Use chown on Linux with Verified Ownership and Scope

chown changes a file’s owner, group or both; chmod changes its mode bits. Neither utility is specific to Bash. An ownership repair requires knowing which account should own the particular object, not just adding sudo until an error disappears.

Choose the exact scope

• An owner argument changes only the owner.
• An owner:group argument changes both.
• A :group argument changes only the group.
• An owner followed by a bare colon can also select that owner’s login group; do not confuse it with owner-only syntax.

Resolve the intended user/group and inspect the current numeric IDs before changing anything. Changing ownership normally requires suitable administrative privilege; ordinary users have limited group-change possibilities, not arbitrary ownership-transfer rights.

One-file synthetic demonstration

This example is for a disposable root-run Linux lab only. The numeric IDs are synthetic, not accounts to assign to real application data. GNU’s leading plus makes them explicit numeric IDs:

lab=$(mktemp -d) || exit 1
cd "$lab" || exit 1
touch sample.txt
chown +10001:+10002 -- sample.txt
stat -c '%u:%g %n' -- sample.txt
chown :+10003 -- sample.txt
stat -c '%u:%g %n' -- sample.txt

The owner/group pairs are 10001:10002 and then 10001:10003. No named account is created. For a real change, use your approved owner/group and verified absolute target, with a recorded before state and recovery plan.

Recursion is a separate risk

The old recursive www-data ownership and post-install blanket repair recipes are withdrawn. The runtime process should not automatically own all deployed code. Recursive traversal, dereferencing a symlink’s target and changing the symlink itself are different decisions; GNU chown documents separate controls and attack risks. There is no universal safe dry-run switch for an arbitrary recursive repair.

Inspect a bounded candidate list first. Check mount boundaries, unexpected links, hard-linked names, ACLs and special permission bits. An ownership change can clear set-ID bits, and hard links refer to the same underlying file. Recheck actual ownership and application behavior afterward; do not run a periodic job that repeatedly overwrites an application’s deliberate ownership layout.

References: GNU chown forms and traversal warnings; numeric-ID disambiguation and common options.

Reviewed October 15, 2026. The example was checked only on synthetic files in an isolated container; no host or customer ownership was changed.