Users, Groups and Ownership

Introduction

Linux is a multi-user system. Every file and process belongs to a user and a group, and that decides who can do what. Understanding this explains most "permission denied" errors.

Who am I?

whoami             # your username
id                 # your user ID and groups
groups             # the groups you belong to

• A user is an account. Each has a numeric user ID.
• A group is a collection of users that share access, such as developers.
• root is the all-powerful administrator account (user ID 0). It can read, change or delete almost anything, which is why you avoid using it directly.

Ownership

Every file has an owner and a group. ls -l shows them:

-rw-r--r-- 1 sam developers 1200 Nov 6 10:00 report.txt

Here sam is the owner and developers is the group. Change them with chown:

sudo chown sam report.txt              # change owner
sudo chown sam:developers report.txt   # change owner and group
sudo chown -R sam project/             # change a whole folder, recursively

Changing ownership usually needs administrator rights.

Numeric permissions

You met r, w, x. Each has a number: r = 4, w = 2, x = 1. Add them for each of the three groups (owner, group, others).

So chmod 644 report.txt gives rw-r--r--: the owner can edit, everyone else can read. And chmod 755 script.sh gives rwxr-xr-x, a common choice for programs. chmod 600 makes a file private to its owner, which is right for secrets such as SSH keys.

For directories, x means you can enter the folder, and r means you can list its contents.

sudo

sudo runs a single command with administrator rights, after asking for your password. It is safer than staying logged in as root, and it records what was run.

sudo apt update
sudo less /var/log/auth.log

Habits for using sudo well:

• Think before you press Enter. Understand exactly what the command does.
• Never paste unknown sudo commands from the internet.
• Use the least privilege you need. Often the fix for permission denied is correct ownership, not sudo or chmod 777.
• Be extra careful with rm -rf under sudo.

Managing users (administrators)

sudo adduser alice               # create a user (on Debian and Ubuntu)
sudo usermod -aG developers alice   # add alice to a group

The -a is important. Without it, -G replaces all of the user's other groups.

Try it yourself

Create a file, check its owner with ls -l, change its permissions to 640, and explain in words what each of the three digits means.

Summary

• Files and processes belong to a user and a group, and root can do anything.
• chown changes ownership, and chmod with numbers sets permissions (r=4, w=2, x=1).
• Use sudo only for single commands you understand, and avoid chmod 777.