Linux File Permissions Cheat Sheet

    -rwxr-xr--  1 user group  4096 Jul 28 10:30 script.sh
    ^ ^^^  ^^^  ^^^
    | |||  |||  |+- File owner and group
    | |||  |||  +-- Number of hard links
    | |||  |||  
    | |||  ||+- Others: read only
    | |||  |+-- Others: no write
    | |||  +--- Others: no execute
    | ||+------ Group: read only
    | |+------- Group: no write
    | +-------- Group: execute
    +---------- User: read, write, execute
            

    -rwxrwxrwx = File with all permissions
    drwxr-xr-x = Directory with typical permissions
    -rw-r--r-- = Regular file with typical permissions
            

    # Numeric mode
    chmod 755 script.sh    # rwxr-xr-x
    chmod 644 text.txt     # rw-r--r--
    chmod 600 private.key  # rw-------

    # Symbolic mode
    chmod u+x script.sh    # Add execute to user
    chmod g-w file.txt     # Remove write from group
    chmod o= file.txt      # Clear all permissions for others
    chmod a+r document.pdf # Add read to all
            

    chmod u+rw,g+r,o-rwx private.txt
    # Add read/write for user, add read for group,
    # remove all for others
            

    # Change owner only
    chown alice file.txt
    
    # Change owner and group
    chown alice:staff file.txt
    
    # Change group only
    chown :developers project/
    
    # Recursively change ownership
    chown -R www-data:www-data /var/www/
            

    # Change group of a file
    chgrp developers project.py
    
    # Recursively change group of a directory
    chgrp -R staff /shared/documents/
            

    # Display current umask (typically 022)
    umask
    
    # Set a new umask value
    umask 027
    # This will create files with 640 (rw-r-----)
    # And directories with 750 (rwxr-x---)
            

    $ ls -l
    -rw-r--r-- 1 user  group   5678 Jun 21 13:45 data.txt
    -rwxr-xr-x 1 user  group   2345 Jun 19 10:32 script.sh
    drwxr-xr-- 2 admin staff   4096 Jun 20 15:22 secure_dir/
            

    $ ls -la
    drwxr-xr-x  3 user  group  4096 Jun 21 14:20 .
    drwxr-xr-x  7 user  group  4096 Jun 10 09:30 ..
    -rw-------  1 user  group  2345 Jun 15 16:42 .bash_history
    -rw-r--r--  1 user  group   220 Jun 10 09:30 .bashrc
    -rw-r--r--  1 user  group  5678 Jun 21 13:45 data.txt
            

    $ stat data.txt
      File: data.txt
      Size: 5678      Blocks: 16         IO Block: 4096   regular file
    Device: 801h/2049d  Inode: 1234567    Links: 1
    Access: (0644/-rw-r--r--)  Uid: ( 1000/   user)   Gid: ( 1000/  group)
    Access: 2023-06-22 10:45:12.000000000 +0200
    Modify: 2023-06-21 13:45:34.000000000 +0200
    Change: 2023-06-21 13:45:34.000000000 +0200
     Birth: -
            

    # With read permission
    $ ls -l dirwithread/
    -rw-r--r-- 1 user group 123 Jun 22 15:30 file1.txt
    -rw-r--r-- 1 user group 456 Jun 22 15:31 file2.txt

    # Without read permission
    $ ls -l dirwithoutread/
    ls: cannot open directory 'dirwithoutread/': Permission denied
            

    # With execute permission
    $ cd dirwithexec/
    $ cat dirwithexec/file.txt  # Works

    # Without execute permission
    $ cd dirwithoutexec/
    bash: cd: dirwithoutexec/: Permission denied
    $ cat dirwithoutexec/file.txt
    cat: dirwithoutexec/file.txt: Permission denied
            

    # Set SUID (numeric)
    chmod 4755 myprogram
    
    # Set SUID (symbolic)
    chmod u+s myprogram
    
    # Display: The 's' replaces 'x' in owner permissions
    -rwsr-xr-x 1 root root 123456 Jun 25 14:20 myprogram
    
    # Example: /usr/bin/passwd has SUID set
    -rwsr-xr-x 1 root root 68208 Apr 16 15:36 /usr/bin/passwd
            

    # Set SGID (numeric)
    chmod 2755 myprog
    chmod 2770 shared_dir/
    
    # Set SGID (symbolic)
    chmod g+s myprog
    chmod g+s shared_dir/
    
    # Display: The 's' replaces 'x' in group permissions
    -rwxr-sr-x 1 user group 123456 Jun 25 14:30 myprog
    drwxrws--- 2 user group 4096 Jun 25 14:35 shared_dir/
            

    # Set sticky bit (numeric)
    chmod 1777 /tmp
    
    # Set sticky bit (symbolic)
    chmod +t /tmp
    
    # Display: The 't' replaces 'x' in others permissions
    drwxrwxrwt 15 root root 4096 Jun 25 15:00 /tmp
            

    chmod 4755 file  # SUID + rwxr-xr-x
    chmod 2755 file  # SGID + rwxr-xr-x
    chmod 1777 dir   # sticky bit + rwxrwxrwx
    chmod 6755 file  # SUID + SGID + rwxr-xr-x
            

    # Give read and execute permissions to everyone for all files in a directory
    chmod -R a+rx /path/to/website/
    
    # Set permissions to 755 for directories and 644 for files
    # This requires a more complex approach:
    find /path/to/dir -type d -exec chmod 755 {} \;
    find /path/to/dir -type f -exec chmod 644 {} \;
            

    # Change ownership of a web directory and all contents
    chown -R www-data:www-data /var/www/html/
    
    # Change ownership but preserve file timestamps
    chown -R --preserve-timestamps user:group directory/
            

    # Make a compiled program executable
    chmod +x program
    
    # Common permission pattern for executables
    chmod 755 program  # rwxr-xr-x
            

    # Try to run a program without execute permission
    $ chmod -x program
    $ ./program
    bash: ./program: Permission denied
    
    # Try to run a program with execute but no read
    $ chmod 111 program
    $ ./program
    bash: ./program: Permission denied
            

    # Create a simple script
    $ echo '#!/bin/bash' > script.sh
    $ echo 'echo "Hello, World!"' >> script.sh
    
    # Make it executable
    $ chmod +x script.sh
    $ ./script.sh
    Hello, World!
            

    # Private script
    chmod 700 backup_my_files.sh
    
    # Shared script
    chmod 755 common_utilities.sh
            

    $ ls -l mylink
    lrwxrwxrwx 1 user group 7 Jun 25 16:20 mylink -> target
    
    # Notice all permissions are set, but they're ignored
    # Actual access is determined by permissions on "target"
            

    # Create a symbolic link
    $ ln -s target mylink
    
    # Trying to change permissions of the link
    $ chmod 600 mylink
    
    # This actually changes permissions of the target
            

    # Create a file
    $ echo "content" > original
    $ chmod 644 original
    
    # Create a hard link
    $ ln original hardlink
    
    # Both show the same permissions because they share the same inode
    $ ls -l original hardlink
    -rw-r--r-- 2 user group 8 Jun 25 16:30 hardlink
    -rw-r--r-- 2 user group 8 Jun 25 16:30 original
            

    # Change permissions on the hard link
    $ chmod 600 hardlink
    
    # Both files now show the new permissions
    $ ls -l original hardlink
    -rw------- 2 user group 8 Jun 25 16:30 hardlink
    -rw------- 2 user group 8 Jun 25 16:30 original
            

    # Set sticky bit with numeric mode
    chmod 1777 /shared
    
    # Set sticky bit with symbolic mode
    chmod +t /shared
            

    $ ls -ld /tmp
    drwxrwxrwt 20 root root 4096 Jun 26 10:15 /tmp
                ^
                |-- 't' indicates sticky bit is set
            

    # Find files with exactly 644 permissions
    find /home -perm 644
            

    # Find files where all users have read permission
    find /home -perm -444
            

    # Find files that are world-writable
    find /home -perm /002
            

    # Find SUID files
    find / -perm -4000 -type f
    
    # Find world-writable files
    find / -perm -2 -type f -not -path "/proc/*"
    
    # Find world-writable directories
    find / -perm -2 -type d -not -path "/proc/*"
    
    # Find files not owned by any user
    find / -nouser
            

    $ ls -l file_with_acl
    -rw-r--r--+ 1 user group 1234 Jun 26 11:30 file_with_acl
                ^
                |-- The '+' indicates ACLs are set
            

    $ getfacl document.txt
    # file: document.txt
    # owner: john
    # group: staff
    user::rw-
    user:mary:r--
    group::r--
    mask::r--
    other::---
            

    # Give user alice read and write permissions
    setfacl -m u:alice:rw- document.txt
    
    # Give group devs read permission
    setfacl -m g:devs:r-- document.txt
    
    # Multiple rules at once
    setfacl -m u:bob:r--,g:admins:rwx document.txt
            

    # Remove ACL for user alice
    setfacl -x u:alice document.txt
    
    # Remove ACL for group devs
    setfacl -x g:devs document.txt
            

    # Recursively give read access to user bob
    setfacl -R -m u:bob:r-x /shared/projects/
            

    # Set default ACL for user alice
    setfacl -m d:u:alice:rwx /projects/
    
    # Set default ACL for group devs
    setfacl -m d:g:devs:rx /projects/
    
    # Set multiple default ACLs
    setfacl -m d:u:bob:rx,d:g:admins:rwx /projects/
            

    $ getfacl /projects/
    # file: /projects/
    # owner: admin
    # group: staff
    user::rwx
    group::r-x
    other::r-x
    default:user::rwx
    default:user:alice:rwx
    default:group::r-x
    default:group:devs:r-x
    default:mask::rwx
    default:other::r-x
            

    # Remove all ACLs from a file
    setfacl -b document.txt
            

    # Remove only default ACLs
    setfacl -k /projects/
            

    # Recursively remove all ACLs from directory and contents
    setfacl -R -b /projects/
            

    # Find world-writable files
    find / -type f -perm -o=w -not -path "/proc/*" -ls
    
    # Fix by removing world write permission
    chmod o-w vulnerable_file
            

    # Find SUID/SGID files
    find / -type f \( -perm -4000 -o -perm -2000 \) -ls
    
    # Remove SUID/SGID if not needed
    chmod u-s,g-s script.sh
            

    # Secure home directory
    chmod 750 /home/username
    
    # Check with:
    ls -ld /home/*
            

    # Correct permissions for SSH private keys
    chmod 600 ~/.ssh/id_rsa
    
    # Correct permissions for SSH directory
    chmod 700 ~/.ssh
            

    # Secure home directory
    chmod 750 /home/username
    
    # Ensure sensitive files are private
    chmod 600 ~/.bash_history ~/.aws/credentials
            

    # Make config files only readable by owner
    chmod 600 config.ini credentials.txt
    
    # System configs readable by specific groups
    chmod 640 /etc/mysql/my.cnf
            

    # Web directories
    find /var/www -type d -exec chmod 755 {} \;
    
    # Web files
    find /var/www -type f -exec chmod 644 {} \;
    
    # CGI scripts
    find /var/www/cgi-bin -type f -exec chmod 755 {} \;
            

    # Add execute permission
    chmod +x script.sh
            

    # Add execute permission to directory
    chmod +x /path/to/directory
    
    # Check parent directories too
    ls -ld / /path /path/to
            

    # Add write permission to directory
    chmod +w /path/to/directory
            

    # Add write permission to directory
    chmod +w /path/to/directory
            

    # Standard web directory permissions
    chown -R www-data:www-data /var/www/html
    find /var/www/html -type d -exec chmod 755 {} \;
    find /var/www/html -type f -exec chmod 644 {} \;
    
    # For writable directories (uploads, cache)
    chmod 775 /var/www/html/uploads
            

    # Server host keys
    chmod 600 /etc/ssh/ssh_host_*_key
    chmod 644 /etc/ssh/ssh_host_*_key.pub
    
    # sshd_config
    chmod 600 /etc/ssh/sshd_config
    
    # User's .ssh directory
    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/authorized_keys
            

    # MySQL data directory
    chown -R mysql:mysql /var/lib/mysql
    chmod 750 /var/lib/mysql
    
    # MySQL config
    chmod 640 /etc/mysql/my.cnf
            

    # Install auditd
    apt install auditd
    
    # Add audit rule for chmod
    auditctl -w /bin/chmod -p x -k permission_changes
    
    # Add audit rule for chown
    auditctl -w /bin/chown -p x -k permission_changes
    
    # View audit logs
    ausearch -k permission_changes
            

    # Install AIDE
    apt install aide
    
    # Initialize database
    aide --init
    
    # Check for changes
    aide --check
            

    # /etc/exports entry with permission options
    /shared *(rw,sync,no_root_squash)
    
    # Mounting with specific permissions
    mount -o rw,users server:/shared /mnt/shared
            

    # Samba share with permissions in smb.conf
    [shared]
      path = /shared
      valid users = @staff
      writable = yes
      create mask = 0644
      directory mask = 0755
            

    # View SELinux context of a file
    ls -Z /var/www/html/index.html
    
    # Change SELinux context
    chcon -t httpd_sys_content_t /path/to/file
    
    # Set default context for web content
    semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
    restorecon -R /web
            

    # View AppArmor status
    aa-status
    
    # Put profile in complain mode
    aa-complain /usr/sbin/apache2
    
    # Put profile in enforce mode
    aa-enforce /usr/sbin/apache2
            

    # Set explicit ownership on mounted volume
    docker run -v /host/data:/container/data:rw \
      --user 1000:1000 my-image
    
    # Use chown when creating volume
    docker run -v /host/data:/container/data:rw \
      my-image chown -R user:group /container/data
            

    # Run container as non-root user
    docker run --user 1000:1000 my-image
    
    # In Dockerfile
    USER appuser
            

    # View user and group info
    id username
    
    # View file ownership by ID
    ls -ln /path/to/file
            

    # Find files with no valid owner
    find / -nouser
    
    # Find files with no valid group
    find / -nogroup
    
    # Fix orphaned files
    chown newuser:newgroup /path/to/orphaned/file
            

    # Create system user
    useradd -r -s /usr/sbin/nologin serviceuser
    
    # Create system group
    groupadd -r servicegroup
            

    # Set SGID on directory
    chmod g+s /shared/project
    
    # Files created will inherit the group
    touch /shared/project/newfile
    

    # Set inherited ACLs with NFSv4
    nfs4_setfacl -a A:fd:user@domain:rwx /mnt/nfs/dir
            

    # Set ACL inheritance on ZFS
    chmod A+everyone@:read_data/inherited:allow /tank/data
            

    # Check current umask
    umask
    
    # Set default umask in /etc/profile or ~/.bashrc
    umask 022
            

    # AWS CLI S3 command with ACL
    aws s3 cp file.txt s3://bucket/ --acl public-read
            

    # In Dockerfile
    RUN mkdir -p /app && chmod 755 /app
    COPY --chown=appuser:appgroup app/ /app/
            

    # Make a file immutable
    chattr +i important.conf
    
    # Try to modify an immutable file
    $ rm important.conf
    rm: cannot remove 'important.conf': Operation not permitted
            

    # Make a log file append-only
    chattr +a logfile.log
    
    # Can add data:
    echo "new entry" >> logfile.log
    
    # Cannot truncate:
    $ echo "overwrite" > logfile.log
    bash: logfile.log: Operation not permitted
            

    $ lsattr important.conf
    ----i--------e-- important.conf
    
    $ lsattr logfile.log
    -----a-------e-- logfile.log
            

    # Mount with noexec
    mount -o noexec /dev/sdb1 /mnt/data
    
    # In /etc/fstab
    /dev/sdb1 /mnt/data ext4 defaults,noexec 0 0
            

    # Mount with nosuid
    mount -o nosuid /dev/sdb1 /mnt/data
    
    # In /etc/fstab
    /dev/sdb1 /mnt/data ext4 defaults,nosuid 0 0
            

    # Mount with multiple security options
    mount -o noexec,nosuid,nodev /dev/sdb1 /mnt/data
            

    # Check all groups a user belongs to
    groups username
    
    # Check effective group membership
    id username
            

    # Test file access as a different user
    sudo -u otheruser cat /path/to/file
    
    # Check access while considering ACLs
    getfacl /path/to/file
            

    #!/bin/bash
    # Save original umask
    old_umask=$(umask)
    
    # Set strict umask
    umask 077
    
    # Create sensitive file
    touch sensitive_data.txt
    echo "secret" > sensitive_data.txt
    
    # Restore original umask
    umask $old_umask
            

    # Temporarily open permissions, then restore
    chmod 644 config.file
    editor config.file
    chmod 600 config.file
            

    # Run a command with a different group
    sg developers -c "touch /shared/project/newfile"
    
    # Run as a different user/group
    sudo -u webuser -g webgroup command