Cybersecurity Foundations (Grades 6–8) · lesson 19 of 48 · 15 min

Linux File Permissions — The Security Foundation

One of Linux’s most powerful security features is its permission system. Every file and directory on a Linux system has a set of permissions that controls exactly who can read it, modify it, or execute it. This is not just a convenience feature — it is a core security mechanism.

The principle of least privilege — giving users and processes only the minimum access they need — is enforced through Linux permissions. A web server process should not be able to read your personal files. A student account should not be able to modify system files. Linux permissions make these restrictions enforceable.

By the end of this lesson you will be able to read and interpret Linux permission strings, calculate numeric (octal) permission values, explain the three permission categories (owner, group, others), use chmod to change permissions, and explain why permissions matter for security.

Why permissions matter for security

Many real-world security incidents have been caused by misconfigured permissions. A world-writable configuration file lets any user modify server settings. A world-readable password file exposes credentials to every user on the system. A world-executable script in a web directory lets attackers run code on your server. Understanding and correctly setting permissions is a fundamental security skill.

The Permission String — Reading ls -la Output

When you run ls -la, each file shows a 10-character permission string. Here is how to read it:

bash — reading permissions

$ ls -la

-rw-r–r– 1 alice staff 1024 Sep 27 report.txt

drwxr-xr-x 2 alice staff 4096 Sep 27 Documents/

-rwxr-x— 1 alice staff 512 Sep 27 script.sh

-rw-r–r–

Type

= filed = directoryl = symlink

Owner

Permissions for the file’s owner

Group

Permissions for the owner’s group

Others

Permissions for everyone else

r
Read
View file contents / list directory
4
w
Write
Modify file / create files in directory
2
x
Execute
Run as program / enter directory
1

Numeric (Octal) Permissions

Each permission set (owner, group, others) can be represented as a number from 0 to 7 by adding the values: r=4, w=2, x=1. This is called octal notation and is used with the chmod command.

0
No permissions

–x

1
Execute only

-w-

2
Write only

-wx

3
Write + execute
r–
4
Read only
r-x
5
Read + execute
rw-
6
Read + write
rwx
7
Full permissions

Reading chmod 755

Break into three digits
755 = 7 (owner) | 5 (group) | 5 (others)
Decode owner: 7
7 = 4+2+1 = rwx — owner can read, write, and execute
Decode group: 5
5 = 4+1 = r-x — group members can read and execute, but not write
Decode others: 5
5 = 4+1 = r-x — everyone else can read and execute, but not write
Full permission string

-rwxr-xr-x — typical for a program that everyone can run but only the owner can modify

Changing Permissions with chmod

bash — chmod examples

Make a script executable by the owner only

$ chmod 700 script.sh

Result: -rwx——

Make a file readable by everyone but only writable by owner

$ chmod 644 report.txt

Result: -rw-r–r–

Make a web directory accessible to the web server

$ chmod 755 /var/www/html

Result: drwxr-xr-x

DANGEROUS — never do this on sensitive files

$ chmod 777 passwords.txt

Result: -rwxrwxrwx ← anyone can read, write, execute!

chmod 777 — a security disaster

chmod 777 gives everyone full read, write, and execute permissions. This is almost never the right choice. On a web server, a world-writable file means any web visitor could potentially modify it. On a shared system, it means any user can read, modify, or delete the file. If you find yourself wanting to use 777, stop and think about what minimum permissions are actually needed.

Activity — Decode the Permissions

Permission String Decoder

Knowledge Check — Files, Users, and Permissions

In the permission string “-rw-r–r–“, what can the GROUP do?

Read, write, and execute
Read and write only
Read only
Nothing

Answer: Read only
The middle three characters “r–” represent group permissions. r=read, -=no write, -=no execute. The group can only read the file.

What numeric permission value represents “read + write” (rw-)?

Answer: 6
Read (4) + Write (2) = 6. Execute would add 1 more for a total of 7 (rwx).

You run “chmod 755 script.sh”. What can OTHER users (not the owner) do?

Nothing
Read and execute, but not write
Read, write, and execute
Write only

Answer: Read and execute, but not write
755 = owner:7(rwx), group:5(r-x), others:5(r-x). Others can read and execute but not write.

Why is “chmod 777” on a web server file considered a security risk?

It makes the file invisible
It gives everyone — including potential attackers — full read, write, and execute access
It deletes the file
It is too slow for web servers

Answer: It gives everyone — including potential attackers — full read, write, and execute access
chmod 777 gives all users full permissions. On a web server, this means any visitor could potentially modify or execute the file — a serious security vulnerability.

What security principle does the Linux permission system help enforce?

Security through obscurity
Least privilege — users get only the minimum access they need
Defence in depth
Zero trust

Answer: Least privilege — users get only the minimum access they need
The principle of least privilege means giving users and processes only the minimum access required for their function. Linux permissions make this enforceable at the file system level.

Previous lesson: The Linux terminal
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Types of malware

Files, users, and permissions