Understand Linux File and Directory Permissions

Linux file modes describe access for the owner, the file’s group and other users. They are one layer of access control: parent-directory traversal, ACLs, SELinux/AppArmor, mount options and application rules can also affect a request.

Read the mode correctly

In a listing such as -rw-r-----, the first character identifies the object type. It is not limited to a regular-file dash or a directory d: l denotes a symbolic link, and other types exist. The next three triplets describe owner, group and other access; special bits can appear as s, S, t or T.

Bit	Regular file	Directory
r: read	Read its data	List entry names
w: write	Modify its data	Change directory entries, normally with search permission
x: execute/search	Permit direct execution, subject to format and other controls	Traverse/search it to access named entries

Deleting a file is principally an operation on its parent directory, not a privilege conferred by the file’s write bit. Sticky-directory rules and other controls can prevent removal. A read-only file can therefore still be removable by someone with suitable parent-directory access.

Understand owner, group and numeric modes

The owner has one UID and the file has one GID; group membership determines whether group-class permissions apply. These classes are selected, not simply added together. For each basic triplet, read is 4, write is 2 and execute/search is 1. Thus 640 means owner read/write, group read and no other access; it does not describe ownership.

Choose the right tool and scope

chmod changes mode bits; chown changes ownership. They are external utilities commonly invoked from Bash, not Bash-specific security features. Owners can normally change their file modes, while ownership changes have separate privilege restrictions.

Before changing a website, identify the deployment owner, PHP execution identity, static-file reader and specific writable upload/cache directories. Group ownership alone does not grant write permission. Making all website code writable by its runtime user can increase the impact of an application compromise. Avoid universal recursive 777, 755 or web-server ownership recipes.

References: GNU mode structure; Linux path traversal; directory-entry removal and restrictions.

Reviewed October 15, 2026. Documentation review; no customer filesystem access controls were changed.