🔒

Who's allowed to touch this file?

Linux has trust issues. Healthy ones.

Every file in Linux has a tiny bouncer deciding who gets in. Once you can read -rwxr-x--- at a glance, half of all "Permission denied" mysteries solve themselves.

Beginner1 eveningPermissions

🧰 What you need

Any Linux machine where you can use sudo

Let's build it

Read the bouncer's list

cd ~
echo 'my secret plans' > secret.txt
ls -l secret.txt

You'll see something like -rw-rw-r-- 1 arun arun ... secret.txt. After the first character come three groups of three: owner, group, everyone else. r = read, w = write, x = run.

Lock it down

chmod 600 secret.txt
ls -l secret.txt

Now it's -rw-------: only you can read or write it. The numbers are a shortcut: read = 4, write = 2, run = 1, added up for owner, group and others. So 600 means owner 6 (4+2), group 0, others 0.

Make a script runnable

echo 'echo Hello from my script!' > hello.sh
./hello.sh
chmod +x hello.sh
./hello.sh

The first try says Permission denied. After chmod +x, it runs.

Create a user to test with

sudo useradd -m guest1
sudo -u guest1 cat /home/$USER/secret.txt

guest1 is refused. Your bouncer is doing its job.

Share with a group

sudo groupadd friends
sudo usermod -aG friends guest1
sudo chgrp friends secret.txt
chmod 640 secret.txt

Now the friends group can read it, but not change it.

✅ How you know it worked

Run ls -l secret.txt and read it out loud: "owner can read and write, group can read, everyone else gets nothing". If you can say that without looking anything up, you've got it.

💥 Break it on purpose

Lock yourself out:

chmod 000 secret.txt
cat secret.txt
sudo cat secret.txt

You're denied your own file, but root reads it anyway. Root ignores the bouncer entirely, which is exactly why you should only use sudo when you mean it. Tidy up with chmod 600 secret.txt and sudo userdel -r guest1.

🧠 What's really going on

Every file stores an owner, a group and nine permission bits. When you touch a file, Linux checks in order: are you the owner? Use the owner bits. In the group? Use the group bits. Otherwise, use the "others" bits. On a folder, x means "allowed to enter", which is why folders are usually 755 and private files 600.

← Back to all Linux labs · Stuck? Email me