Linux Permissions Cheat Sheet

Read, write, execute, special bits, umask, ACLs, and sudo — the permission model that protects every Linux file and process.

Security8 sections · 53 commands

⌘K

Reading Modes

ls -l FILE

rwx bits, owner, group, size

stat FILE

Modes in octal and human form

ls -l --time-style=long-iso DIR /

Readable time columns

stat -c '%a %U:%G' FILE

Octal mode and owner:group

drwxr-xr-x

Owner rwx, group r-x, others r-x

chmod — Change Modes

chmod 754 FILE

rwxr-xr-- (7 owner, 5 group, 4 other)

chmod 755 DIR

rwxr-xr-x, typical for dirs

chmod 644 FILE

rw-r--r--, typical for files

chmod +x FILE

Add execute to all

chmod u=rw,g=r,o= FILE

Symbolic assignment

chmod a+r FILE

Make world-readable

chmod g+w DIR

Add group write

chmod -R g+w DIR

Apply recursively

chmod -x FILE /

Remove execute everywhere

Ownership

chown USER FILE

Change the owner

chown USER:GROUP FILE

Owner and group together

chgrp GROUP FILE

Change only the group

chown -R USER:GROUP DIR

Recursive ownership change

chown --reference=TEMPLATE FILE

Copy ownership from another file

Special Bits

chmod u+s FILE

Setuid — run with the owner's identity

chmod 4755 FILE

Setuid in octal (4 prefix)

chmod g+s DIR

Setgid — inherit group for new files

chmod 2755 DIR

Setgid in octal (2 prefix)

chmod +t DIR

Sticky bit — only owner can delete

chmod 1777 /tmp

Sticky in octal (1 prefix)

find / -type f -perm -4000 2>/dev/null

Spot SUID binaries

umask & Defaults

umask

Current default mode mask

umask 022

New files 644, new dirs 755

umask 027

Tighten: 640 files / 750 dirs

umask 077

Private: owner only

echo 'umask 027' >> ~/.bashrc

Persist a mask for a user

ACLs

getfacl FILE

Full ACL listing

setfacl -m u:USER:rw FILE

Grant a user rw

setfacl -m g:DEV:rwx DIR

Grant a group rwx

setfacl -x u:USER FILE

Remove a user entry

setfacl -b FILE

Strip all ACLs

setfacl -m u::rwx,g::r-x,o::--- FILE

Revise the base trio via ACL

sudo & Privilege

sudo -l

What a user may run

sudo -u USER CMD

Run as another user

sudo -i

Root login shell

sudo -s

Root shell keeping env

visudo

Edit /etc/sudoers safely

%wheel ALL=(ALL) NOPASSWD: ALL

Group sudo without a password

USER ALL=(ALL:ALL) ALL

A user may run anything

sudo -v

Refresh the cached timestamp

Auditing & SELinux

find / -type f -perm -4000

Locate SUID files

find / -type f -perm -2000

Locate SGID files

ls -la /tmp

See the sticky-bit ownership rule

getenforce

SELinux: Enforcing / Permissive / Disabled

setenforce 0

Temporarily permissive

restorecon -Rv DIR

Restore SELinux labels

semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"

Add a file-context rule

auditctl -w /etc/passwd -p wa -k passwd_changes

Watch a file with auditd