Whose File Is It, Anyway
Permissions grant powers to the owner, the group, and everyone else — but who are you, to a given file? Ownership is the answer, and it decides which of those three sets of powers apply to you.
Permissions give powers to the owner, the group, and everyone else. But how does a file know which of those I am?
By its ownership. Every file has one owner — a user — and one group. Which of the three sets of permissionsPermissionsThe rules on each file saying who may read it, change it, or run it — split between its owner, its group, and everyone else. you get depends entirely on which of those you are to that file.
Every file has an owner and a group
You are one user, and you belong to one or more groups. Every file records an owner and a group too. ls -l shows them; whoami tells you which user you are, and id lists the groups you are in. Those two facts — who you are, who owns the file — decide everything.
$ whoami
wren
$ id
uid=1000(wren) groups=1000(wren),27(sudo),1001(devs)
$ ls -l report.txt
-rw-r----- 1 rook devs 8931 Aug 24 report.txt
# owned by rook, group devs. you are wren, but you ARE in devs.
Which audience are you?
The rule is simple and absolute. If you own the file, you get the owner powers — and only those. If you do not own it but belong to its group, you get the group powers. If neither, you are other. You are always exactly one of the three for any given file, never a mixture.
report.txt above is -rw-r-----: read/write for owner rook, read for group devs, nothing for others. You are wren, in the devs group. What can you do with it?
rw- does not apply to you. You are in the group, so you get r--. Others get nothing — and if you were not in devs, neither would you. Ownership picked your row for you.Changing owner and group
chown changes a file's owner; chgrp changes its group. Both are powerful — handing a file to another user, or moving it into a group, changes who can reach it — so they usually require sudosudo"Do this one command as the superuser" — a controlled, logged way to borrow administrator power for a single action rather than living with it.. Groups are the point: put a team in a shared group, set the file's group powers, and they can collaborate without the file ever being readable by everyone.
sudo chown alice report.txt # give the file to alice
sudo chgrp devs report.txt # set its group to devs
chmod g+r,o-rwx report.txt # group may read; others get nothing
- Line 2Now every member of
devsreaches the file through the group row — add a teammate to the group and they are in, remove them and they are out. No per-file fiddling. - Line 3Group gets read, other gets nothing. This is how you share with a few people without sharing with the whole machine.
Three teammates need to read a file, and nobody else on a shared server should. What is the clean way?
chmod 777 gives everyone read and write — the opposite of what was asked.Ownership ignored
- `chmod 777` to make an error go away, opening a file to the whole machine
- Secrets left readable by group or other because nobody checked `ls -l`
- One shared login everyone uses, so ownership means nothingOwnership used
- Files owned by the person who should hold them, secrets owner-only
- A group for each team, and group powers instead of world powers
- Reading `ls -l` before trusting that a file is actually privatechmod 777 is the "I give up" setting — everyone may read and write. It is almost never the right answer, and on a shared system it is a quiet way to hand your files to strangers.
So the powers were only half the story. Ownership is the half that says which powers are mine.
Exactly. rwx is what may be done; owner and group are to whom. Together they are the whole access model — and groups are how real teams share without opening a file to the world.
And a single chmod 777, dropped in a hurry, undoes all of it. I look for exactly that: the file someone opened to everyone and forgot.
Legal
Set ownership and groups on systems you administer or are authorised to use. Using chown or sudo to seize files that are not yours on a system you do not control is unauthorised access, whatever the individual command looks like.
So ownership decides which row of powers is yours — owner, group, or other — and chown, chgrp and groups are how you arrange that deliberately. Next: the one account that ignores every row of this table — rootrootThe all-powerful administrator account on a Unix system, allowed to do absolutely anything — including irreversible damage. — and how to borrow its power through sudosudo"Do this one command as the superuser" — a controlled, logged way to borrow administrator power for a single action rather than living with it. without living in the danger it brings.