Changing Permissions and Ownership

You can now read any permission string and know exactly what it allows. This chapter is about changing it — three commands that cover everything from making a script runnable to fixing a file that somehow ended up owned by the wrong person.

Changing Permissions: chmod

chmod (“change mode”) sets a file’s permissions, and it accepts both notations from the last chapter — numeric and symbolic — for different situations.

Numeric Mode: Setting An Exact Permission Set

Give chmod a three-digit number and it sets that exact permission set, replacing whatever was there before entirely.

chmod 755 deploy.sh

This sets deploy.sh to rwxr-xr-x — owner gets full access, group and other get read and execute — regardless of what its permissions were beforehand. Numeric mode is absolute: you’re not adding or removing anything, you’re declaring the complete final state in one move.

chmod 600 secrets.txt

This locks a file down to owner-only access — a common thing to do with anything containing credentials or sensitive configuration.

Symbolic Mode: Adjusting Relative To What’s Already There

Symbolic mode changes permissions relative to the current state, using three pieces: who it applies to, whether you’re adding or removing, and what permission.

chmod u+x deploy.sh

This adds execute permission for the owner only, leaving every other permission — group, other, and even the owner’s existing read/write bits — completely untouched. This is the case numeric mode genuinely can’t express cleanly: to do the same thing numerically, you’d first need to know the file’s entire existing permission set, then recalculate the whole three-digit number by hand.

A few more examples of the pattern:

chmod g-w notes.txt

Removes write permission for the group, changes nothing else.

chmod a+r notes.txt

Adds read permission for everyone — owner, group, and other alike.

chmod o=r notes.txt

Sets “other” to exactly read, no more, no less — regardless of what other permission “other” had before. Notice = behaves differently from +/-: it’s not additive or subtractive, it replaces that category outright.

You can combine several changes in one command, comma-separated with no spaces:

chmod u+x,g-w,o=r deploy.sh

A Real Example: Making A Script Runnable

This is one of the most common permission situations you’ll actually hit. Create a simple script:

nano hello.sh

Put this inside:

#!/bin/bash
echo "Hello from a script"

Save and exit (Ctrl+O, Enter, Ctrl+X — from the Text Editors chapter). Try running it directly:

./hello.sh

This fails with a “permission denied” error — nano created the file with the default permissions covered in the last chapter (typically 644, no execute bit for anyone), and a script needs execute permission to be run this way. Fix it:

chmod u+x hello.sh
./hello.sh

Now it runs, printing Hello from a script. This exact sequence — write a script, try to run it, get denied, add execute permission — is common enough that you’ll likely do it from memory within a few weeks of using Linux regularly.

Changing Ownership: chown

chown (“change owner”) changes which user owns a file. You typically need elevated privileges to change ownership to someone else — a natural first brush with sudo, which gets its own proper treatment in the Users & Groups section. For now, know the command shape:

sudo chown alice notes.txt

This makes alice the new owner of notes.txt. You can change the group at the same time by adding a colon:

sudo chown alice:developers notes.txt

This sets alice as owner and developers as the associated group, in one command. To change only the group and leave the owner untouched, omit the name before the colon:

sudo chown :developers notes.txt

chown also supports -R (recursive) for applying ownership changes through an entire directory tree at once:

sudo chown -R alice:developers projects/

Changing Just The Group: chgrp

chgrp does exactly what the group-only form of chown does, as a dedicated command:

sudo chgrp developers notes.txt

Functionally identical to chown :developers notes.txt — which one you reach for is largely personal preference. Many people use chown exclusively, since it can do everything chgrp does and more; chgrp exists mostly for clarity when a command is specifically and only about group membership.

Putting It Together

All three support -R for recursive changes through a directory, and all three deserve the same caution as any command that changes many files at once with no confirmation: check with ls -l before, and ideally after, any change you’re not fully certain about.

What’s Next

You can now both read and change standard permissions and ownership. There’s one more layer to the permission system worth knowing — a set of special bits that go beyond the basic read/write/execute model, covered next with a real-world example of exactly when you’d reach for them.