Linux is a multi-user, multi-tenant operating system by design. Every process, file, and directory is bound to a specific User ID (UID) and Group ID (GID). Understanding how Linux enforces access control prevents common production pitfalls like Permission denied errors in CI/CD pipelines or accidental permission leaks (chmod 777).
1. Users, Groups & Identity
Every account on Linux has a unique numerical identifier:
| Account Type | Typical UID Range | Examples | Purpose |
|---|---|---|---|
| Superuser (root) | 0 | root | Unrestricted administrative control across the kernel |
| System Accounts | 1 ā 999 | www-data, nginx, postgres, daemon | Unprivileged service daemons (cannot log in directly) |
| Human / Regular Users | 1000+ | ubuntu, alice, deploy | Interactive users and DevOps deployment workers |
2. Deconstructing the 10-Character Permission String
When you run ls -l, each entry begins with a 10-character mode string:
File vs. Directory Permission Semantics
The permissions r, w, and x have fundamentally different meanings for files versus directories:
| Permission | Octal Value | Meaning for a File | Meaning for a Directory |
|---|---|---|---|
r (Read) | 4 | Open and read file contents (cat, less) | List files within the folder (ls) |
w (Write) | 2 | Modify, save, or truncate file content | Create, rename, or delete files inside the folder |
x (Execute) | 1 | Run file as a binary program or shell script | Enter directory (cd) and access file metadata |
If a directory lacks the x (execute) bit, users cannot cd into it or access any files inside it, even if the individual files have r (read) permissions!
3. The Octal Mode Calculation
Permissions are represented by three octal digits (one each for Owner, Group, and Others). Each digit is the sum of its permission values (r=4, w=2, x=1):
4. Modifying Permissions with chmod
Numeric Mode (Fast & Explicit)
Symbolic Mode (Targeted Add/Remove)
Use symbols: Users (u), Groups (g), Others (o), All (a), with operators + (add), - (remove), = (set exact):
5. Special Permission Bits: SUID, SGID & Sticky Bit
Beyond basic rwx, Linux provides three special permission bits for advanced access control:
| Special Bit | Octal Value | Symbol in ls -l | Practical Purpose | Real-World Example |
|---|---|---|---|---|
| SUID (Set User ID) | 4000 | s in owner (rwsr-xr-x) | Executable runs with privileges of the file owner, not the invoking user. | /usr/bin/passwd (allows normal users to update /etc/shadow) |
| SGID (Set Group ID) | 2000 | s in group (rwxr-sr-x) | New files created in directory automatically inherit the parent directory's group. | Shared team collaboration folders (/var/www/shared) |
| Sticky Bit | 1000 | t in others (rwxrwxrwt) | Users can only delete or rename files that they personally own, even in a world-writable directory. | /tmp and /var/tmp |
6. Changing File Ownership with chown & chgrp
7. Default File Creation Mask: umask
When an application creates a new file, the initial permissions are calculated by subtracting the umask value from system defaults:
8. Administrative Elevation: sudo & visudo
sudo (SuperUser DO) allows authorized users to run security-sensitive commands without sharing the root password:
Safe Editing of /etc/sudoers with visudo
Never edit /etc/sudoers directly with nano or vim. Always use visudo, which performs strict syntax validation before writing changes to disk (preventing accidental system lockout):
Summary
- Every file is governed by three permission triplets: Owner, Group, Others.
- Read = 4, Write = 2, Execute = 1.
- Standard configurations:
755(binaries, scripts, directories),644(configs, code),600(SSH keys, secrets). - Special bits: SUID (
4000), SGID (2000), and Sticky Bit (1000) handle shared team folders and/tmp. - Change ownership with
chown -R user:group path. - Always configure passwordless elevation or restricted commands using
visudo.
In the next lesson, you will master Linux process management, PID hierarchies, resource monitoring with htop, signals (SIGTERM, SIGKILL), and systemd services!