iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Linux access control becomes predictable once you separate three things: who owns a path, which mode bits are set for the owner, group and everyone else, and whether ACLs or other controls add restrictions. Start with ls -l, stat and, when indicated, getfacl; then change only the layer that is wrong.
This guide explains permission strings, octal and symbolic chmod, chown and chgrp, directory semantics, special bits, umask, POSIX ACLs and a repeatable method for diagnosing service-account failures.
How Linux decides whether an operation is allowed
Every filesystem object has a user owner and a group owner. Linux first selects the permission class that applies to the requesting process: the owning user, a member of the owning group, or everyone else (other). Within that class, the classic mode has read, write and execute bits.
| Class | Read (r) | Write (w) | Execute (x) |
|---|---|---|---|
| Owner | Read file contents; list directory names | Modify file contents; create or remove directory entries | Run a program; traverse/search a directory |
| Group | Same operation for users in the owning group | Same operation for users in the owning group | Same operation for users in the owning group |
| Other | Same operation for users matching neither owner nor group | Same operation for users matching neither owner nor group | Same operation for users matching neither owner nor group |
Directory permissions are a frequent source of confusion. Read on a directory lets a process list names, but does not by itself permit opening a listed file. Write permits creating and removing entries, while execute is the search or traversal right needed to access an entry by name. A user may therefore be able to read a file when given its pathname but be unable to discover that pathname with a directory listing, or may see a name yet fail to open it because a parent directory lacks search permission.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Reading an ls -l permission string
A typical line begins with a file-type character followed by three groups of three bits:
-rwxr-x--- 1 alice web 1842 Oct 15 12:00 deploy.sh- First character:
-is a regular file,da directory; other characters represent objects such as symbolic links or device nodes. - Positions 2–4: owner permissions (
rwxin this example). - Positions 5–7: group permissions (
r-x). - Positions 8–10: other permissions (
---). - Following fields: link count, user owner, group owner, size, modification time and name.
In the example, user alice can read, modify and execute the file; members of group web can read and execute it; everyone else has no listed mode rights. A trailing +, such as -rw-r-----+, indicates extended ACL data in ACL-aware environments. Inspect that ACL instead of assuming the nine visible mode bits are the complete policy.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat chmod numbers mean
Octal notation assigns a value to each basic permission: read is 4, write is 2 and execute is 1. Add the values within each class, then write owner, group and other as three digits.
| Digit | Bits | Meaning |
|---|---|---|
| 0 | — | No permission |
| 1 | –x | Execute or directory search |
| 2 | -w- | Write |
| 3 | -wx | Write and execute/search |
| 4 | r– | Read |
| 5 | r-x | Read and execute/search |
| 6 | rw- | Read and write |
| 7 | rwx | Read, write and execute/search |
Decoding common modes
chmod 640 report.txt sets owner rw- (6), group r-- (4) and other --- (0). It is a useful private-file policy when a group may read but nobody else should.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
chmod 750 app gives the owner full access, the group read and search/execute, and other no access. On a directory, that allows the owner to list, create, remove and traverse; group members can list and traverse but cannot create or remove entries.
chmod 777 grants read, write and execute/search to all three classes. On a directory, any user who can reach it can create and remove entries, which is rarely appropriate for application or service data. Grant the narrowest class that meets the requirement instead of using 777 to mask an ownership or path problem.
Recommended Free Tools
Special bits: a possible fourth octal digit
A leading octal digit represents special bits: 4 is setuid, 2 is setgid and 1 is the sticky bit. For example, mode 4755 combines setuid with ordinary 755 bits.
- Setuid executable: when executed, the process gains the file owner’s effective identity. This is powerful and should be limited to trusted, carefully reviewed programs.
- Setgid executable: when executed, the process gains the file group’s effective identity.
- Setgid directory: on most Linux filesystems, new entries inherit the directory’s group, making it practical for a shared team tree.
- Sticky directory: users generally may remove or rename only entries they own (or when they own the directory or have administrator privilege). This is why a world-writable scratch directory can prevent users from deleting one another’s files.
When a special bit is displayed in place of an execute bit, lowercase s or t means the execute bit is also set; uppercase means the special bit is set without execute.
Ownership commands: chown, chgrp and chmod are different
Use ownership commands when the wrong account or group is attached to the object. Use chmod when the ownership is correct but the allowed operations are not.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Change user and group together
sudo chown appuser:web /srv/web/config.yamlThis assigns user owner appuser and group owner web for that path. A narrowly scoped form is safer than changing an entire tree while investigating one failure.
Change only the group
sudo chgrp web /srv/web/releases/currentchgrp leaves the user owner unchanged and changes only the group owner. This is useful when a service account should remain the owner but a team group needs access.
Change mode bits
chmod 640 /srv/web/config.yamlchmod g+rX /srv/webchmod o-rwx /srv/web/config.yaml
Use explicit octal when establishing a complete, known policy. Use symbolic mode when changing one dimension: g+rX adds group read and adds execute only where it is appropriate for directories or already-executable files, while o-rwx removes all other rights. Symbolic changes preserve unrelated bits, including special bits you did not intend to rewrite.
A safe inspection and change workflow
- Inspect the exact path. Run
ls -l pathfor a readable summary andstat pathfor numeric mode, ownership and timestamps. Check every parent directory when access fails. - Check for ACLs. If
ls -lshows+, rungetfacl path. Review both access entries and, for directories, default entries. - Identify the requesting identity. Confirm which user and supplementary groups the process actually uses. A service launched under a dedicated account does not automatically receive your interactive shell’s group memberships.
- Separate ownership from mode. If the owner or group is wrong, apply a narrowly scoped
chown user:group pathorchgrp group path. If ownership is right, adjust mode or ACL instead. - Choose the smallest change. Add only the required class and bit. For a shared directory, a group plus setgid may be safer than granting other users access; named-user requirements may call for an ACL.
- Verify after changing. Re-run
ls -l,statandgetfaclwhere relevant, then test as the affected account. A mode change that looks correct on the file can still fail because a parent directory, ACL mask or mount policy blocks access.
Directory sharing with groups and setgid
For a team-owned workspace, create or select a group, add every intended user to it, assign that group to the directory and set the directory’s setgid bit. A common restrictive starting point is:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo chown root:developers /srv/project
sudo chmod 2770 /srv/projectMode 2770 means setgid plus 770: owner and group have full directory rights, and other has none. New entries normally inherit the directory’s group, reducing the “wrong group on the next file” problem. Verify group membership for each user and remember that an already-running service may need to restart before it sees newly granted supplementary groups.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Setgid controls group inheritance, not the write bits on newly created files. Creation permissions still depend on the creating program’s requested mode and its umask; use a default ACL when consistent inherited rights for named principals are required.
How umask changes newly created files
The process umask removes permission bits from the mode supplied to file-creation system calls such as open and mkdir. It does not retroactively change existing files.
umask
umask 022If a program requests mode 0666 for a regular file and the process has umask 022, the resulting mode is 0644: owner read/write, group read and other read. The umask removes the group-write and other-write bits. A directory request commonly includes execute/search in its requested mode, so the same umask also removes group and other write while retaining their read/search rights when those bits were requested.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Check the umask in the actual service environment, not only in your login shell. Unit files, supervisor configurations, container entrypoints and startup scripts can establish a different value. A parent directory’s default ACL can also supply inherited entries and change the result beyond what a simple umask calculation suggests.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePOSIX ACLs for named users and groups
Classic modes express one owner, one owning group and one other class. POSIX ACLs add named-user and named-group entries, allowing a specific account or additional group to receive rights without moving ownership.
getfacl /srv/project/report.csv
setfacl -m u:analyst:r-- /srv/project/report.csv
setfacl -m g:auditors:r-X /srv/projectThe ACL mask is critical. It limits the effective rights of named users (other than the owner), named groups and the owning-group entry. getfacl displays the mask and commonly adds an “effective” comment when an entry requests more than the mask permits. The owner entry and the other entry are not reduced by the mask.
Default ACLs and inheritance
A directory can carry a default ACL that is inherited by newly created children. This is useful when a named user or group must receive access consistently throughout a tree and the three classic classes cannot represent that policy. Inspect both the directory’s access ACL and its default ACL with getfacl; changing only the current directory’s mode does not rewrite every existing child.
Classic modes versus ACLs
| Question | Classic mode bits | POSIX ACLs |
|---|---|---|
| Principals expressible | One owner, one group and other | Owner, owning group, named users and named groups |
| Auditing | Compact and visible in standard ls -l |
Requires getfacl; mask can make effective rights differ from requested entries |
| Inheritance | Directory setgid provides group inheritance; mode alone has no named-principal defaults | Default ACLs can supply inherited named-user and named-group entries |
| Portability | Widely supported across Unix-like filesystems | Support and behavior vary more across filesystems and Unix variants |
| Operational risk | Fewer hidden layers | More precise, but an overlooked mask or inherited entry can silently limit or expand effective access |
Diagnosing “permission denied” in the right order
Do not begin by adding write permission or using 777. Walk the access path from the root of the filesystem to the target:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Parent traversal: confirm the service account has execute/search permission on every parent directory. A single missing
xblocks access even when the target file is644. - Target ownership: use
statorls -lto verify the user and group names. - Classic mode: determine which class applies and whether its read, write or execute/search bit is present.
- ACL entries and mask: use
getfaclwhen a plus sign is present or when the visible mode does not explain the result. - Special attributes: attributes such as immutable can prevent modification despite apparently permissive mode bits.
- Filesystem and security policy: a read-only mount, filesystem restrictions or a mandatory security policy can deny an operation that discretionary mode bits allow.
Apply the smallest fix at the layer that failed, then repeat the test as the real service identity. This avoids concealing a path, ownership or policy error with broad permissions.
Quick Recap
Common mistakes to avoid
- Using
chmod 777as a diagnostic: it grants every class full rights and can create an unnecessary modification or deletion path. - Confusing file execute with directory search: adding execute to a data file does not make it readable; adding search to a directory is what permits traversal.
- Changing only the final file: parent-directory traversal is required at every level.
- Ignoring ACLs: the
+marker means the nine displayed bits are not the whole policy. - Forgetting the ACL mask: a named entry can show
rwxwhile its effective rights are reduced by the mask. - Running recursive commands casually:
chmod -Randchown -Rcan alter service trees, symlinks and directories whose search bit is essential. Review the path and sample results before applying a broad change. - Assuming your shell environment matches the service: the daemon may run as another user, with different groups and a different umask.
A compact decision guide
- If the wrong user or group is shown, use narrowly scoped
chownorchgrp. - If the right owner and group are shown but a class lacks one required operation, use symbolic
chmodfor that bit or an explicit octal mode when replacing the complete policy. - If several users or groups need different rights, use an ACL and verify its mask.
- If files created in a shared directory receive inconsistent groups, use directory setgid and check group membership.
- If newly created objects are too open or too restricted, inspect the creating process’s umask and any parent default ACL.
- If all of those look correct, investigate parent traversal, special attributes, mount state and security policy rather than widening permissions blindly.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
