Don't Panic — Linux Users, Groups, and Permissions

Linux access control is a small tribunal conducted at great speed. A process arrives carrying numeric user and group IDs. A file or directory presents its numeric owner, group, and mode. The kernel compares them and permits or denies the requested operation. The familiar names are there so humans can cope; the numbers are what the filesystem keeps when humans are elsewhere having a meeting.

The crucial idea is that Linux chooses one ordinary permission class. If the process's effective user ID owns the object, owner bits apply. Otherwise a matching group can select group bits. Otherwise, other bits apply. They do not combine into a generous buffet. An owner denied by owner bits does not borrow group access, however politely it asks.

Directories are the usual ambush. Search permission is directory execute permission: it allows a name to be resolved through that directory. Read lists names. Write changes entries. So deleting a file depends on its containing directory, while changing file contents depends on the file. A mode that looks like a tiny row of letters is therefore a map of several different operations wearing a trench coat.

Groups make shared access manageable. Give a project directory a project group, grant the group the required directory access, and set the directory's set-group-ID bit when new children must keep that group. New group membership does not alter credentials already carried by a running shell or service, so begin a new authenticated session before declaring the change mysteriously ineffective.

When access fails, start with the current process and numeric ownership. Then trace every parent directory, the selected mode class, any ACL mask, mount state, and mandatory security policy. An ACL can grant named-user or named-group entries, but its mask can limit what those entries actually deliver. A permissive-looking file is not a guarantee; Linux has several more opportunities to say no.

For the detailed map, read the Intro and then the Slides. Use the Cheatsheet beside a terminal for mode values and diagnostic order. The Practice Reference and exercise keep the experiment inside a temporary directory, where no production path is harmed in the making of a useful mistake. The Timeline explains how capabilities and user namespaces made the old all-powerful root story less tidy. It was never really tidy; it merely had fewer chapters.

Don't Panic — Linux Users, Groups, and Permissions

Relevant careers