Step 23. Permissions 1 — rwx, Rules Carved Into Files

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★☆☆☆ | Estimated time: 3 hours

Prerequisites: you need to know the basic Linux commands and editor usage from Steps 18–22. An Ubuntu virtual machine (or WSL) is required.

What you need: an Ubuntu terminal.
Caution: today’s exercise is safe. It’s all about creating practice files and folders in your home folder and changing their permissions.
Note: the read-only commands that inspect system file permissions were actually run, while the outputs of the permission-changing chmod experiments are marked as "output examples."

Just as a house has a front door, every file and folder in Linux has a "door." And written on each door is "who may open it." This is Linux’s permission system. That cryptic string like -rwxr-xr-- you’ve seen every time you ran ls -l — today you learn to read it.

In security study, permissions underlie almost everything. "Why can’t I read this file?" is a permissions question, and much of what a hacker does after seizing a system is "gaining higher privileges." Today we start by learning to read the strings of those rules.

1. Learning Objectives

By the end of this chapter, you will be able to:

Interpret a string like -rwxr-xr-- at the front of ls -l output, class by class
Explain the three classes — owner, group, others — and the three actions r, w, x
Convert permission strings and octal notation (644, 755, etc.) in both directions
Change file permissions with chmod, using both numeric and symbolic notation
Confirm by experiment that x on a file (execute) differs from x on a folder (enter)

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/Environment	Ubuntu terminal (bash shell), no internet needed
Today’s commands	`ls -l` (view permissions), `chmod` (change permissions), `umask` (check default permissions), `touch` / `mkdir` (create experiment targets)
Concepts needed	the 3 classes (owner/group/others), the 3 actions (r/w/x), octal permission notation, umask

2-1. Three Kinds of Users

Permissions divide "for whom" into three classes.

Owner (user, u): the file’s owner. Usually the person who created it.
Group (g): the user group assigned to the file. For example, granting read access to an entire "dev team" group.
Others (o): everyone who is neither the owner nor a group member. Effectively "anyone."

2-2. Three Kinds of Actions

"What may be done" divides into three actions.

r (read): can view the contents. For a file, read it with cat; for a folder, list it with ls.
w (write): can modify or delete the contents.
x (execute): for a file, can run it as a program. For a folder, it means "can enter it (cd)" — the point beginners confuse most.

2-3. Why Do Groups Exist?

If we have "owner" and "others," why bother with "group"? Imagine a company server. Five developers share a project folder. Setting it to "open to everyone (permissions for others)" lets people from other departments peek inside. Conversely, if only one owner has permissions, collaboration fails.

This is where you create a "dev team" group and set the folder’s group to dev team — granting permissions only to teammates while blocking everyone else. A group is a device for "bundling permissions to a specific set of people." One user can belong to multiple groups, and you can see your groups with the groups command. For now, just remember its reason for existing: "the middle class is for team-level permission management."

2-4. Dissecting the Permission String

The front of ls -l output always has 10 characters:

-rwxr-xr--

First character: file type. - is a regular file, d is a folder (directory)
Next 3 characters: the owner’s permissions. rwx = read, write, and execute all allowed
Next 3 characters: the group’s permissions. r-x = read and execute only, no write (- marks "absent")
Last 3 characters: others’ permissions. r-- = read only

So this string is the rule: "the owner may do everything, the group may read and execute, everyone else may only read."

2-5. Permissions as Numbers — Octal

When changing permissions, numbers are often used instead of strings. The rule is simple:

r = 4, w = 2, x = 1
One class’s permission is the sum of these. Example: rwx = 4+2+1 = 7, r-x = 4+0+1 = 5, r-- = 4 = 4

Write the three classes together and you get a three-digit number like 754. rwxr-xr-- is 7, 5, 4 — that is, 754. Frequently seen combinations:

Number	String	Meaning
644	rw-r–r–	Default for regular files. Only the owner modifies; everyone reads
755	rwxr-xr-x	Default for executables and folders. Everyone reads and executes; only the owner modifies
600	rw——-	Secret file. Only the owner reads and writes
700	rwx——	Secret folder. Only the owner enters

The reason r, w, x happen to be 4, 2, 1 is that they’re binary place values (100, 010, 001). The computer stores permissions as 9 switches (3 classes × 3 actions), and we simply read them as three octal digits.

3. Follow Along

3-1. Reading Real Permission Strings on a Live System

Before making practice files, let’s read real permissions on the Ubuntu in front of you. Querying changes nothing on the system:

ls -l /etc/passwd /bin/ls

-rwxr-xr-x 1 root root   142312 Jun 23  2025 /bin/ls
-rw-r--r-- 1 root root     1490 Sep  8 21:12 /etc/passwd

(Verified 2026-09-09 on Ubuntu 24.04. Sizes and dates differ by environment.)

How to read the output: /bin/ls (the actual body of the ls command we just used) is -rwxr-xr-x, i.e., 755 — "owner (root) may modify; everyone may read and execute." The reason you can run ls is exactly those three xs. /etc/passwd is 644 — "everyone may read; only root may modify," because it’s a user roster that everyone must be able to read.

Let’s look at folder permissions too. The -d option means "show the folder itself, not its contents":

ls -ld /home /etc /tmp

drwxr-xr-x 100 root root 4096 Sep  9 11:28 /etc
drwxr-xr-x   2 root root 4096 Apr 22  2024 /home
drwxrwxrwt   9 root root 4096 Sep  9 11:28 /tmp

(Verified 2026-09-09.)

How to read it: every first character is d — folders. /etc and /home are 755 — everyone can enter (x), but only root can write. /tmp is drwxrwxrwt — a temporary plaza with rwx open to everyone, and the final t is a special device (the sticky bit) meaning "you can’t delete other people’s files." For now, just note "there’s one more special letter" and move on.

3-2. Where Default Permissions Come From — umask

Let’s confirm why new files automatically get 644 and new folders 755:

umask

(Verified 2026-09-09.)

How to read it: umask is "the amount to shave off the default maximum permissions." A file’s maximum is 666 (execute permission is not granted by default) and a folder’s maximum is 777; shaving 022 off these gives — files 644, folders 755. That’s the source of the defaults you saw in Section 3-1. Permissions are not "added from a state of nothing" but a concept of "defaults exist, and you adjust them."

3-3. Viewing and Changing My Files’ Permissions

Now experiment with files you make yourself:

cd ~
touch report.txt
ls -l report.txt

-rw-rw-r-- 1 lee lee 0  Sep 9 10:23 report.txt

(Output example — since touch creates a file, it was not run in this chapter’s verification environment. The permission part comes out as 644 or 664 depending on the environment’s umask.)

How to read it: let’s interpret -rw-rw-r--. - regular file; rw- the owner reads and writes; rw- the group also reads and writes; r-- others only read. The lee lee after that is the owner name and group name.

First chmod experiment:

echo "a very important secret" > secret.txt
chmod 600 secret.txt
ls -l secret.txt

-rw------- 1 lee lee 18  Sep 9 10:25 secret.txt

(Output example.)

How to read it: chmod is short for "change mode." The permissions changed to rw------- — only the owner reads and writes; group and others can do nothing. 6 = r+w (4+2), 0 = no permissions, 0 = no permissions. Confirm with your eyes that the numbers and the string match exactly.

Make a prediction: if you run chmod 000 secret.txt, can I — the file’s owner — read it with cat secret.txt? (Answer: even the owner can’t read it. You’ll get cat: secret.txt: Permission denied. Once you’ve confirmed, restore it with chmod 600 secret.txt. Note that root is the exception to this rule — that story comes in Step 24.)

3-4. Experiencing Execute Permission (x)

Using nano, which you learned in Step 22, create a script:

nano run.sh

Inside nano, write the following two lines, save (Ctrl+O, Enter), and exit (Ctrl+X):

#!/bin/bash
echo "The script has run!"

Now check the permissions and try running it:

ls -l run.sh
./run.sh

-rw-rw-r-- 1 lee lee 45  Sep 9 10:30 run.sh
bash: ./run.sh: Permission denied

(Output example.)

How to read it: "permission denied." This file has no x permission, so it can’t be executed. Here ./ means "of the current folder" — Linux does not look in the current folder along the execution path, so you must include it.

Give it x and run again:

chmod +x run.sh
ls -l run.sh
./run.sh

-rwxrwxr-x 1 lee lee 45  Sep 9 10:30 run.sh
The script has run!

(Output example.)

How to read it: +x means "add x to all classes." The permissions changed to rwxrwxr-x, and it ran.

Why: in Linux, whether a file "is a program" is decided not by an extension but by the x permission. The name .sh is merely a hint for humans — the system looks only at the x bit. An important difference from Windows’ .exe mindset.

3-5. A Folder’s x Is "Permission to Enter"

mkdir secret_room
echo "treasure in the room" > secret_room/treasure.txt
chmod 644 secret_room
ls secret_room

ls: cannot open directory 'secret_room': Permission denied

(Output example.)

How to read it: you granted r but took away x — and now you can’t even see the listing. When x is missing from a folder, ls fails.

chmod 755 secret_room
ls secret_room
cat secret_room/treasure.txt

treasure.txt
treasure in the room

(Output example.)

Why: on a folder, x is not "execute" but "allowed to enter." It helps to think of reading the listing at a room’s door (r) and entering the room (x) as separate things. That’s why folders are usually given r and x as a set — the reason the folder default is 755.

3-6. Adding and Subtracting with Symbolic Notation

Besides numbers (octal), you can grant and revoke permissions with symbols. Combine class symbols u (owner), g (group), o (others), a (all) with operator symbols + (add), – (remove), = (set exactly to this):

chmod 644 report.txt
chmod g+w report.txt
chmod o-r report.txt
ls -l report.txt

-rw-rw---- 1 lee lee 0  Sep 9 10:41 report.txt

(Output example.)

How to read it: g+w is "add write to the group" (644 → 664); o-r is "remove read from others" (664 → 660). The final result is rw-rw----.

Why: numeric notation "specifies the final state wholesale," while symbolic notation "adds and subtracts from the current state." When you want to nudge one specific class on several files, symbolic notation is handy. You need to read both to understand other people’s documentation.

4. Missions & Exercises

Mission — Building Your Own Vault

Create a vault folder and make pw.txt inside it (any content)
Set the folder to 700 and the file to 600
Check the final state with the two commands ls -ld vault and ls -l vault/pw.txt
Verification experiment: after chmod 000 pw.txt, confirm both cat pw.txt and nano pw.txt are denied, then restore to 600
Calculation check: create practice.txt, apply chmod 640, then compare the ls -l output against the string you computed by hand

The answer isn’t written here — verify it in Section 5.

Exercises

Question 1. Convert these permission strings to octal: rwxr-x---, rw-------, r-xr-xr-x

Question 2. Expand the numbers 640 and 711 into permission strings. What does 711’s final --x mean for a folder?

Question 3. Explain what chmod 777 file opens up, and why someone studying security should never use it.

Question 4. Name at least two things to check when ./run.sh is refused with "Permission denied" even after chmod +x.

5. Model Answers & Completion Criteria

Mission Model Answer

mkdir vault
echo "the vault password is 0426" > vault/pw.txt
chmod 700 vault
chmod 600 vault/pw.txt
ls -ld vault
ls -l vault/pw.txt

drwx------ 2 lee lee 4096  Sep 9 11:00 vault
-rw------- 1 lee lee   21  Sep 9 11:00 vault/pw.txt

(Output example.)

How to verify: ① if the folder is drwx------ (700) and the file is -rw------- (600), setup is complete. ② If the chmod 000 experiment shows cat: vault/pw.txt: Permission denied and nano also refuses to open it, you’ve confirmed that "permissions are the wall" — be sure to restore to 600. ③ The result of chmod 640 practice.txt should be -rw-r-----.

Exercise Answers

Answer 1. rwxr-x--- = 750, rw------- = 600, r-xr-xr-x = 555. Just convert each class to the sum of r=4, w=2, x=1.

Answer 2. 640 = rw-r-----; 711 = rwx--x--x. The final --x is an unusual but real permission meaning "everyone else may (for a folder) only enter" — a state where they can’t see the listing (r) but can go inside.

Answer 3. 777 opens read, write, and execute to everyone — it doesn’t "solve" a problem so much as smash the door down. Other users on the server (or an attacker who broke in) can read and modify that file at will. The habit of asking what the minimum necessary permission is — that’s where the security mindset begins.

Answer 4. ① check with ls -l that x is really attached ② check that you prefixed ./ to specify the file in the current folder ③ check whether the file’s owner is a different user ④ check that the script’s first line (#!/bin/bash) isn’t missing — since Linux doesn’t look in the current folder along the execution path, ./ is forgotten especially often.

Completion Checklist

[ ] Looking at a string like -rwxr-xr--, I can say who may do what
[ ] I know where the owner and group names sit in ls -l output
[ ] I can convert permissions to and from octal using r=4, w=2, x=1
[ ] I can use both chmod numeric notation (600, 755, etc.) and symbolic notation (g+w, o-r)
[ ] I can explain the difference between x on a file and x on a folder
[ ] I know umask is "the amount shaved off the defaults"
[ ] Mission: I completed the vault build and the 000 experiment and restore

6. Common Pitfalls & Fixes

Wall 1. "I read a post telling me to chmod 777?"

Symptom: you often see internet answers advising "if it’s a permission problem, just do 777."
Cause: 777 opens read, write, and execute to everyone — it doesn’t "solve" the problem so much as smash the door down.
Fix: you, who are studying security, must not use 777. Asking first "what is the minimum necessary permission?" — this habit continues into Step 24’s principle of least privilege.

Wall 2. "I gave it x but it still won’t run."

Symptom: you ran chmod +x but ./run.sh is still refused.
Cause: you tried to run a file in another folder, or the owner is a different user, or the first line (#!/bin/bash) is missing.
Fix: first check with ls -l that x is really attached, and check that you included ./. Linux does not look in the current folder along the execution path.

Wall 3. "I gave the folder r, so why doesn’t ls work?"

Symptom: the permissions include r, yet ls foldername is refused.
Cause: to actually view a folder’s listing, you need r and x together. With r alone, you end up in an awkward state where you might know names but can’t go in.
Fix: give folders r and x as a set. That’s why the folder default is 755.

Wall 4. "The number math keeps confusing me."

Symptom: you mix up which of 4, 2, 1 was read.
Cause: a memorization-order problem.
Fix: memorize them as a set in "rwx" order: "4, 2, 1." Read is most important, so the biggest number 4; then write 2; then execute 1.

7. Summary

Today’s Concepts

Concept	One-line description
Permission	"Who may do what," carved into every file and folder
3 classes	owner (u) · group (g) · others (o)
3 actions	r (read) · w (write) · x (execute for files, enter for folders)
Octal notation	Three digits, sums of r=4, w=2, x=1 (e.g., 755)
umask	The "shaving amount" that sets default permissions for new files and folders

Today’s Commands

Command	What it does
`ls -l` / `ls -ld folder`	View permission strings / view a folder’s own permissions
`chmod 600 file`	Set permissions wholesale as a number
`chmod g+w file`	Add and subtract with symbolic notation
`umask`	Check the default permission value

More Important Than Commands: The Instinct

Permissions feel like an annoying lock at first, but they’re actually a seatbelt Linux wears to protect you. Whenever "Permission denied" appears, instead of getting angry, develop the eye that reads it as "ah, the rules are working right now." That same eye will serve you later when auditing other people’s server configurations.

Keep one field case in mind. Web server programs usually run as a powerless dedicated account called www-data — because a web server is a doorstep exposed to the entire internet, and the moment an attacker breaks through a vulnerability, they inherit exactly its permissions. Permission misconfiguration is a staple cause of real incidents, and breaches where cloud storage is left open with "read for everyone" repeat every year. The eye that reads today’s 10-character strings is the first step in preventing those incidents. Permission strings are the alphabet of security configuration.

Once every box is checked, Step 23 is complete. Click the checkbox in the sidebar to save your progress.