How Linux file permissions actually work — the owner/group/other model, reading and writing permission strings, and the chmod/chown commands to change them safely.
"Permission denied" is one of the most common errors a fresher hits when working on Linux, and it's usually solvable in seconds once you understand what's actually being checked — but genuinely confusing if you try to guess at chmod 755 values from memory without understanding the model underneath them.
The owner/group/other permission model, how to read a permission string like -rwxr-xr--, and how to change permissions and ownership deliberately rather than by trial and error.
Every file has permissions defined for three separate categories:
And three permission types apply to each category:
cd into) a directory.Running ls -l shows a string like -rwxr-xr--. Break it into groups of three, after the leading file-type character:
- rwx r-x r--
^ ^ ^ ^
type owner group other
Here, the owner has read/write/execute, the group has read/execute, and everyone else has read-only. The leading character indicates file type: - for a regular file, d for a directory, l for a symbolic link.
Each permission triplet can also be written as one digit (0-7), summing read=4, write=2, execute=1. So rwx = 4+2+1 = 7, r-x = 4+1 = 5, r-- = 4. The string above is octal 754. This is why chmod 755 file is common — owner gets full access (7), group and other get read+execute (5) but not write.
chmod 644 file.txt
chmod 755 script.sh
chmod u+x script.sh
The first two use octal notation directly. The third uses symbolic notation (u for user/owner, +x to add execute) — useful when you want to change just one bit without recalculating the full octal value.
chown www-data file.txt
chown www-data:www-data file.txt
chown -R www-data:www-data /var/www/site
The first changes just the owner. The second changes owner and group together (owner:group). The -R flag applies recursively to a directory and everything inside it — use it deliberately, since it's easy to accidentally change permissions on far more files than intended if run from the wrong directory.
A frequent cause of a web application failing to read its own files is that the files are owned by the deploying user's account, but the web server process runs as a different, more restricted account (like www-data on many Linux distributions) that doesn't have read access. The fix is usually chown -R www-data:www-data on the application directory — but confirm which account the web server actually runs as first, rather than guessing.
Permission and ownership problems often surface as an application error rather than an obvious "permission denied" message — see Reading Windows Event Viewer for the Windows-side equivalent investigation habit, or Root Cause Analysis: A Simple Framework for a general approach to narrowing down an unclear failure.
Part of: Freshers, System Administrators