions for all
chmod u+rwx,go+rx file  // Multiple changes

// Numeric method
chmod 755 script.sh
chmod 644 config.conf
chmod 600 private.key
chmod 700 secure_dir

// Recursive (directories)
chmod -R 755 directory/
chmod -R u+rwx,go+rx directory/

// Change only directories (not files)
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

chown – Change Owner

// Change user owner
chown alice file

// Change user and group
chown alice:users file

// Change only group
chown :users file
chgrp users file

// Recursive
chown -R alice:users directory/

// Copy permissions from another file
chown --reference=reference_file file

Special Permissions

SUID (Set User ID)

  • Numeric: 4xxx (e.g., 4755)
  • Symbolic: chmod u+s file
  • Executes with owner's privileges
  • Appears as s in user execute position
  • Example: /usr/bin/passwd
  • Security risk – use sparingly

SGID (Set Group ID)

  • Numeric: 2xxx (e.g., 2755)
  • Symbolic: chmod g+s file
  • File: executes with group's privileges
  • Directory: new files inherit group
  • Appears as s in group execute position
  • Example: shared team directories

Sticky Bit

  • Numeric: 1xxx (e.g., 1777)
  • Symbolic: chmod +t directory
  • Only owner can delete files in directory
  • Appears as t in others execute position
  • Example: /tmp (world‑writable)
  • Prevents users from deleting others' files
Special Permissions Quick Reference
Special Symbol Numeric Effect
SUID u+s 4000 Run as owner
SGID g+s 2000 Run as group / inherit group
Sticky +t 1000 Restrict deletion

Special Permission Examples

// SUID – run as owner
chmod u+s /usr/bin/myapp
chmod 4755 /usr/bin/myapp

// SGID – inherit group (directory)
chmod g+s shared_dir/
chmod 2755 shared_dir/

// Sticky bit – restrict deletion
chmod +t /tmp
chmod 1777 /tmp

// Combine special permissions
chmod 6777 file        // SUID + SGID + full permissions (very dangerous)

umask (Default Permissions)

  • umask – default permission mask for new files
  • Formula: permissions = 666 - umask (files) or 777 - umask (directories)
umask File Permissions Directory Permissions Use Case
022 644 (rw-r--r--) 755 (rwxr-xr-x) Default (most systems)
002 664 (rw-rw-r--) 775 (rwxrwxr-x) Group collaboration
077 600 (rw-------) 700 (rwx------) Private (secure)
027 640 (rw-r-----) 750 (rwxr-x---) Group private 
// View current umask
umask

// Set umask (temporary)
umask 002

// Set umask permanently (in ~/.bashrc)
echo "umask 002" >> ~/.bashrc

Access Control Lists (ACL)

  • ACL – fine‑grained permissions beyond u/g/o
  • Support multiple users/groups
  • Commands: setfacl, getfacl
// Check if ACL is supported
mount | grep acl

// View ACL
getfacl file.txt

// Set user permission
setfacl -m u:alice:rw file.txt

// Set group permission
setfacl -m g:developers:rx directory/

// Remove ACL
setfacl -x u:alice file.txt

// Remove all ACL
setfacl -b file.txt

// Recursive
setfacl -R -m u:alice:rw directory/

Common Security Hardening

File Hardening
  • Set 600 for SSH keys (~/.ssh/id_rsa)
  • Set 644 for SSH public keys (~/.ssh/authorized_keys)
  • Set 700 for SSH directory (~/.ssh)
  • Set 644 for system config files
  • Set 640 for sensitive config (group read only)
  • Avoid 777 (world‑writable)
Directory Hardening
  • Set 750 for home directories (group read/execute)
  • Set 700 for sensitive directories
  • Set sticky bit on /tmp and /var/tmp
  • Avoid 777 (world‑writable)
  • Use SGID for shared directories

Find Files with Insecure Permissions

// Find world‑writable files
find / -type f -perm -0002 -ls 2>/dev/null

// Find world‑writable directories
find / -type d -perm -0002 -ls 2>/dev/null

// Find files with SUID/SGID
find / -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null

// Find files with no owner
find / -nouser -o -nogroup -ls 2>/dev/null

// Find files with 777 permissions
find / -perm 777 -ls 2>/dev/null

Secure File Deletion

// Shred (overwrite and delete)
shred -vfz file.txt      // Overwrite, zero, delete
shred -vfz -n 10 file.txt // 10 passes

// Secure deletion for directories
shred -vfz file1 file2
rm -f file1 file2

User & Group Management

// Create user
useradd -m -s /bin/bash alice
adduser alice             // interactive (Debian)

// Create group
groupadd developers

// Add user to group
usermod -aG developers alice

// Change password
passwd alice

// Delete user
userdel -r alice          // with home directory

// View user info
id alice
groups alice

// Switch user
su - alice                // switch with environment
sudo -u alice command     // run as user

sudo Configuration

// /etc/sudoers (use visudo)
// User specifications
alice ALL=(ALL) ALL       // Full sudo access
bob ALL=(ALL) NOPASSWD: ALL // No password
charlie ALL=(ALL) /usr/bin/systemctl, /usr/bin/apt // Limited commands

// Group specifications
%developers ALL=(ALL) ALL // Group sudo
%admins ALL=(ALL) NOPASSWD: ALL

// View sudo permissions
sudo -l

Common Permission Troubleshooting

Permission Denied
  • Check ownership: ls -l
  • Check group membership: groups
  • Check file/directory permissions
  • Use sudo if appropriate
Can't Execute
  • Check execute bit: chmod +x
  • Check shebang: #!/bin/bash
  • Check PATH: ./script vs script
Can't Write to Directory
  • Check directory write permission
  • Check parent directory permissions
  • Check ownership
Can't Delete File
  • Need write permission on parent directory
  • Check sticky bit on parent
  • Check ownership of the file
📌 Quick Reference
Permissions: r (4), w (2), x (1) – use octal (e.g., 755)
chmod: u/g/o + r/w/x, or numeric (644, 755, 600)
chown: user:group – change ownership
chgrp: change group only
umask: default permissions for new files (022 default)
Special: SUID (4xxx) – run as owner, SGID (2xxx) – inherit group, Sticky (1xxx) – restrict deletion
ACL: setfacl, getfacl – fine‑grained permissions
Secure: 600 for private files, 700 for private dirs, 755 for executables
← Back to All Cheatsheets