Module 5: Linux Permissions — Interactive Animated Beginner Reference

🕵️ Permission Detective Mission

Your job: investigate why files can be opened, edited, executed, or blocked.

Linux permissions are like a security desk for every file and directory. The desk checks three things:

👤 Who owns it? 👥 Which group can use it? 🌍 What can everyone else do? 🔑 Is read/write/execute allowed?

Main conclusion: permissions decide who can perform read, write, and execute actions on files and directories.

Case #005
File: demo.sh
Problem: Script exists, but learner says: “Permission denied!”

👤

👥

🌍

Clue: Look at ls -l demo.sh

1) Read, Write, Execute

The three permission powers. Same letters, slightly different meaning for files and directories.

📖 Read r

File: view file contents. Example: cat notes.txt

Directory: list names inside it. Example: ls folder

✍️ Write w

File: modify file contents. Example: edit with vim.

Directory: create, delete, or rename entries inside it.

🏃 Execute x

File: run it as a program/script. Example: ./demo.sh

Directory: enter/traverse it. Example: cd folder

Beginner trap: execute on a directory does not mean “run the directory.” It means you can enter or access items inside that directory.

2) Decode ls -l Like a Pro

Click the command, then read the output as four blocks: file type, owner, group, others.

Terminal view

permission-lab

$ ls -l demo.sh
-rwxr-xr-x 1 jp jp 42 Aug 03 10:10 demo.sh

The date, time, size, owner, and group can differ on your VM. Focus on the left side: -rwxr-xr-x.

Animated permission strip

- rwx r-x r-x

file type owner group others

Type-

regular file

Ownerrwx

read, write, execute

Groupr-x

read and execute

Othersr-x

read and execute

3) Owner, Group, Others

Linux asks: “Which identity bucket does this user fall into?” Then it applies that permission set.

👤 Owner

The user who owns the file. In ls -l, this is usually the first name after the link count.

-rwxr-xr-x 1 jp jp ... demo.sh

👥 Group

A team of users. Group permissions apply when the user is a member of that file's group.

-rwxr-xr-x 1 jp devops ... demo.sh

🌍 Others

Everyone else who is not the owner and not covered by the file's group.

-rwxr-xr-x 1 jp devops ... demo.sh

Decision order: Linux checks owner first. If not owner, it checks group membership. If not matched there, it applies others permissions.

4) chmod Numeric Mode Calculator

Tick permissions below and watch the numeric mode and symbolic string update instantly.

Permission switches

Owner r=4 w=2 x=1

Group r=4 w=2 x=1

Others r=4 w=2 x=1

Numeric permission

755

Symbolic permission

-rwxr-xr-x

owner: 4+2+1=7 · group: 4+1=5 · others: 4+1=5

chmod 755 demo.sh

Numeric memory trick

Permission	Value	Meaning	Example digit
r	4	Read	4 = r--
w	2	Write	6 = rw-
x	1	Execute	5 = r-x
rwx	7	Full permission for that class	7 = rwx

5) chmod Symbolic Mode Playground

Symbolic mode is excellent when you want to add or remove a permission without calculating numbers.

Try common symbolic commands

Symbols: u=user/owner, g=group, o=others, a=all. Operators: + add, - remove, = set exactly.

Result

Starting mode: -rw-r--r-- demo.sh

chmod +x demo.sh

Adds execute to owner, group, and others based on current umask rules. Common quick fix for scripts.

Symbolic vs Numeric

Task	Symbolic mode	Numeric mode	When to prefer
Add execute bit	chmod +x demo.sh	Depends on current mode	Symbolic is easier
Set standard script permission	chmod u=rwx,g=rx,o=rx demo.sh	chmod 755 demo.sh	Numeric is shorter
Private file	chmod u=rw,go= secret.txt	chmod 600 secret.txt	Numeric is common
Remove access from others	chmod o-rwx file	Depends on current mode	Symbolic is safer

6) chown and chgrp

Permissions decide allowed actions. Ownership decides which permission bucket applies.

Change owner/group with chown

chown changes file ownership. It usually needs sudo because ownership is security-sensitive.

sudo chown root:root demo.sh
ls -l demo.sh
-rwxr-xr-x 1 root root 42 Aug 03 10:10 demo.sh

After this: root owns the file. A normal user may still execute it if others have x, but cannot edit it unless write permission applies or they use sudo.

Change only group with chgrp

chgrp changes the group owner. Useful when a team should share access.

sudo groupadd devops
sudo chgrp devops demo.sh
ls -l demo.sh
-rwxr-xr-x 1 root devops 42 Aug 03 10:10 demo.sh

Team idea: use groups when many users need the same access. Avoid giving “others” too much permission.

7) Default Permissions and umask

New files and directories do not start from the same base permission.

Default idea

Linux applies a permission mask called umask when creating new files and directories.

umask
0022
touch file.txt
mkdir folder
ls -ld file.txt folder
-rw-r--r-- 1 jp jp ... file.txt
drwxr-xr-x 2 jp jp ... folder

How default math works

Object	Base permission	Typical umask	Common result	Why
New file	666	022	644 / rw-r--r--	Files are not executable by default for safety.
New directory	777	022	755 / rwxr-xr-x	Directories need execute permission so users can enter them.

Do not over-teach the math initially: for beginners, remember this practical rule: new files often become 644; new directories often become 755.

8) Permission Denied Monster Clinic

Common beginner errors, likely cause, and clean fix.

👾

Script will not run

./demo.sh
bash: ./demo.sh: Permission denied

Likely cause: missing execute bit.

Fix: chmod +x demo.sh or chmod 755 demo.sh

🧟

Cannot edit file

demo.sh: Permission denied

Likely cause: you do not own it or lack write permission.

Check: ls -l demo.sh

🐉

Directory access blocked

cd logs
bash: cd: logs: Permission denied

Likely cause: missing execute permission on directory.

Fix idea: add x for the correct user/group.

🚨 Danger Zone: commands learners should not blindly run

Command	Why dangerous	Safer thinking
chmod 777 file	Everyone can read, write, and execute. It “fixes” by weakening security.	Give only the required permission to owner/group.
chmod -R 777 /path	Recursively opens many files/directories. Easy to create a major security mess.	Apply to a specific lab folder only after understanding impact.
sudo chown -R root:root /	Can damage the entire system ownership layout.	Never run ownership changes on / in training.

9) Guided Hands-on Lab

Use a safe lab directory. Commands match the requested module lab and include expected output.

Create a safe lab folder

This keeps the practice clean and easy to delete.

mkdir -p ~/permission-lab
cd ~/permission-lab

Create the file

touch demo.sh
ls -l demo.sh

Expected pattern: usually -rw-r--r--. A new file normally does not have execute permission.

Make it executable with numeric chmod

chmod 755 demo.sh
ls -l demo.sh

Expected permission pattern:
-rwxr-xr-x ... demo.sh

755 means owner=rwx, group=r-x, others=r-x.

Change ownership to root

sudo chown root:root demo.sh
ls -l demo.sh

Expected pattern:
-rwxr-xr-x 1 root root ... demo.sh

Important: this changes owner and group to root. It does not change the 755 permission bits.

Optional: add content and test execution

touch demo.sh creates an empty file, so running it gives no visible output. Add a small echo line to make the demo more satisfying.

sudo bash -c 'printf "#!/bin/bash\necho Permission lab works!\n" > demo.sh'
sudo chmod 755 demo.sh
./demo.sh

Expected output:
Permission lab works!

Clean up

cd ~
sudo rm -rf ~/permission-lab

10) Mini Terminal Simulator

Click through the lab flow without touching your VM yet.

simulated terminal

$ Ready. Click “Next lab step”.

11) Quick Quiz

Instant feedback. Good for a 5-minute classroom recap.

Q1. Which command gives rwxr-xr-x?

Q2. What does execute permission mean for a directory?

Q3. What does chown change?

Flashcards: click to flip

7click

4+2+1 = read + write + execute = rwx

6click

4+2 = read + write = rw-

5click

4+1 = read + execute = r-x

0click

No permission = ---

12) Trainer Delivery Flow

A simple sequence to make the topic interactive in class.

Start with the story: “A script exists but refuses to run. Which clue should we inspect first?” Expected answer: ls -l.

Use body movement: ask three learners to be Owner, Group, Others. Give each read/write/execute cards.

Run the lab live: show touch, chmod 755, ls -l, and sudo chown root:root.

Break it intentionally: run chmod 644 demo.sh, then ./demo.sh, and let learners diagnose the error.

End with quiz: make learners decode 640, 700, 755, and 777.

13) One-page Cheatsheet

Quick recap for learners after the session.

Need	Command / Concept	Beginner note
Show permissions	ls -l file	Read the leftmost permission string.
Create empty file	touch demo.sh	New files commonly start as 644.
Make script executable	chmod 755 demo.sh	Owner full, others can read/run.
Add execute only	chmod +x demo.sh	Fast fix for a script.
Change owner and group	sudo chown root:root demo.sh	Changes ownership, not permission bits.
Change group only	sudo chgrp devops demo.sh	Useful for team access.
Check default mask	umask	Common value: 0022.
Avoid bad habit	chmod 777	Usually too open. Use least privilege.

Final memory line: 755 = owner gets full power, group and others can read and run, but cannot edit.