Permissions & Ownership

Fix permission denied on deploy user
Explain rwx bits and ownership
Set mode without chmod 777

Must-know cold

ls -l → mode, owner, group · ls -ld DIR
chmod 644 file · chmod 755 dir/script · chmod u+x file
chown user:group file · chown -R user:group dir
umask · id · never default to 777 / chmod -R 777

Mode quick map

Definition: Common octal modes and what rwx means for files vs directories.

Octal	rwx	Common use
`644`	`rw-r--r--`	Normal file
`600`	`rw-------`	Secrets / keys
`755`	`rwxr-xr-x`	Dirs / public scripts
`750`	`rwxr-x---`	Dir; group exec, others none
`700`	`rwx------`	Private dir (`~/.ssh`)
`400`	`r--------`	Read-only secret

Bits:

user group other
r=4 w=2 x=1
Dir x = enter/traverse

Commands

`chmod`

Definition: Change file mode bits (permissions) using octal or symbolic modes.

Option	Argument	Meaning	Example
(none)	`MODE FILE`	Set mode (octal or symbolic)	`chmod 644 f`
`-R`	`MODE PATH`	Recursive	`chmod -R u+rwX dir/`
`-v`	`MODE FILE`	Verbose	`chmod -v 755 x`
`-c`	`MODE FILE`	Report only when changed	`chmod -c 644 f`
`--reference`	`RFILE FILE`	Copy mode from RFILE	`chmod --reference=a b`

Symbolic MODE: [ugoa][+-=][rwx]
Examples: u+x · go-w · a+r · u=rwx,g=rx,o=

Flag combos

Combo	Meaning	Example
`chmod 600 ~/.ssh/id_rsa`	Private key	Required for SSH
`chmod 700 ~/.ssh`	SSH dir
`chmod -R u+rwX,go-w dir`	Safer recursive than 777	Deploy trees

`chown`

Definition: Change file owner and/or group.

Option	Argument	Meaning	Example
(none)	`USER FILE`	Set owner	`chown jenkins f`
(none)	`USER:GROUP FILE`	Set owner and group	`chown app:app f`
(none)	`:GROUP FILE`	Set group only (same as chgrp)	`chown :deploy f`
`-R`	`OWNER PATH`	Recursive	`chown -R app:app /opt/app`
`-h`	`OWNER LINK`	Affect symlink itself not target	`chown -h u:g link`
`-v`	`OWNER FILE`	Verbose	`chown -v u f`
`--reference`	`RFILE FILE`	Copy ownership from RFILE	`chown --reference=a b`

Flag combos

Combo	Meaning	Example
`chown -R app:app /var/app`	Service tree ownership	After extract
`sudo chown root:root f`	Return to root

`chgrp`

Definition: Change the group ownership of a file.

Option	Argument	Meaning	Example
(none)	`GROUP FILE`	Change group only	`chgrp deploy f`
`-R`	`GROUP PATH`	Recursive	`chgrp -R deploy dir`
`-h`	`GROUP LINK`	Symlink itself	`chgrp -h g link`
`-v`	`GROUP FILE`	Verbose	`chgrp -v g f`

Flag combos

Combo	Meaning	Example
`chgrp -R staff /shared`	Shared project group	With setgid dir

`umask`

Definition: Set or display the mask that subtracts permissions from newly created files/dirs.

Option	Argument	Meaning	Example
(none)	—	Print current umask	`umask`
(none)	`MODE`	Set umask (subtract from defaults)	`umask 022`
`-S`	—	Symbolic display	`umask -S`
`-p`	—	Output reusable as input	`umask -p`

How to read: umask subtracts from 666 (files) / 777 (dirs).

022 → files 644, dirs 755.
077 → files 600, dirs 700.

Flag combos

Combo	Meaning	Example
`umask 027`	Group-readable; others none	Shared team hosts

`id`

Definition: Print real/effective UID, GID, and group memberships.

Option	Argument	Meaning	Example
(none)	—	Current UID/GID/groups	`id`
(none)	`USER`	Identity of USER	`id jenkins`
`-u`	—	Effective UID only	`id -u`
`-g`	—	Effective GID only	`id -g`
`-gn`	—	Group name	`id -gn`
`-un`	—	User name	`id -un`
`-G`	—	All group IDs	`id -G`
`-Gn`	—	All group names	`id -Gn`
`-n`	—	Names instead of numbers (with `-ugG`)	`id -un`

Flag combos

Combo	Meaning	Example
`id -Gn user`	Groups for membership debug	After `usermod -aG`

`namei`

Definition: Walk each path component and show permissions (finds where access fails). Optional package — install if missing.

Option	Argument	Meaning	Example
(none)	`PATH`	Resolve each path component	`namei /var/app/conf`
`-l`	`PATH`	Long; show owner/mode each step	`namei -l /path`
`-m`	`PATH`	Mode of each component	`namei -m /path`

Flag combos

Combo	Meaning	Example
`namei -l /a/b/c`	Find which component blocks traverse	Permission denied RCA

Common recipes

Goal	Command
See mode/owner	`ls -l file` · `ls -ld dir`
Normal file	`chmod 644 file`
Executable script	`chmod 755 script.sh`
Private key	`chmod 600 key` · `chmod 700 ~/.ssh`
App owns tree	`sudo chown -R app:app /opt/app`
Who am I / groups	`id` · `id deploy`
Path walk	`namei -l /var/app/data/file`
Current umask	`umask`

Pitfalls

Dir without x for a user → cannot cd or access children even if the file is 777.
chmod -R 777 breaks security and often masks the root cause — don’t.
Recursive chown on / or the wrong path is catastrophic — verify the path.
Group membership changes need a new login (or new session) to apply fully.
Symlinks: permissions on the target matter for access; the link mode is often ignored for access checks.

For more details, try man <command> in your terminal.

Permissions & Ownership

Fix permission denied on deploy user
Explain rwx bits and ownership
Set mode without chmod 777

Must-know cold

ls -l → mode, owner, group · ls -ld DIR
chmod 644 file · chmod 755 dir/script · chmod u+x file
chown user:group file · chown -R user:group dir
umask · id · never default to 777 / chmod -R 777

Mode quick map

Definition: Common octal modes and what rwx means for files vs directories.

Octal	rwx	Common use
`644`	`rw-r--r--`	Normal file
`600`	`rw-------`	Secrets / keys
`755`	`rwxr-xr-x`	Dirs / public scripts
`750`	`rwxr-x---`	Dir; group exec, others none
`700`	`rwx------`	Private dir (`~/.ssh`)
`400`	`r--------`	Read-only secret

Bits:

user group other
r=4 w=2 x=1
Dir x = enter/traverse

Commands

`chmod`

Definition: Change file mode bits (permissions) using octal or symbolic modes.

Option	Argument	Meaning	Example
(none)	`MODE FILE`	Set mode (octal or symbolic)	`chmod 644 f`
`-R`	`MODE PATH`	Recursive	`chmod -R u+rwX dir/`
`-v`	`MODE FILE`	Verbose	`chmod -v 755 x`
`-c`	`MODE FILE`	Report only when changed	`chmod -c 644 f`
`--reference`	`RFILE FILE`	Copy mode from RFILE	`chmod --reference=a b`

Symbolic MODE: [ugoa][+-=][rwx]
Examples: u+x · go-w · a+r · u=rwx,g=rx,o=

Flag combos

Combo	Meaning	Example
`chmod 600 ~/.ssh/id_rsa`	Private key	Required for SSH
`chmod 700 ~/.ssh`	SSH dir
`chmod -R u+rwX,go-w dir`	Safer recursive than 777	Deploy trees

`chown`

Definition: Change file owner and/or group.

Option	Argument	Meaning	Example
(none)	`USER FILE`	Set owner	`chown jenkins f`
(none)	`USER:GROUP FILE`	Set owner and group	`chown app:app f`
(none)	`:GROUP FILE`	Set group only (same as chgrp)	`chown :deploy f`
`-R`	`OWNER PATH`	Recursive	`chown -R app:app /opt/app`
`-h`	`OWNER LINK`	Affect symlink itself not target	`chown -h u:g link`
`-v`	`OWNER FILE`	Verbose	`chown -v u f`
`--reference`	`RFILE FILE`	Copy ownership from RFILE	`chown --reference=a b`

Flag combos

Combo	Meaning	Example
`chown -R app:app /var/app`	Service tree ownership	After extract
`sudo chown root:root f`	Return to root

`chgrp`

Definition: Change the group ownership of a file.

Option	Argument	Meaning	Example
(none)	`GROUP FILE`	Change group only	`chgrp deploy f`
`-R`	`GROUP PATH`	Recursive	`chgrp -R deploy dir`
`-h`	`GROUP LINK`	Symlink itself	`chgrp -h g link`
`-v`	`GROUP FILE`	Verbose	`chgrp -v g f`

Flag combos

Combo	Meaning	Example
`chgrp -R staff /shared`	Shared project group	With setgid dir

`umask`

Definition: Set or display the mask that subtracts permissions from newly created files/dirs.

Option	Argument	Meaning	Example
(none)	—	Print current umask	`umask`
(none)	`MODE`	Set umask (subtract from defaults)	`umask 022`
`-S`	—	Symbolic display	`umask -S`
`-p`	—	Output reusable as input	`umask -p`

How to read: umask subtracts from 666 (files) / 777 (dirs).

022 → files 644, dirs 755.
077 → files 600, dirs 700.

Flag combos

Combo	Meaning	Example
`umask 027`	Group-readable; others none	Shared team hosts

`id`

Definition: Print real/effective UID, GID, and group memberships.

Option	Argument	Meaning	Example
(none)	—	Current UID/GID/groups	`id`
(none)	`USER`	Identity of USER	`id jenkins`
`-u`	—	Effective UID only	`id -u`
`-g`	—	Effective GID only	`id -g`
`-gn`	—	Group name	`id -gn`
`-un`	—	User name	`id -un`
`-G`	—	All group IDs	`id -G`
`-Gn`	—	All group names	`id -Gn`
`-n`	—	Names instead of numbers (with `-ugG`)	`id -un`

Flag combos

Combo	Meaning	Example
`id -Gn user`	Groups for membership debug	After `usermod -aG`

`namei`

Definition: Walk each path component and show permissions (finds where access fails). Optional package — install if missing.

Option	Argument	Meaning	Example
(none)	`PATH`	Resolve each path component	`namei /var/app/conf`
`-l`	`PATH`	Long; show owner/mode each step	`namei -l /path`
`-m`	`PATH`	Mode of each component	`namei -m /path`

Flag combos

Combo	Meaning	Example
`namei -l /a/b/c`	Find which component blocks traverse	Permission denied RCA

Common recipes

Goal	Command
See mode/owner	`ls -l file` · `ls -ld dir`
Normal file	`chmod 644 file`
Executable script	`chmod 755 script.sh`
Private key	`chmod 600 key` · `chmod 700 ~/.ssh`
App owns tree	`sudo chown -R app:app /opt/app`
Who am I / groups	`id` · `id deploy`
Path walk	`namei -l /var/app/data/file`
Current umask	`umask`

Pitfalls

Dir without x for a user → cannot cd or access children even if the file is 777.
chmod -R 777 breaks security and often masks the root cause — don’t.
Recursive chown on / or the wrong path is catastrophic — verify the path.
Group membership changes need a new login (or new session) to apply fully.
Symlinks: permissions on the target matter for access; the link mode is often ignored for access checks.

For more details, try man <command> in your terminal.