Linux Cheatsheet
Permissions and Ownership
Use this Linux reference while you build software engineering projects, review code, or refresh the syntax you reach for most.
Permission Basics
Every file has three permission groups and three permission bits:
-rwxr-xr-- 1 alice staff 4096 Jan 1 12:00 script.sh │└─┬──┘└─┬──┘└─┬──┘ │ │ │ └── other (world) │ │ └──────── group │ └─────────────── owner (user) └────────────────── file type (- file, d dir, l symlink)
| Bit | File | Directory |
|---|---|---|
r (4) | read content | list contents |
w (2) | write/modify | create/delete entries |
x (1) | execute | enter (cd) |
chmod — Change Mode
chmod 755 script.sh # rwxr-xr-x (octal) chmod 644 file.txt # rw-r--r-- chmod 600 private.key # rw------- (owner only) chmod u+x script.sh # add execute for owner chmod g-w file.txt # remove write for group chmod o= file.txt # clear all other perms chmod a+r file.txt # add read for all chmod -R 755 dir/ # recursive
Common Octal Values
| Octal | Symbolic | Use case |
|---|---|---|
700 | rwx------ | private executables |
600 | rw------- | private files (SSH keys, secrets) |
644 | rw-r--r-- | regular files |
664 | rw-rw-r-- | group-editable files |
755 | rwxr-xr-x | executables, public dirs |
775 | rwxrwxr-x | group-writable dirs |
777 | rwxrwxrwx | avoid in production |
chown — Change Owner
chown alice file.txt # change owner chown alice:staff file.txt # change owner and group chown :staff file.txt # change group only chown -R alice:staff dir/ # recursive
chgrp — Change Group
chgrp staff file.txt # change group chgrp -R devs project/ # recursive
Special Permission Bits
| Bit | Octal | On file | On directory |
|---|---|---|---|
| setuid | 4xxx | runs as file's owner | (rarely meaningful) |
| setgid | 2xxx | runs as file's group | new files inherit group |
| sticky | 1xxx | (legacy) | only owner can delete entries |
chmod u+s /usr/bin/passwd # setuid chmod g+s /var/shared/ # setgid directory chmod +t /tmp # sticky bit # numeric: prefix with extra digit chmod 4755 binary # setuid + rwxr-xr-x chmod 1777 /tmp # sticky + rwxrwxrwx
umask — Default Permission Mask
umask # show current mask (e.g. 022) umask 027 # set mask (temporary)
New files = 666 - umask; new dirs = 777 - umask.
| umask | New file | New dir |
|---|---|---|
022 | 644 | 755 |
027 | 640 | 750 |
077 | 600 | 700 |
Set permanently in ~/.bashrc or /etc/profile.
ACLs (Access Control Lists)
getfacl file.txt # view ACL setfacl -m u:bob:rw file.txt # grant bob rw setfacl -m g:devs:rx dir/ # grant group devs rx setfacl -R -m u:bob:rwx dir/ # recursive setfacl -x u:bob file.txt # remove bob's entry setfacl -b file.txt # remove all ACL entries # default ACL — inherited by new files in dir setfacl -d -m u:bob:rw dir/
Viewing Permissions
ls -l file.txt # standard view stat file.txt # full metadata including octal perms namei -l /path/to/file # show perms for each component of the path