IT & cloud certifications · course 55 of 105

Permission Denied? Linux rwx, chmod and umask

Read and set Unix file permissions without guessing: mode strings and their octal twins, what chmod leaves behind, the modes a umask gives new files, and the setuid, setgid and sticky bits.

4 modules

Try a question

Not on sale yet. When sales open: $4.99 for this course, paid once, or every course for $9.99 a month. Prices

Preview

What it teaches

How to read and set Unix file permissions without guessing. The ls -l mode string (-rwxr-xr--) and its octal twin (754): which of r, w and x each digit stands for; what chmod leaves behind (u+x, go-w, o=r, g=u, chmod 640, and what chmod +w with no “who” does under a umask of 022); the default modes a umask gives new files (they start at 666) and new directories (777); and the setuid, setgid and sticky bits as the leading octal digit and the s and t in the mode string. The AI asks 3 questions, places you, shows a short card per module, then gives you one question at a time.

Not a Linux course, and it can’t judge whether your own files or server are set up right or safely.

How long

43 items. About 12-30 rounds for someone who already uses chmod up to about 75 for a beginner, plus a 12-item final: 1-3 sessions (from a test run’s simulated students: 12 and 28 rounds for confident students, 73 for a beginner; not timed with a real student). The tutor gives a one-line save code at the end of each session.

From the answer key · M1, row S9

Which classes (owner, group, other) can write to a regular file whose mode string is -rwxrw-r--?

Think first, then show the answer

Answerowner and group

Working-rwxrw-r--: owner rwx, group rw-, other r--; the w appears in the owner and group triples: owner and group.

The wrong answer it catchesOwner, group and other → counted every class that has any permission; other has r-- only, so no w.

Ten characters: the mode string is one entry-type character, then the owner’s three, the group’s three and other’s three. The type is “d Directory.” or “- Regular file.” Each three is “Permissions for the file owner class”, “Permissions for the file group class”, “Permissions for the file other class”.
Each three reads r, w, x in that order: “If 'r', the file is readable; if '-', the file is not readable.” “If 'w', the file is writable; if '-', the file is not writable.” For x: “x The file is executable or the directory is searchable.” In the drills a - in a slot means that permission is off.

The modules

4 modules, drilled one item at a time.

M0
The words
Owner, group and other; read, write and execute on files and directories; chmod’s letters; the special bits; the umask
M1
Reading mode strings
Read a mode string like -rwxr-xr-x, turn it into octal (755) and back, and say which classes can write or execute
M2
What chmod leaves
What chmod leaves behind: u+x, o=r, chmod 600, several changes at once, and +w with no “who”
M3
Default modes from the umask, and the special bits
The mode a umask gives a new file or directory, the umask for a wanted mode, and the setuid, setgid and sticky bits

Before it teaches, it asks

1
What do you use a Linux or Mac terminal for most (servers, help-desk tickets, scripts, nothing yet), and can you open one?
2
ls -l shows -rwxr-xr-x for a regular file. What is its mode in octal?
3
A regular file f has mode -rwxr-xr-x. After chmod o=r f, what is its mode as an ls -l mode string?

What’s exact, and what isn’t

Show

Straight from the course’s own notes.

The words and rules are quoted: From the saved pages, read 2026-10-12: the GNU Coreutils manual 9.12 (chapter “File permissions”) and the POSIX.1-2017 pages (Issue 7, 2018 edition) for chmod, umask, ls, mkdir and touch. A script checks all 48 quotes word for word on the 13 saved pages; it does not re-fetch live pages. The 22 POSIX quotes are also on the newer Issue 8 (2024) pages, checked once by hand on 2026-10-13 (not saved). M0's Answers are built from the quotes, not computed.
Computed three ways that must agree: Every M1, M2 and M3 key comes from (1) a script’s own model of modes and chmod, which matches Python’s stat.filemode for all 4,096 modes of a file and of a directory; (2) stat.filemode reading a real file; (3) the real chmod, touch, mkdir and ls -ld, re-run for each key in a throwaway folder (the checks make 461 real runs of chmod, or of touch and mkdir: 34 behind the keys, and 427 more that compare the model with the real commands across other start modes, commands and umasks). Every number in the Workings is computed by the same functions. All 30 wrong-answer rows are proven wrong and proven to be the slip they name.
Where the re-runs were done: On a Mac (Darwin 24.0.0, Apple’s BSD chmod, Python 3.14.3), not on Linux. The rules come from POSIX and the GNU manual, and the check prints the system it ran on. The check has not been run on Linux (there it would re-run every key with that machine’s chmod and flag any difference), but a test run re-ran all 33 keys with real tools in four local Linux containers (Debian 13 with GNU coreutils 9.7, Debian 12 with GNU 9.1, Ubuntu 26.04 with uutils 0.8.0, Alpine with BusyBox 1.37): 33 of 33 on each.
Starting points: A new file made by touch starts at 666 (the six bits the touch page names add up to 666 in the chmod page’s table) and a new directory made by mkdir at 777 (the mkdir page: “777 on most systems”). The course covers those two ways of creating things and nothing else.
Honest limits: The course drills quoted rules and computed modes. It gives no security advice and can’t tell whether a real file, folder or server setting is right. Only regular files and directories appear, the extra flag character some systems print after the nine permission characters is never shown, and the sticky bit is drilled on directories only. POSIX leaves a directory’s setuid and setgid bits to each system (the chmod page: “Conforming applications should never assume that they know how the set-user-ID and set-group-ID bits on directories are interpreted”; the GNU manual: “Portable scripts should not rely on requests to set or clear these bits on directories, as POSIX allows implementations to ignore these requests.”), so no chmod item starts from or ends on a directory with a special bit; the special-bit items only convert between octal and the mode string (one question shows a directory’s setgid bit to convert; one concept question defines it in words). In a test run’s Linux re-runs, mkdir inside a setgid directory also set that bit on the new directory (macOS did not), so two of the umask questions assume an ordinary parent directory.
Not in it yet: Access control lists, chown and chgrp, sudo and root, chmod -R and find, the X, s and t letters in symbolic chmod, the symbolic form of umask (umask -S), file types other than regular files and directories, Windows and Finder permissions.