File Permissions & Ownership

ls -la /etc/nginx/nginx.conf
# -rw-r--r-- 1 root root 2691 Jan 15 10:23 nginx.conf
# │└─┬──┘└─┬──┘└─┬──┘
# │  owner  group  others
# │
# â””── file type:
#     - = regular file
#     d = directory
#     l = symbolic link
#     b = block device
#     c = character device

# Permission bits: r=read w=write x=execute
# rw-  r--  r--
# 110  100  100   ← binary
#  6    4    4    ← octal = 644

# Common permission patterns:
# 755  rwxr-xr-x  binaries, directories (owner full, others read+execute)
# 644  rw-r--r--  config files (owner read-write, others read-only)
# 600  rw-------  private keys, secrets (owner only)
# 777  rwxrwxrwx  ⚠️ world-writable — security risk, avoid in production
# 400  r--------  read-only secrets (SSH private keys)

ls -la ~/.ssh/
# -rw------- 1 akshay akshay 1823 Jan 10 id_rsa       ← 600: good
# -rw-r--r-- 1 akshay akshay  399 Jan 10 id_rsa.pub   ← 644: good

# chmod — change permissions

# Numeric mode (easiest to remember)
chmod 755 script.sh        # rwxr-xr-x
chmod 644 config.conf      # rw-r--r--
chmod 600 ~/.ssh/id_rsa    # rw------- (SSH requires this)
chmod 700 ~/.ssh/          # rwx------

# Symbolic mode (more readable for small changes)
chmod +x script.sh         # add execute for all
chmod u+x,go-x script.sh   # add execute for owner, remove for group+others
chmod g+w app/             # add write for group
chmod o-rwx secrets/       # remove all permissions for others
chmod a-x file.sh          # remove execute for all (a = all)

# Recursive (dangerous — think before using on / )
chmod -R 755 /var/www/html/

# chown — change owner and group
chown akshay file.txt                 # change owner
chown akshay:developers file.txt      # change owner and group
chown -R www-data:www-data /var/www/  # recursive (for web server files)
chgrp developers project/             # change group only

# Check your own identity
id
# uid=1000(akshay) gid=1000(akshay) groups=1000(akshay),4(adm),27(sudo),1001(docker)

# setuid (s in owner execute position)
# Binary runs with file OWNER's privileges regardless of who runs it
ls -la /usr/bin/passwd
# -rwsr-xr-x 1 root root ... /usr/bin/passwd
#    ↑ setuid bit — anyone can run passwd, it runs as root to write /etc/shadow

chmod u+s /path/to/binary    # set setuid
chmod 4755 /path/to/binary   # numeric (4 = setuid, 755 = rwxr-xr-x)

# setgid on a DIRECTORY
# Files created inside inherit the DIRECTORY's group (not creator's group)
mkdir /shared
chgrp developers /shared
chmod g+s /shared            # set setgid on directory
# chmod 2775 /shared         # numeric: 2 = setgid
# Now all files created in /shared belong to 'developers' group

# Sticky bit on a directory
# Only the file OWNER can delete their own files (even if others have write)
ls -la /tmp
# drwxrwxrwt 18 root root ... /tmp
#         ↑ sticky bit — you can't delete other users' files in /tmp

chmod +t /shared             # set sticky bit
chmod 1777 /tmp              # numeric: 1 = sticky

# Find all setuid binaries (security audit)
find / -perm -4000 -type f 2>/dev/null