topics/07-users-and-permissions

Users & Permissions

Linux was built for many people sharing one machine safely — and that model is exactly why it's so secure today. Learn who root is, what sudo really does, and how to read rwxr-xr-x like a pro.

Root vs regular users

Regular user — that's you

Your everyday account. Full control over your files in /home/you, but can't modify system files or other users' stuff. This is by design: if you (or malware pretending to be you) break something, the damage stays contained.

Root — the superuser

The all-powerful administrator account. Can read, change or delete anything, including the operating system itself. Essential for maintenance — catastrophic for mistakes. On most distros you don't log in as root at all; you borrow its power per-command with sudo.

The golden rule: do everyday work as your regular user. Reach for admin powers only when installing software or changing system settings — never “just in case”.

perms/sudo

sudo — temporary superpowers

sudo (superuser do) runs a single command as root. You authenticate with your own password, the system checks you're allowed (your user must be in the sudo group), runs that one command — and the powers expire immediately after.

bash — sudo in action

alex@pc:~$apt updateE: Could not open lock file - open (13: Permission denied)alex@pc:~$sudo apt update[sudo] password for alex:Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease# same command — but now with admin rights, it works

Remember: your password stays invisible while typing (no dots, no asterisks) — a Unix tradition. Type it and press Enter; it works.

perms/rwx

Reading file permissions: rwx

Every file and folder answers three questions, for three audiences: its owner, its group, and everyone else. May they read it? write (change) it? execute (run/enter) it? Run ls -l and the answer is the ten characters at the start of each line:

file type
- file · d folder

rwx

owner (you)

r-x

group

---

everyone else

So -rwxr-x--- = a file, whose owner may read, write and run it, whose group may read and run it, and which is invisible to everyone else. A dash - always means “nope, not allowed”.

bash — read it in the wild

alex@pc:~$ls -l-rw-r--r--  1 alex alex  2048  notes.txt      # you: read+write · others: read only-rwxr-xr-x  1 alex alex  8192  backup.sh      # everyone may run it; only you may editdrwx------  2 alex alex  4096  private/       # folder only you can enter

perms/chmod

chmod — changing permissions

chmod (change mode) edits those nine letters. It speaks two dialects — learn whichever clicks first, they do the same thing.

Dialect 1 · Symbols (great for small tweaks)

Who: u user/owner, g group, o others, a all. Do what: + add, - remove. What: r w x.

bash — symbolic mode

alex@pc:~$chmod u+x script.sh     # owner gains executealex@pc:~$chmod g-w report.txt    # group loses writealex@pc:~$chmod o-r secret.txt    # others lose read

Dialect 2 · Numbers (great for full control)

Each permission has a value: r = 4, w = 2, x = 1. Add them up per audience and you get the famous three-digit codes:

Code	Math	Means	Typical use
`755`	7=4+2+1 · 5=4+1 · 5=4+1	owner: rwx · group+others: r-x	scripts, programs, public folders
`644`	6=4+2 · 4 · 4	owner: rw- · group+others: r--	normal documents (the default)
`700`	7 · 0 · 0	owner: rwx · others: nothing	fully private folders
`600`	6 · 0 · 0	owner: rw- · others: nothing	private files, SSH keys

bash — numeric mode

alex@pc:~$chmod 755 run-me.sh      # make it executable for everyonealex@pc:~$chmod 600 ~/.ssh/id_ed25519  # SSH keys must stay privatealex@pc:~$chmod 700 ~/private     # my eyes only

Never chmod 777 to “fix” a problem — it gives the whole world full access. If an app can't read a file, the right fix is nearly always adjusting ownership (chown) or adding the one missing permission.

Finished this topic?

Saved locally in your browser — no account needed.