Step 23. Permissions 1 — rwx, Rules Carved Into Files

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★☆☆☆ | Estimated time: 3 hours

Prerequisites: you need to know the basic Linux commands and editor usage from Steps 18–22. An Ubuntu virtual machine (or WSL) is required.

• What you need: an Ubuntu terminal.
• Caution: today’s exercise is safe. It’s all about creating practice files and folders in your home folder and changing their permissions.
• Note: the read-only commands that inspect system file permissions were actually run, while the outputs of the permission-changing chmod experiments are marked as "output examples."

Just as a house has a front door, every file and folder in Linux has a "door." And written on each door is "who may open it." This is Linux’s permission system. That cryptic string like -rwxr-xr-- you’ve seen every time you ran ls -l — today you learn to read it.

In security study, permissions underlie almost everything. "Why can’t I read this file?" is a permissions question, and much of what a hacker does after seizing a system is "gaining higher privileges." Today we start by learning to read the strings of those rules.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Interpret a string like -rwxr-xr-- at the front of ls -l output, class by class
• Explain the three classes — owner, group, others — and the three actions r, w, x
• Convert permission strings and octal notation (644, 755, etc.) in both directions
• Change file permissions with chmod, using both numeric and symbolic notation
• Confirm by experiment that x on a file (execute) differs from x on a folder (enter)

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. Three Kinds of Users

Permissions divide "for whom" into three classes.

• Owner (user, u): the file’s owner. Usually the person who created it.
• Group (g): the user group assigned to the file. For example, granting read access to an entire "dev team" group.
• Others (o): everyone who is neither the owner nor a group member. Effectively "anyone."

2-2. Three Kinds of Actions

"What may be done" divides into three actions.

• r (read): can view the contents. For a file, read it with cat; for a folder, list it with ls.
• w (write): can modify or delete the contents.
• x (execute): for a file, can run it as a program. For a folder, it means "can enter it (cd)" — the point beginners confuse most.

2-3. Why Do Groups Exist?

If we have "owner" and "others," why bother with "group"? Imagine a company server. Five developers share a project folder. Setting it to "open to everyone (permissions for others)" lets people from other departments peek inside. Conversely, if only one owner has permissions, collaboration fails.

This is where you create a "dev team" group and set the folder’s group to dev team — granting permissions only to teammates while blocking everyone else. A group is a device for "bundling permissions to a specific set of people." One user can belong to multiple groups, and you can see your groups with the groups command. For now, just remember its reason for existing: "the middle class is for team-level permission management."

2-4. Dissecting the Permission String

The front of ls -l output always has 10 characters:

-rwxr-xr--

• First character: file type. - is a regular file, d is a folder (directory)
• Next 3 characters: the owner’s permissions. rwx = read, write, and execute all allowed
• Next 3 characters: the group’s permissions. r-x = read and execute only, no write (- marks "absent")
• Last 3 characters: others’ permissions. r-- = read only

So this string is the rule: "the owner may do everything, the group may read and execute, everyone else may only read."

2-5. Permissions as Numbers — Octal

When changing permissions, numbers are often used instead of strings. The rule is simple:

• r = 4, w = 2, x = 1
• One class’s permission is the sum of these. Example: rwx = 4+2+1 = 7, r-x = 4+0+1 = 5, r-- = 4 = 4

Write the three classes together and you get a three-digit number like 754. rwxr-xr-- is 7, 5, 4 — that is, 754. Frequently seen combinations:

The reason r, w, x happen to be 4, 2, 1 is that they’re binary place values (100, 010, 001). The computer stores permissions as 9 switches (3 classes × 3 actions), and we simply read them as three octal digits.

3. Follow Along

3-1. Reading Real Permission Strings on a Live System

Before making practice files, let’s read real permissions on the Ubuntu in front of you. Querying changes nothing on the system:

ls -l /etc/passwd /bin/ls

-rwxr-xr-x 1 root root   142312 Jun 23  2025 /bin/ls
-rw-r--r-- 1 root root     1490 Sep  8 21:12 /etc/passwd

(Verified 2026-09-09 on Ubuntu 24.04. Sizes and dates differ by environment.)

How to read the output: /bin/ls (the actual body of the ls command we just used) is -rwxr-xr-x, i.e., 755 — "owner (root) may modify; everyone may read and execute." The reason you can run ls is exactly those three xs. /etc/passwd is 644 — "everyone may read; only root may modify," because it’s a user roster that everyone must be able to read.

Let’s look at folder permissions too. The -d option means "show the folder itself, not its contents":

ls -ld /home /etc /tmp

drwxr-xr-x 100 root root 4096 Sep  9 11:28 /etc
drwxr-xr-x   2 root root 4096 Apr 22  2024 /home
drwxrwxrwt   9 root root 4096 Sep  9 11:28 /tmp

(Verified 2026-09-09.)

How to read it: every first character is d — folders. /etc and /home are 755 — everyone can enter (x), but only root can write. /tmp is drwxrwxrwt — a temporary plaza with rwx open to everyone, and the final t is a special device (the sticky bit) meaning "you can’t delete other people’s files." For now, just note "there’s one more special letter" and move on.

3-2. Where Default Permissions Come From — umask

Let’s confirm why new files automatically get 644 and new folders 755:

umask

0022

(Verified 2026-09-09.)

How to read it: umask is "the amount to shave off the default maximum permissions." A file’s maximum is 666 (execute permission is not granted by default) and a folder’s maximum is 777; shaving 022 off these gives — files 644, folders 755. That’s the source of the defaults you saw in Section 3-1. Permissions are not "added from a state of nothing" but a concept of "defaults exist, and you adjust them."

3-3. Viewing and Changing My Files’ Permissions

Now experiment with files you make yourself:

cd ~
touch report.txt
ls -l report.txt

-rw-rw-r-- 1 lee lee 0  Sep 9 10:23 report.txt

(Output example — since touch creates a file, it was not run in this chapter’s verification environment. The permission part comes out as 644 or 664 depending on the environment’s umask.)

How to read it: let’s interpret -rw-rw-r--. - regular file; rw- the owner reads and writes; rw- the group also reads and writes; r-- others only read. The lee lee after that is the owner name and group name.

First chmod experiment:

echo "a very important secret" > secret.txt
chmod 600 secret.txt
ls -l secret.txt

-rw------- 1 lee lee 18  Sep 9 10:25 secret.txt

(Output example.)

How to read it: chmod is short for "change mode." The permissions changed to rw------- — only the owner reads and writes; group and others can do nothing. 6 = r+w (4+2), 0 = no permissions, 0 = no permissions. Confirm with your eyes that the numbers and the string match exactly.

Make a prediction: if you run chmod 000 secret.txt, can I — the file’s owner — read it with cat secret.txt? (Answer: even the owner can’t read it. You’ll get cat: secret.txt: Permission denied. Once you’ve confirmed, restore it with chmod 600 secret.txt. Note that root is the exception to this rule — that story comes in Step 24.)

3-4. Experiencing Execute Permission (x)

Using nano, which you learned in Step 22, create a script:

nano run.sh

Inside nano, write the following two lines, save (Ctrl+O, Enter), and exit (Ctrl+X):

#!/bin/bash
echo "The script has run!"

Now check the permissions and try running it:

ls -l run.sh
./run.sh

-rw-rw-r-- 1 lee lee 45  Sep 9 10:30 run.sh
bash: ./run.sh: Permission denied

(Output example.)

How to read it: "permission denied." This file has no x permission, so it can’t be executed. Here ./ means "of the current folder" — Linux does not look in the current folder along the execution path, so you must include it.

Give it x and run again:

chmod +x run.sh
ls -l run.sh
./run.sh

-rwxrwxr-x 1 lee lee 45  Sep 9 10:30 run.sh
The script has run!

(Output example.)

How to read it: +x means "add x to all classes." The permissions changed to rwxrwxr-x, and it ran.

Why: in Linux, whether a file "is a program" is decided not by an extension but by the x permission. The name .sh is merely a hint for humans — the system looks only at the x bit. An important difference from Windows’ .exe mindset.

3-5. A Folder’s x Is "Permission to Enter"

mkdir secret_room
echo "treasure in the room" > secret_room/treasure.txt
chmod 644 secret_room
ls secret_room

ls: cannot open directory 'secret_room': Permission denied

(Output example.)

How to read it: you granted r but took away x — and now you can’t even see the listing. When x is missing from a folder, ls fails.

chmod 755 secret_room
ls secret_room
cat secret_room/treasure.txt

treasure.txt
treasure in the room

(Output example.)

Why: on a folder, x is not "execute" but "allowed to enter." It helps to think of reading the listing at a room’s door (r) and entering the room (x) as separate things. That’s why folders are usually given r and x as a set — the reason the folder default is 755.

3-6. Adding and Subtracting with Symbolic Notation

Besides numbers (octal), you can grant and revoke permissions with symbols. Combine class symbols u (owner), g (group), o (others), a (all) with operator symbols + (add), – (remove), = (set exactly to this):

chmod 644 report.txt
chmod g+w report.txt
chmod o-r report.txt
ls -l report.txt

-rw-rw---- 1 lee lee 0  Sep 9 10:41 report.txt

(Output example.)

How to read it: g+w is "add write to the group" (644 → 664); o-r is "remove read from others" (664 → 660). The final result is rw-rw----.

Why: numeric notation "specifies the final state wholesale," while symbolic notation "adds and subtracts from the current state." When you want to nudge one specific class on several files, symbolic notation is handy. You need to read both to understand other people’s documentation.

4. Missions & Exercises

Mission — Building Your Own Vault

1. Create a vault folder and make pw.txt inside it (any content)
2. Set the folder to 700 and the file to 600
3. Check the final state with the two commands ls -ld vault and ls -l vault/pw.txt
4. Verification experiment: after chmod 000 pw.txt, confirm both cat pw.txt and nano pw.txt are denied, then restore to 600
5. Calculation check: create practice.txt, apply chmod 640, then compare the ls -l output against the string you computed by hand

The answer isn’t written here — verify it in Section 5.

Exercises

Question 1. Convert these permission strings to octal: rwxr-x---, rw-------, r-xr-xr-x

Question 2. Expand the numbers 640 and 711 into permission strings. What does 711’s final --x mean for a folder?

Question 3. Explain what chmod 777 file opens up, and why someone studying security should never use it.

Question 4. Name at least two things to check when ./run.sh is refused with "Permission denied" even after chmod +x.

mkdir vault
echo "the vault password is 0426" > vault/pw.txt
chmod 700 vault
chmod 600 vault/pw.txt
ls -ld vault
ls -l vault/pw.txt

drwx------ 2 lee lee 4096  Sep 9 11:00 vault
-rw------- 1 lee lee   21  Sep 9 11:00 vault/pw.txt

6. Common Pitfalls & Fixes

Wall 1. "I read a post telling me to chmod 777?"

Symptom: you often see internet answers advising "if it’s a permission problem, just do 777."
Cause: 777 opens read, write, and execute to everyone — it doesn’t "solve" the problem so much as smash the door down.
Fix: you, who are studying security, must not use 777. Asking first "what is the minimum necessary permission?" — this habit continues into Step 24’s principle of least privilege.

Wall 2. "I gave it x but it still won’t run."

Symptom: you ran chmod +x but ./run.sh is still refused.
Cause: you tried to run a file in another folder, or the owner is a different user, or the first line (#!/bin/bash) is missing.
Fix: first check with ls -l that x is really attached, and check that you included ./. Linux does not look in the current folder along the execution path.

Wall 3. "I gave the folder r, so why doesn’t ls work?"

Symptom: the permissions include r, yet ls foldername is refused.
Cause: to actually view a folder’s listing, you need r and x together. With r alone, you end up in an awkward state where you might know names but can’t go in.
Fix: give folders r and x as a set. That’s why the folder default is 755.

Wall 4. "The number math keeps confusing me."

Symptom: you mix up which of 4, 2, 1 was read.
Cause: a memorization-order problem.
Fix: memorize them as a set in "rwx" order: "4, 2, 1." Read is most important, so the biggest number 4; then write 2; then execute 1.

7. Summary

Today’s Concepts

Today’s Commands

More Important Than Commands: The Instinct

Permissions feel like an annoying lock at first, but they’re actually a seatbelt Linux wears to protect you. Whenever "Permission denied" appears, instead of getting angry, develop the eye that reads it as "ah, the rules are working right now." That same eye will serve you later when auditing other people’s server configurations.

Keep one field case in mind. Web server programs usually run as a powerless dedicated account called www-data — because a web server is a doorstep exposed to the entire internet, and the moment an attacker breaks through a vulnerability, they inherit exactly its permissions. Permission misconfiguration is a staple cause of real incidents, and breaches where cloud storage is left open with "read for everyone" repeat every year. The eye that reads today’s 10-character strings is the first step in preventing those incidents. Permission strings are the alphabet of security configuration.

Once every box is checked, Step 23 is complete.