File permissions form the foundation of Linux and UNIX multi-user security. Every file, directory, socket, and pipe in Linux is governed by a 9-bit permission mask divided among three distinct security identities: the User (Owner), the Group, and Others (Public). Incorrectly configured permissions (such as the notorious chmod 777) are among the most common root causes of web server compromises and arbitrary code execution.
1. The Anatomy of Linux Permissions: Read, Write & Execute
When you run ls -la in a terminal, Linux displays file permissions in a 10-character string such as -rwxr-xr--:
- Character 1 (File Type):
-for regular file,dfor directory,lfor symbolic link,c/bfor character/block device. - Characters 2-4 (User/Owner): Permissions granted to the user who owns the file.
- Characters 5-7 (Group): Permissions granted to members of the file's assigned group.
- Characters 8-10 (Others/World): Permissions granted to all other system users and unauthenticated processes.
2. Octal Mathematical Weights
Each permission is assigned a binary power-of-two numeric value:
| Permission | Symbol | Binary Bit | Octal Value | Effect on Files | Effect on Directories |
|---|---|---|---|---|---|
| Read | r | 100 | 4 | View file content | List filenames inside directory (ls) |
| Write | w | 010 | 2 | Modify or truncate file | Create, rename, or delete files in directory |
| Execute | x | 001 | 1 | Run binary or script | Enter directory (cd) or access inodes |
To calculate an octal digit, sum the values:
rwx= 4 + 2 + 1 = 7 (Full read, write, and execute)rw-= 4 + 2 + 0 = 6 (Read and write, no execute)r-x= 4 + 0 + 1 = 5 (Read and execute, no write)r--= 4 + 0 + 0 = 4 (Read-only)---= 0 + 0 + 0 = 0 (No permissions at all)
3. Special Permission Bits: SUID, SGID & Sticky Bit
In enterprise security, standard 3-digit octal notation is preceded by an optional 4th leading digit representing special kernel flags:
- SUID (Set User ID - Octal 4): When an executable file has SUID set (e.g.,
chmod 4755 /usr/bin/passwd), it executes with the privileges of the file owner (typicallyroot), rather than the user launching it. - SGID (Set Group ID - Octal 2): When set on a directory (
chmod 2775 /var/shared), newly created files automatically inherit the parent directory's group ownership rather than the creating user's primary group. - Sticky Bit (Octal 1): Indicated by a trailing
t(e.g.,chmod 1777 /tmp). In a world-writable directory with sticky bit enabled, only the file's owner orrootcan delete or rename the file, preventing malicious users from deleting each other's temporary files.
4. Production Hardening Rules for Web Servers & SSH
Never use chmod 777 on production environments. Follow these industry-standard least-privilege benchmarks:
- Web Server Directories:
chmod 755 /var/www/html(Owner can modify; web server and visitors can browse and read). - Static Web Files (HTML, CSS, JS):
chmod 644 /var/www/html/index.html(Prevent arbitrary in-place modification by unprivileged processes). - Configuration Files (wp-config.php, .env):
chmod 600 .envorchmod 640 .envwith ownership assigned towww-data. - SSH Key Directory:
chmod 700 ~/.ssh(OpenSSH server strictly refuses login if~/.sshis readable by others). - SSH Private Keys:
chmod 600 ~/.ssh/id_ed25519(OpenSSH refuses to load private keys with broad permissions).
5. Interactive Sysadmin Utilities
- Chmod Permissions Calculator - Interactive 3x3 permission grid with instant octal & symbolic generator.
- Linux Terminal & Sysadmin Matrix - Top 50 server management, disk monitoring, and process commands.
- SSH Commands & Remote Admin Matrix - Key generation, tunneling, and secure configuration.
- Iptables & Netfilter Firewall Matrix - Packet filtering, port allow/drop, and rate limiting rules.