Complete File Permissions Guide — chmod · chown · ACL

-rwxr-xr-- 1 alice developers 4096 May 27 10:00 script.sh
│└──┘└──┘└──┘
│  U   G   O    U=User (owner), G=Group, O=Other
│
└─ File type (- file, d directory, l link)

r = read(4)  w = write(2)  x = execute(1)  - = none(0)

# Numeric notation
chmod 755 script.sh     # rwxr-xr-x
chmod 644 file.txt      # rw-r--r--
chmod 600 secret.key    # rw-------
chmod 777 dir/          # rwxrwxrwx (dangerous)

# Symbolic notation
chmod u+x script.sh     # Add execute for owner
chmod g-w file.txt      # Remove write from group
chmod o=r file.txt      # Other: read only
chmod a+r file.txt      # Add read for everyone
chmod ug=rw,o= file.txt # Owner and group rw, other none

# Recursive
chmod -R 755 /var/www/html

# Apply 644 to files and 755 to directories separately
find /var/www -type f -exec chmod 644 {} \;
find /var/www -type d -exec chmod 755 {} \;

# Change owner
chown alice file.txt

# Change owner and group together
chown alice:developers file.txt

# Change group only
chown :developers file.txt
chgrp developers file.txt

# Recursive
chown -R deploy:www-data /var/www/myapp

# SUID — run with owner's privileges
chmod u+s /usr/bin/sudo # ls -la when -rwsr-xr-x

# SGID — run with group's privileges / inherit group for files in directory
chmod g+s /shared/dir/

# Sticky Bit — only owner can delete (e.g. /tmp)
chmod +t /tmp
ls -ld /tmp                   # drwxrwxrwt

# Numeric: 4=SUID, 2=SGID, 1=Sticky
chmod 4755 mybin    # SUID + 755
chmod 1777 /tmp     # Sticky + 777

# Check current umask
umask           # 0022 (default)

# Default file permissions = 666 - umask = 644
# Default directory permissions = 777 - umask = 755

# Stricter umask (deny group and other read as well)
umask 077       # files 600, directories 700

# Persist permanently
echo "umask 022" >> ~/.bashrc

# Install ACL package
sudo apt install -y acl

# Set ACL
setfacl -m u:bob:rw file.txt        # Grant bob rw
setfacl -m g:devops:rx /project/    # Grant devops group rx
setfacl -m o::- file.txt            # No permissions for others

# Default ACL (directory — applied automatically to new files)
setfacl -d -m u:ci:rw /deploy/

# View ACL
getfacl file.txt
getfacl -R /project/

# Remove ACL
setfacl -x u:bob file.txt           # Remove ACL for a specific user
setfacl -b file.txt                 # Remove all ACLs

# Copy / backup
getfacl -R /project/ > acl_backup.txt
setfacl --restore=acl_backup.txt