What do the numeric values 4, 2, and 1 represent in chmod permissions?

In Linux octal permissions, each permission type is assigned a base-2 binary weight: Read (r) = 4, Write (w) = 2, and Execute (x) = 1. Combining these yields numeric values from 0 to 7 (e.g. Read + Write = 4 + 2 = 6; Read + Write + Execute = 4 + 2 + 1 = 7).

What is the difference between execute (x) permission on a file vs a directory?

On a regular file, execute permission allows the file to be run as an executable program or shell script. On a directory, execute permission is required to enter or traverse the directory using 'cd' and access file inodes within it.

What does the Sticky Bit do when applied to a directory?

When the Sticky Bit (numeric 1000, symbolic 't') is applied to a directory (such as /tmp), users can write and create files inside the directory, but they can only delete or rename files that they personally own, preventing users from maliciously deleting each other's work.

What does the SGID bit on a directory accomplish?

When the SetGID (SGID, numeric 2000, symbolic 's') bit is set on a directory, any new file or subfolder created inside automatically inherits the group ownership of the parent directory, rather than the primary group of the user who created it. This is essential for team collaboration folders.

How does umask determine default file permissions?

The umask (user file-creation mode mask) acts as a bitmask filter that subtracts permissions from system maximum base values (666 for files, 777 for directories). With a standard umask of 022, new directories receive 755 (777 - 022) and new files receive 644 (666 - 022).

Class 40: Linux File Permissions & Ownership Masterclass

chmod Octal Math, chown Ownership, umask Calculations, and Special SUID, SGID & Sticky Bits

Security in Linux is rooted directly inside the filesystem inode. Every single file, directory, symlink, and device node maintains a 12-bit security mode governing access rights. Understanding permission bits, octal values, ownership, and special execution bits is the defining hallmark of a professional Linux system administrator.

1. The Unix Permission Model: Classes & Permissions

When you execute ls -l, the first column displays a 10-character string representing the file type and access permissions:

-rwxr-xr--  1 student devops  4096 Nov  2 11:30 deploy.sh

Character 1: File Type (- = regular file, d = directory, l = symbolic link, c/b = character/block device).
Characters 2-4: Owner (User - u) permissions (read, write, execute).
Characters 5-7: Group (g) permissions (read, write, execute).
Characters 8-10: Others (World - o) permissions (everyone else).

Linux File Permissions Structure Diagram

Figure 40.1: Anatomy of Linux File Permissions, Classes & Octal Weights

Critical Distinction: Files vs Directories

Permission	Meaning on Regular Files	Meaning on Directories
Read (r = 4)	Open and view file content (`cat`, `less`)	List directory contents (`ls`)
Write (w = 2)	Modify or truncate file content (`vim`, `>`)	Create, delete, or rename files inside this directory
Execute (x = 1)	Run the file as an executable binary or script	Enter and traverse the directory (`cd`, access file inodes)

2. Numeric (Octal) Math: chmod

Each 3-character permission triplet is calculated by summing the binary weights of its enabled bits:

r = 4
w = 2
x = 1
- = 0

Octal Mode	Symbolic Representation	Real-World Usage & Standard Application
`755`	`rwxr-xr-x`	Standard for executable scripts and directories (Owner has full control; everyone can read and traverse).
`644`	`rw-r--r--`	Standard for documents, configuration files, and web pages (Owner can read/write; others read-only).
`700`	`rwx------`	Private scripts and private directories (e.g. `~/.ssh/`).
`600`	`rw-------`	Private cryptographic keys and sensitive credentials (e.g. `~/.ssh/id_ed25519`).
`777`	`rwxrwxrwx`	DANGEROUS! Anyone on the system can read, modify, and delete the file. Avoid in production!

Modifying Permissions with Symbolic and Octal chmod:

# 1. Octal notation: Grant standard web directory permissions
chmod 755 /var/www/html

# 2. Octal notation: Secure private SSH key
chmod 600 ~/.ssh/id_rsa

# 3. Symbolic notation: Add execute permission for owner only (u+x)
chmod u+x deploy_server.sh

# 4. Symbolic notation: Revoke write permissions for group and others (go-w)
chmod go-w sensitive_report.pdf

# 5. Recursive change: Apply to entire directory hierarchy (-R)
chmod -R 750 /opt/internal_tools/

3. Managing Ownership: chown & chgrp

The chown (Change Owner) command updates the user and group ownership of files:

# 1. Change user owner only
sudo chown alex server.py

# 2. Change both user owner AND group owner simultaneously (user:group)
sudo chown -R www-data:www-data /var/www/html

# 3. Change group owner using chown (prefix with colon)
sudo chown :devops project_notes.md

# 4. Dedicated group change command: chgrp
sudo chgrp developers /opt/shared_code/

4. Default Creation Mask: umask

When a program creates a file, what permissions does it receive automatically? The operating system determines this via the umask (user file-creation mode mask):

Maximum base permissions for new directories: 777 (rwxrwxrwx)
Maximum base permissions for new files: 666 (rw-rw-rw-) [Security rule: files never get execute by default!]

The umask is subtracted from base permissions:
• With standard umask 022:
  Directory: 777 - 022 = 755 (rwxr-xr-x)
  File: 666 - 022 = 644 (rw-r--r--)
• With restrictive umask 027:
  Directory: 777 - 027 = 750
  File: 666 - 027 = 640

# View current umask in octal
umask
# Output: 0022

# Set temporary restrictive umask for current session
umask 077
touch private.txt && ls -l private.txt
# Output: -rw------- (only owner can read/write!)

5. Special Permission Bits: SUID, SGID & Sticky Bit

Standard rwx permissions cannot solve advanced security requirements, such as allowing unprivileged users to modify /etc/shadow or preventing users from deleting files in /tmp. Linux solves this with three special permission bits represented by a 4th leading octal digit:

Special Bit	Octal Value	Symbolic	Applied To	Behavior & Real-World Example
SUID (SetUID)	`4000`	`s` in owner's execute field (e.g. `-rwsr-xr-x`)	Executable binary files	The executable runs with the effective privileges of the file's owner (typically root), rather than the user running it. Classic Example: `/usr/bin/passwd` (allows users to update `/etc/shadow`).
SGID (SetGID)	`2000`	`s` in group's execute field (e.g. `drwxrwsr-x`)	Directories (and executables)	When set on a directory, all newly created files and subdirectories automatically inherit the group ownership of the parent directory, rather than the creator's primary group. Essential for team collaboration!
Sticky Bit	`1000`	`t` in others' execute field (e.g. `drwxrwxrwt`)	Shared directories	Users can create files in the directory, but only the file's owner (or root) can delete or rename the file. Classic Example: `/tmp` and `/var/tmp`.

# 1. Set SUID on an executable binary (octal 4755 or symbolic u+s)
sudo chmod 4755 /usr/local/bin/custom_tool

# 2. Set SGID on a shared team collaboration folder (octal 2775 or symbolic g+s)
sudo chmod 2775 /var/projects/devteam

# 3. Set Sticky Bit on a shared scratch directory (octal 1777 or symbolic +t)
sudo chmod 1777 /shared_scratch/

Student Practical Terminal Lab: Collaborative Directory Setup

Terminal Lab Exercise: Open your terminal and build a production-grade shared collaboration directory utilizing SGID and group permissions:

# Step 1: Create a shared directory
sudo mkdir -p /var/lab_shared

# Step 2: Create a collaboration group and add your user
sudo groupadd -r project_team 2>/dev/null || true
sudo gpasswd -a $USER project_team

# Step 3: Assign group ownership to project_team
sudo chown :project_team /var/lab_shared

# Step 4: Apply SGID bit and read/write/execute for owner and group (2775)
sudo chmod 2775 /var/lab_shared

# Step 5: Verify special SGID bit in ls -ld
ls -ld /var/lab_shared
# Output shows: drwxrwsr-x 2 root project_team ...

# Step 6: Create a test file inside and observe group inheritance
touch /var/lab_shared/test_doc.txt
ls -l /var/lab_shared/test_doc.txt
# Notice group owner is automatically project_team!

# Clean up lab directory
sudo rm -rf /var/lab_shared
echo "Collaboration permissions lab complete!"

Viva Voce & Technical Interview Questions

1. What are the binary weights of read, write, and execute in chmod?

Read (r) = 4, Write (w) = 2, Execute (x) = 1. Combining them produces numeric values from 0 (no access) to 7 (full read, write, and execute).

2. What happens if a user has read permission on a directory but lacks execute permission?

The user can run ls to view the filenames within the directory, but they cannot cd into it, cannot view file metadata (size, timestamps, permissions via ls -l), and cannot access or read any files inside.

3. How does the Sticky Bit protect the /tmp directory?

Because /tmp has world-writable permissions (777), any user can write files there. The Sticky Bit ensures that an unprivileged user can only delete or rename files that they personally own, preventing users from sabotaging or deleting each other's temporary files.

4. What does the SGID bit do when applied to a directory?

It forces any new files or subdirectories created inside to inherit the group ownership of the directory itself, rather than inheriting the creator's default primary group.

5. What does SUID do on an executable binary?

SUID causes the binary to execute with the privileges of the file's owner (frequently root) rather than the privileges of the user launching the command.

6. What is the difference between lowercase 's' and uppercase 'S' in SUID/SGID listings?

A lowercase s indicates that the underlying execute bit (x) is also enabled. An uppercase S indicates that SUID/SGID is set, but the underlying execute bit is NOT set (which is usually a misconfiguration error).

7. If umask is 027, what are default permissions for newly created directories and files?

Directories: 777 - 027 = 750 (rwxr-x---). Files: 666 - 027 = 640 (rw-r-----).

8. Can a non-root user transfer ownership of a file to another user using chown?

No. On modern Linux systems, only the superuser (root) can change the user owner of a file (preventing users from bypassing disk quotas or passing malicious files). Regular users can only change the group owner of files they own to a group they belong to.

9. Why should you never set permissions to 777 in production?

777 allows any local user or compromised service process on the system to read, overwrite, infect with malicious code, or delete your files, violating security compliance standards.

10. How do you find all SUID executables across the entire filesystem?

Run find / -perm -4000 -type f 2>/dev/null. Security auditors monitor this list closely to detect unauthorized privilege escalation binaries.