[Zero Two]

File permissions trip up everyone at some point. Here's a solid mental model.

The permission model
Every file has three permission sets: owner, group, others. Each set has three bits: read (4), write (2), execute (1).

-rwxr-xr-- 1 alice developers 4096 Jun 22 file.sh

• rwx = owner (alice) can read, write, execute
  
• r-x = group (developers) can read and execute, not write
  
• r-- = others can only read
  

chmod - changing permissions

Code:

chmod 755 file.sh     # rwxr-xr-x (owner all, group+others read+execute)
chmod 644 file.txt     # rw-r--r-- (owner read+write, others read only)
chmod 600 secret.key   # rw------- (owner only, common for SSH keys)
chmod +x script.sh     # add execute for everyone
chmod -w file.txt      # remove write for everyone
chmod -R 755 /var/www  # recursive

chown - changing ownership

Code:

chown alice file.txt           # change owner
chown alice:developers file.txt # change owner and group
chown -R www-data:www-data /var/www  # recursive (common for web servers)

The execute bit on directories
For directories, execute means "can enter" (traverse). A directory with r-- but no x lets you list contents but not access files inside. Usually you want r-x together on directories.

Common permission mistakes:

• chmod 777 on web-served files - never. World-writable is a security hole.
  
• Wrong owner on web root (nexusclade instead of www-data) - PHP-FPM can't write uploads
  
• SSH private key too permissive - SSH refuses keys that aren't 600
  
• Forgetting -R on a directory change and wondering why subdirectory access still fails