KWAS Academy
Learn. Build. Master.
QUICK START:HTMLCSSJavaScriptTypeScriptPythonSQLReactNext.jsNode.jsLinux & UbuntuKotlinSwiftC# / .NETJavaGoRustC++DSASystem DesignDevOpsCybersecurityAI / ML
Beginner 22 min readModule: Module 3: Permissions, Ownership & Access Control (POSIX & ACLs)

File Permissions, Ownership & Special Bits (SUID/SGID)

Understand read/write/execute permissions for User, Group, and Others, umask calculations, SUID executables, and the Sticky Bit on shared directories.

What You Will Learn in This Lesson

  • The 3x3 POSIX permission matrix (User, Group, Others with r, w, x)
  • Calculating octal numeric permission modes (e.g. 755, 644, 600, 700)
  • Changing ownership and group affiliation with chown and chgrp
  • Special permission bits: SetUID (4000), SetGID (2000), and Sticky Bit (1000)

Introduction & Core Concept

Linux is a multi-user operating system with robust POSIX access control. Every file and directory is owned by a User (UID) and a Group (GID), with permissions governing Read (r=4), Write (w=2), and Execute (x=1) access for the Owner, the owning Group, and all Other users on the system.
WHY DOES THIS MATTER IN THE REAL WORLD?

Improper permissions are a primary cause of security vulnerabilities (e.g., world-writable private SSH keys or database credentials) and deployment failures. Mastering permission masks and special bits guarantees system integrity.

Syntax & Structure

bash
chmod 755 script.sh
chmod 600 id_rsa
chown deploy:www-data /var/www/html
chmod +t /shared_directory

Configuring Secure File and Directory Permissions

bash
bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
#!/usr/bin/env bash
# POSIX Permission Hardening Demonstration
 
mkdir -p /tmp/secure_app && cd /tmp/secure_app
 
# Create sensitive credential file and executable script
touch db_credentials.env deploy.sh
 
# 1. Restrict sensitive secret to Owner ONLY (Read/Write = 600)
chmod 600 db_credentials.env
 
# 2. Grant Owner Read/Write/Exec (7), Group & Others Read/Exec (5) = 755
chmod 755 deploy.sh
 
# 3. Create a shared temporary directory with Sticky Bit (+t / 1777)
mkdir -p shared_uploads
chmod 1777 shared_uploads
 
# Inspect permissions format
ls -ld db_credentials.env deploy.sh shared_uploads

Line-by-Line Technical Breakdown

1Octal Math: Read = 4, Write = 2, Execute = 1. Add them together for each triad: rwx = 4+2+1 = 7, rw- = 4+2+0 = 6, r-x = 4+0+1 = 5, r-- = 4+0+0 = 4.
2Special Bits: SUID (4xxx) executes a binary with the permissions of the file owner (e.g., /usr/bin/passwd). SGID (2xxx) on directories forces newly created files to inherit the parent directory's group. Sticky Bit (1xxx) restricts file deletion in shared directories.

Try It Yourself (Interactive Editor)

Modify the code in real-time and click Run to test live browser output and console logs.

Intelligent Code Runner & Live Sandbox[BASH]
BASH SOURCE EDITOR
Interactive Live Code

Common Mistakes & How to Avoid Them

#1: Using chmod 777 as a quick fix to resolve application permission errors.

chmod 777 makes every file readable, writable, and executable by every user and process on the system, creating severe security holes.

Incorrect / Antipattern
chmod -R 777 /var/www/app
Correct / Professional Solution
chown -R www-data:www-data /var/www/app
find /var/www/app -type d -exec chmod 755 {} +
find /var/www/app -type f -exec chmod 644 {} +

Industry Best Practices & Professional Standards

  • Private keys (~/.ssh/id_rsa) must always be set to chmod 600 (or chmod 400).
  • Set default directory permissions to 755 and file permissions to 644.
  • Configure umask 027 in production environments to prevent newly created files from being readable by unauthenticated users.

Lesson Summary & Core Takeaways

  • Permissions are evaluated in strict order: Owner → Group → Others.
  • Numeric modes use octal sums: Read (4) + Write (2) + Execute (1).
  • The Sticky bit (1777) protects shared multi-user folders from unauthorized deletion.