Linux Permission Model

Every file and directory on a Linux system carries a set of rules about who’s allowed to read it, change it, or run it — and those rules are enforced by the kernel itself, not by convention or good behavior. This is the mechanism that makes a shared, multi-user system possible in the first place: the same machine can host your files, another user’s files, and system-critical files, all coexisting safely, because the kernel checks permissions on every single access, without exception.

You’ve been creating files for several files now without ever thinking about this. This chapter is where that changes.

Seeing Permissions: Reading ls -l

You already know ls -l from the Navigation chapter — this is where that long format actually starts paying off. Run it against any file:

ls -l notes.txt

You’ll see output shaped something like this:

-rw-r--r-- 1 you you 220 Jan 15 10:03 notes.txt

That first cluster of characters, -rw-r--r--, is the entire permission story for this file. It looks dense, but it breaks into predictable pieces.

Breaking Down The Permission String

The ten characters split into four groups:

-  rw-  r--  r--
│   │    │    │
│   │    │    └── other: what everyone else can do
│   │    └─────── group: what the file's group can do
│   └──────────── owner: what the file's owner can do
└──────────────── file type

The first character is the file type, not a permission at all. - means a regular file, d means a directory. You’ll see other letters later for more exotic types, but these two cover the vast majority of what you’ll encounter.

The remaining nine characters split into three groups of three, each group representing read, write, and execute, in that fixed order, for three different categories of user:

• Owner — the specific user who owns the file
• Group — any user belonging to the file’s associated group
• Other — everyone else on the system

So rw-r--r-- reads as: the owner can read and write (but not execute), the group can only read, and everyone else can only read. A - in any position simply means that permission is absent.

What Owner, Group, And Other Actually Mean

Every file has exactly one owner and exactly one associated group — you can see both in that ls -l output, right after the permission string (you you in the example above: owner, then group). This is what makes the three-tier model work: the owner is usually the user who created the file, the group lets a whole team share access without granting it to literally everyone, and “other” is the fallback for anyone not covered by the first two.

We’ll get hands-on with actually changing ownership and group membership in the Users & Groups section coming up — for now, just recognize that “owner” and “group” aren’t fixed forever. They’re properties of the file, checked at the moment someone tries to access it.

What Read, Write, And Execute Actually Mean

These three permissions don’t mean quite the same thing depending on whether you’re looking at a file or a directory — this catches people off guard constantly, so it’s worth being precise.

On a file:

On a directory, the same three letters mean something else entirely:

One more detail worth internalizing now: write permission on a directory controls deletion of files inside it — not write permission on the file being deleted. You can delete a file you don’t have write permission to modify, as long as you have write permission on the directory containing it, because deleting an entry is really an operation on the directory’s listing, not on the file’s own content. This is exactly the nuance rm -f was quietly overriding warnings about back in the File Operations section.

Two Ways To Represent The Same Permissions

Permissions can be written two different ways, and you’ll see both constantly — knowing how to convert between them in your head is worth the effort now.

Symbolic notation is what ls -l shows you: rwx, r--, ---, and so on — a direct letter-by-letter representation.

Numeric (octal) notation represents the same three permissions as a single digit, by treating each permission as a power of two and adding them together:

Add up whichever permissions are present to get one digit, per category. rwx is 4+2+1 = 7. rw- is 4+2 = 6. r-- is just 4. --- is 0. A full permission set becomes three digits, one per category — owner, group, other, in that same fixed order.

So the earlier example, rw-r--r--, converts to 644: owner gets 6 (read + write), group gets 4 (read only), other gets 4 (read only).

    flowchart LR
    A["rw-r--r--"] --> B["Owner: rw- = 4+2+0 = 6"]
    A --> C["Group: r-- = 4+0+0 = 4"]
    A --> D["Other: r-- = 4+0+0 = 4"]
    B --> E["644"]
    C --> E
    D --> E
  

A few permission sets come up often enough to recognize on sight:

Why Two Notations Exist At All

Numeric notation is compact and precise — useful when you want to set an exact, complete permission set in one move, and it’s what you’ll most often see in scripts and documentation. Symbolic notation is better for relative changes — adding execute permission without disturbing anything else about a file’s existing permissions, for instance, which numeric notation can’t express without you first knowing the full existing set. You’ll see exactly this distinction in practice in the next chapter, where chmod accepts both forms for different reasons.

What’s Next

You can now read any file’s permissions and understand exactly what they allow. The next chapter makes it practical: actually changing those permissions and ownership with chmod, chown, and chgrp.