Linux Users, Groups, and Permissions

Linux permissions answer three questions: who owns a resource, which group owns it, and what the owner, group, and everyone else may do. Follow Linux Filesystem Navigation and Command-Line Help if paths and inspection commands are unfamiliar.

Users and groups

id
getent passwd alice
getent group sudo
groups

/etc/passwd identifies local accounts, while password hashes are kept in /etc/shadow. Use getent rather than reading files directly when a system may also use LDAP or another identity service.

Create and modify accounts only when required:

sudo useradd --create-home --shell /bin/bash alice
sudo passwd alice
sudo usermod --append --groups sudo alice

Adding a user to sudo grants significant privilege. Log out and in again before testing the new group membership.

Reading permission output

ls -l report.txt

The first character identifies the type. The next nine characters are three sets of read (r), write (w), and execute (x) bits: owner, group, and other. Execute means “may enter” for a directory, so a directory usually needs x as well as r to be usable.

Changing permissions

chmod 640 report.txt
chmod 750 private-scripts
sudo chown alice:developers report.txt
sudo chgrp developers private-scripts

640 means owner read/write, group read-only, and no access for others. 750 gives the owner full access, the group read/execute, and others no access. Use --recursive carefully: applying one mode to every file and directory can create broken or unsafe permissions.

Verification

namei -l /srv/app/config.yml
getfacl /srv/app/config.yml 2>/dev/null

If an access check fails, inspect every parent directory, the file owner/group, ACLs, and any service-specific security policy before granting broad access.