Permissions and Links

Objectives

By the end of this chapter, you should be able to:

• Read a file or folder’s permissions from ls -l output
• Change permissions with chmod, using both octal and symbolic notation
• Change ownership with chown and chgrp
• Explain what root and sudo are, and when you need them
• Create links with ln, and explain the difference between a hard and a symbolic link

💡 Why this matters: “Permission denied” is one of the most common errors you’ll hit in Terminal. This lesson is what lets you actually understand and fix that error, instead of just reaching for sudo and hoping it works.

Users and Groups

Every file on your system belongs to a user and a group, and permissions are set separately for three categories: the owner, other members of the file’s group, and everyone else. Head to your home directory and run ls -lah (the -h flag makes file sizes human-readable — check man ls if you want the details). One line might look like this:

-rwxr-xr-x  1 sam  staff  67B  Aug 29 2014  .bashrc

The third column is the file’s owner — here, sam. The fourth is the group associated with the file — here, staff. Run groups in your terminal to see every group you personally belong to; on most Mac setups, staff will be one of them.

Reading a Permissions String

Look at the first column from that same line: -rwxr-xr-x. This is the file’s permissions string, and every character in it means something. There are three possible operations:

• r — read the file
• w — write to the file
• x — execute the file

And three categories of user the string covers, in order: the owner, the group, and everyone else (“other”). So -rwxr-xr-x breaks down as: a regular file (the leading -), owner can read/write/execute, group can read/execute, everyone else can read/execute.

Changing Permissions with chmod

chmod changes a file’s permissions. The fastest way is octal notation — one digit, 0 through 7, per category (owner, group, other):

chmod 770 somefile.txt gives the owner and group full access and leaves everyone else with nothing.

If you want to change specific bits without rewriting all three digits, use symbolic notation instead:

chmod ug+rwx,o-rwx hi.txt

That reads as “add read, write, and execute for the user and the group; remove read, write, and execute for everyone else.” More to type, but easier to reason about when you’re only changing one thing.

To apply a permission change to a folder and everything inside it, add -R: chmod -R 755 some_folder.

Why Folders Need the Execute Bit

The execute bit means something different for a folder than for a file. On a folder, it’s what lets you cd into it at all. Try this:

mkdir test_folder
cd test_folder
cd ..
chmod 666 test_folder
cd test_folder

That last command fails with “permission denied” — removing execute access blocked you from entering, even though you can still read and write. Restore it (chmod 755 test_folder) and delete the folder when you’re done.

On a file, the execute bit is what lets you run it as a program. Build a tiny one:

echo ls > test.sh
echo pwd >> test.sh
cat test.sh

(Notice > on the first line and >> on the second — the next lesson covers exactly why.) test.sh now contains two commands, one per line. Make it executable and run it:

chmod 755 test.sh
./test.sh

That’s your first working shell script.

Ownership: chown and chgrp

Back to that ls -lah line:

-rwxr-xr-x  1 sam  staff  67B  Aug 29 2014  .bashrc

1 is the link count (always 1 for a plain file), sam is the owner, staff is the group, then the size, modified date, and name. To hand ownership to someone else, or move the file into a different group:

chown newuser:newgroup .bashrc
chgrp newgroup .bashrc

The root User and sudo

Now compare that line to this one, also from ls -lah:

drwxr-xr-x  6 root  admin  204B  Oct 20 2015  ..

Owner root, group admin — and the leading d means this is a directory, not a file. root is a special account with unrestricted power: it can change permissions or delete anything on the system. When root owns a file, changing it yourself requires sudo, which temporarily borrows root’s permissions for a single command (and asks for your password first). Try it:

sudo chown root somefile.txt

Now try deleting somefile.txt without sudo — you’ll be refused. Look at the ownership and permissions to see exactly why.

Links

Files can only live in one place, which makes them awkward to reference from elsewhere — that’s what ln solves. Its basic shape:

ln path_to_original name_of_link

There are two kinds, and they behave very differently.

Hard Links

Create a file on your Desktop and write something into it:

cd ~/Desktop
echo "Learning about links!" > learn.txt
ln learn.txt first_link

cat first_link prints the same text as learn.txt — so far, unsurprising. Now delete the original: rm learn.txt, then cat first_link again. The text is still there. A hard link is effectively a second name pointing at the same underlying data, not a pointer to the filename — removing one name doesn’t touch the data.

Symbolic Links

Most of the time you actually want a reference, not a hidden full copy. That’s a symbolic link, made with the -s flag:

echo "Another file" > learn_again.txt
ln -s learn_again.txt first_sym_link

cat first_sym_link works fine right now — but delete or move learn_again.txt and first_sym_link breaks immediately. Symbolic links can also point at folders, which is handy for shortcuts to paths you don’t want to type out, but the same fragility applies: move the target, and the link stops working.

Try It

None of this can run in a sandbox — permissions, ownership, and links all change your real filesystem — so work through these in your own terminal:

1. Create secret.txt and set its permissions to owner-read-and-write-only, using octal notation.
2. Create a folder, remove its execute permission, try to cd into it and read the error, then restore execute access.
3. Create original.txt with some text inside. Make a hard link and a symbolic link to it, delete original.txt, then cat both links. Explain the difference in what you see.

Recap

• A permissions string like -rwxr-xr-x covers three categories — owner, group, other — each with read, write, and execute bits.
• chmod changes permissions (octal for a full reset, symbolic for targeted changes); chown/chgrp change ownership.
• root can do anything; sudo borrows that power for one command.
• A hard link survives deletion of the original; a symbolic link breaks.

Next lesson: sending command output exactly where you want it, with redirection.