Linux File Permissions Explained: chmod, chown and umask

Overview

This tutorial covers Linux file permissions from the ground up, focusing on the three core tools every system administrator must master: chmod, chown, and umask. You will learn how to read permission strings, assign ownership, modify access modes using both symbolic and octal notation, and control default permissions for newly created files and directories.

Prerequisites:

• Basic Linux command-line familiarity
• Access to a RHEL 8/9, CentOS Stream, or compatible Linux environment
• A non-root user account with sudo privileges

File permissions are a core domain on the Red Hat Certified System Administrator (RHCSA) exam (EX200). Expect hands-on tasks requiring you to set specific permissions, change ownership for services, and configure umask for users or system-wide environments. Getting these wrong in the exam environment means services fail and points are lost.

Getting Started

Log into your Linux system and create a working directory to follow along safely:

# Create a sandbox directory
mkdir ~/permissions-lab
cd ~/permissions-lab

# Create sample files and a directory
touch file1.txt file2.sh
mkdir mydir

# List with full permission details
ls -la

The output of ls -la will show something like:

-rw-r--r--. 1 clouduser clouduser    0 Jan 10 09:00 file1.txt
-rw-r--r--. 1 clouduser clouduser    0 Jan 10 09:00 file2.sh
drwxr-xr-x. 2 clouduser clouduser    6 Jan 10 09:00 mydir

The permission string -rw-r--r-- breaks down as: file type (-), owner permissions (rw-), group permissions (r--), and others permissions (r--). Directories use d as the file type character.

chmod and Permission Modes

chmod (change mode) modifies read (r=4), write (w=2), and execute (x=1) permissions for three identity classes: user/owner (u), group (g), and others (o).

Symbolic notation is human-readable and precise for targeted changes:

# Add execute permission for the owner only
chmod u+x file2.sh

# Remove write permission from group and others
chmod go-w file1.txt

# Set exact permissions: owner rwx, group rx, others nothing
chmod u=rwx,g=rx,o= mydir

# Add read permission for all three classes at once
chmod a+r file1.txt

# Verify the result
ls -la file2.sh file1.txt mydir

Octal notation sets all three classes simultaneously and is faster for known permission targets:

# 755 = rwxr-xr-x  (standard for executables and public directories)
chmod 755 file2.sh

# 644 = rw-r--r--  (standard for regular config and text files)
chmod 644 file1.txt

# 700 = rwx------  (private directory, owner only)
chmod 700 mydir

# 600 = rw-------  (private file, e.g., SSH private keys)
touch secret.key
chmod 600 secret.key

ls -la

Recursive chmod applies changes to all files and subdirectories. Use with caution in production:

# Recursively set 755 on all contents of mydir
chmod -R 755 mydir

# Better approach: set directories to 755, files to 644 using find
find mydir -type d -exec chmod 755 {} \;
find mydir -type f -exec chmod 644 {} \;

Common pitfall: Applying chmod -R 777 is a security risk and a common exam trap. Never use it on system directories. Also note that execute permission on a directory means the ability to enter it — without x, users cannot cd into the directory even if they have read permission.

chown, chgrp and Ownership

chown (change owner) assigns user and group ownership to files and directories. Only root or a privileged user can change file ownership.

# Create a test user for demonstration (run as root or with sudo)
sudo useradd devuser
sudo groupadd devteam
sudo usermod -aG devteam devuser

# Change owner of file1.txt to devuser
sudo chown devuser file1.txt

# Change owner and group simultaneously
sudo chown devuser:devteam file2.sh

# Change group only (colon with no user specified)
sudo chown :devteam secret.key

# Alternatively use chgrp
sudo chgrp devteam mydir

# Recursive ownership change
sudo chown -R devuser:devteam mydir

# Verify ownership
ls -la

Real-world example: When deploying a web application with Apache or Nginx, files must be owned by the service account:

# Apache on RHEL runs as apache:apache
sudo chown -R apache:apache /var/www/html/myapp
sudo chmod -R 755 /var/www/html/myapp

# For files that should not be world-readable (configs with secrets)
sudo chmod 640 /var/www/html/myapp/config.php
sudo chown apache:apache /var/www/html/myapp/config.php

Special permission bits are also part of the RHCSA scope:

# SUID (4) - file executes as the owner, not the calling user
chmod u+s /usr/bin/somebinary
# Octal: chmod 4755 /usr/bin/somebinary

# SGID (2) - files created inside inherit the directory group
chmod g+s mydir
# Octal: chmod 2755 mydir

# Sticky bit (1) - only owner can delete their files (used on /tmp)
chmod +t mydir
# Octal: chmod 1777 /tmp

# Find all SUID binaries on the system (useful for security audits)
find / -perm -4000 -type f 2>/dev/null

umask and Default Permissions

umask (user file creation mask) defines which permission bits are removed by default when a new file or directory is created. It is a mask subtracted from the maximum defaults: 666 for files and 777 for directories.

# Check the current umask value
umask
# Common default output: 0022

# Understand the math:
# Files:       666 - 022 = 644 (rw-r--r--)
# Directories: 777 - 022 = 755 (rwxr-xr-x)

# Verify by creating files and checking permissions
touch testfile
mkdir testdir
ls -la testfile testdir

# Change umask for the current session
umask 027
# Files:       666 - 027 = 640 (rw-r-----)
# Directories: 777 - 027 = 750 (rwxr-x---)

touch securefile
mkdir securedir
ls -la securefile securedir

To make umask persistent for a specific user, add it to their shell profile:

# Per-user persistent umask (add to ~/.bashrc or ~/.bash_profile)
echo 'umask 027' >> ~/.bashrc
source ~/.bashrc

# System-wide default for all users (RHEL/CentOS)
sudo vi /etc/profile
# Add or modify the line: umask 022

# For a specific service or application user via /etc/profile.d/
echo 'umask 027' | sudo tee /etc/profile.d/custom-umask.sh
sudo chmod +x /etc/profile.d/custom-umask.sh

Common pitfall: umask uses subtraction logic, not direct assignment. A umask of 077 does NOT mean files get 077 permissions — it means files get 600 (666 minus 077) and directories get 700. Also, files never receive execute permission from umask math alone; Linux strips execute from the 666 base regardless.

Exam Tips for Red Hat Certified System Administrator (RHCSA)

The RHCSA EX200 exam is performance-based. You will be given a live system and specific tasks. Here are the high-value areas for this topic:

Key concepts that appear on the exam:

• Setting specific numeric permissions on files and directories using chmod
• Changing file and directory ownership with chown for users and service accounts
• Configuring umask persistently for users via profile files
• Understanding and applying SGID on shared group directories
• Using the sticky bit on shared writable directories
• Finding files by permission using find -perm

Common exam scenarios:

1. Create a shared directory where all files created inside inherit the group ownership (SGID)
2. Ensure a user's home directory is not readable by others (chmod 700)
3. Set umask to 027 persistently for a named user
4. Change ownership of a web document root to the apache service account

Quick reference commands:

# Most common permission patterns
chmod 755 /path/to/directory    # rwxr-xr-x
chmod 644 /path/to/file         # rw-r--r--
chmod 600 /path/to/privatefile  # rw-------
chmod 700 /path/to/privatedir   # rwx------

# SGID on shared directory
chmod g+s /shared/groupdir

# Sticky bit on writable shared directory
chmod +t /shared/public

# Find files with specific permissions
find /home -perm 777 -type f
find / -perm -4000 -type f 2>/dev/null

# Check and set umask
umask          # view current
umask 027      # set for session
echo 'umask 027' >> /home/username/.bashrc  # persist

Summary

Linux file permissions are non-negotiable knowledge for any system administrator. In this tutorial you covered:

• Reading the ls -la permission string and understanding its structure
• Using chmod with both symbolic (u+x) and octal (755) notation
• Applying chown and chgrp to manage user and group ownership
• Using find for bulk permission changes safely
• Configuring umask per-session and persistently via profile scripts
• Understanding special bits: SUID, SGID, and the sticky bit

Next steps: Practice these commands in a dedicated RHEL 9 lab VM. Build muscle memory for octal values — on exam day you will not have time to calculate. Set up shared group directories with SGID and test umask inheritance to solidify the concepts. For deeper RHCSA preparation including SELinux, storage management, and user administration, visit the CloudNinjas RHCSA Certification Guide.