Quick answer
Linux file permissions control who can read, write, or execute files. The `chmod` and `chown` commands change permissions and ownership, but improper use can cause errors like 403 Forbidden or access problems. Learn the correct syntax and most common scenarios to avoid mistakes.
How to recognize the problem
- Web server reports 403 Forbidden for files that should be accessible
- You cannot save changes to a file even though you are logged in as the user
- A script or program cannot execute even though it has the appropriate permissions
- After moving files, ownership and permissions are incorrect
- Attempting to access a file via FTP/SFTP client returns Permission denied error
Most common causes
Incorrectly set permissions
Permissions like 777 or 666 are too permissive and can cause security issues or conflicts with the web server.
Wrong file owner
The file is owned by root or the wrong user, so the web server or application cannot access it.
Inappropriate group
The file belongs to a group that lacks the necessary permissions, or the user is not in the appropriate group.
Inherited permissions when copying
Copying files without preserving permissions (e.g., `cp` without `-p`) assigns the copy a new owner and permissions according to the umask value.
Wrong umask value
The system umask value can affect the default permissions of new files and folders.
Step-by-step fix
- 1
Check current permissions and ownership
Run
ls -lin the directory containing the file. The output shows permissions, number of links, owner, group, size, and date. For example,-rw-r--r-- 1 user group 1234 Jan 1 12:00 file.txtmeans the owner has read/write, the group read, and others read. - 2
Understand permission notation
Standard permissions consist of three digits (owner, group, others). Each digit is a sum: 4=read, 2=write, 1=execute. For example, 644 means rw- for owner, r-- for group and others. 755 means rwx for owner, r-x for group and others.
- 3
Change permissions using chmod
Use
chmodwith octal or symbolic notation. Only the file owner or root can change permissions. For example,chmod 644 file.txtsets permissions to rw-r--r--. For a folder that should be accessible to everyone but only writable by the owner, usechmod 755 folder. Symbolically:chmod u+x script.shadds execute for the owner. - 4
Change ownership using chown
The
chowncommand usually requires root orsudo.chown user:group filechanges the owner and group. For example,sudo chown www-data:www-data index.phpsets the owner and group to www-data. For recursive changes use-R(e.g.,sudo chown -R www-data:www-data /var/www/html). Before that, record the current state (ls -lR) or make a backup, because recursive changes affect all files and folders. - 5
Use groups for shared access
If multiple users need to access a file, add them to a common group and set group permissions. For example,
chmod 664 fileandchgrp shared_group file. Users in that group will have read/write access. - 6
Set special permissions (setuid, setgid, sticky)
Setuid (
chmod u+s) allows a program to execute with the owner's privileges. Setgid (chmod g+s) on a folder makes new files and subfolders inherit the folder's group. Sticky bit (chmod +t) on a folder allows deletion mainly by the file owner, folder owner, and root. Use them with caution. - 7
Change default permissions using umask
The
umaskcommand shows the current mask. A new value is set withumask 022, meaning new files get 644 and folders 755. This affects only the current session; for permanent change, edit~/.bashrcor/etc/profile. - 8
Verify and test changes
After changes, run
ls -lagain to verify permissions. Test access as the appropriate user (e.g.,sudo -u www-data ls /var/www/html). Make sure the application works without errors.
If nothing helps
If you still have permission problems, check if SELinux or AppArmor is enabled and blocking access. The command getenforce (SELinux) or aa-status (AppArmor) can show the status. Also, check web server logs (/var/log/nginx/error.log or /var/log/apache2/error.log) for error details. Avoid permissions 777. If you must check whether the problem is permissions, do it on a site copy or test environment and immediately restore previous permissions. For advanced cases, consult the documentation for ACL (Access Control Lists) using setfacl and getfacl.
How to prevent it
- Avoid permissions 777 and 666; use the least necessary permissions.
- Regularly check ownership and permissions on web application files.
- Use groups for shared access instead of granting permissions to everyone.
- When copying, use `cp -p` to preserve permissions and timestamps, and ownership when you have appropriate privileges.
When to call a professional
If you are unsure which permissions your application requires or if permission changes cause site downtime, consult an IT expert. Also, if you suspect a security incident related to permissions, it is better to have a professional review it.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
What is the difference between chmod and chown?
`chmod` changes access permissions (read, write, execute) for owner, group, and others. `chown` changes the owner and group of a file. Both commands are necessary for proper access management.
Why shouldn't I use chmod 777?
Permissions 777 allow everyone to read, write, and execute the file, which is a major security risk. Attackers can modify the file or exploit it. Always use the least permissions needed for operation.
How can I change permissions only for folders, not files?
Use `find` with `-type d` for folders: `find /path -type d -exec chmod 755 {} \;`. For files use `-type f` and `chmod 644`.