Use chmod to change read, write, and execute permissions; use chown to change a file’s user owner (and optionally its group); and use chgrp when only the group should change. Inspect the current mode and owner first, make the smallest change that fixes the problem, and treat recursive commands as potentially destructive. Only root can assign a different user as owner, while an ordinary user can change a file’s group only to a group that user belongs to.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The Linux permission model in one minute
Every file and directory has two separate kinds of access control:
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
- Permission bits: read (
r), write (w), and execute (x) permissions for the owner, the owning group, and everyone else.chmodchanges these bits. - Ownership: one user and one group attached to the inode.
chownchanges the user and, if requested, the group;chgrpchanges only the group.
These controls are independent. A web server, game server, or container can report “Permission denied” because the process has the wrong owner or group even when the mode looks permissive, or because the mode blocks an otherwise correct owner. Check both before changing either.
Check the current owner, group, and mode before editing
Start with a listing that shows the nine permission bits, owner, group, size, and path:
#1 Best Overall
ls -l /path/to/file
ls -ld /path/to/directoryUse ls -ld for a directory itself. Without -d, ls -l shows the directory’s contents instead, which can lead you to change the wrong object. A line such as -rw-r----- alice games save.dat means a regular file, owner alice, group games, owner permissions rw-, group permissions r--, and no permissions for others.
Confirm the account and group names that exist on this machine:
id
id username
getent group gamesIf a path is a symbolic link, inspect both the link and its target:
ls -l /path/to/link
readlink /path/to/linkThis distinction matters because many ownership commands follow a symlink and modify its target by default.
Choose the right command
| Command | Changes | Typical use |
|---|---|---|
chmod |
Read, write, and execute bits for owner, group, and others | Allow a script to run, remove write access from other users, or set a directory’s traversal permissions |
chown |
User owner, with an optional group change | Give a service account ownership of a game-server directory or uploaded files |
chgrp |
Group owner only | Move a shared directory into a team group without changing its user owner |
Changing the mode cannot change who owns a file, and changing ownership cannot add a missing execute bit to a directory. Solve the specific control that is wrong instead of applying a broad command “just in case.”
Change permissions with chmod
Numeric (octal) mode
A numeric mode has one digit for each class in this order: owner, group, others. Within each digit, read is 4, write is 2, and execute is 1; add the values for the permissions you want.
| Digit | Bits | Meaning |
|---|---|---|
| 0 | --- |
No access |
| 1 | --x |
Execute (or traverse for a directory) |
| 2 | -w- |
Write |
| 3 | -wx |
Write and execute |
| 4 | r-- |
Read |
| 5 | r-x |
Read and execute |
| 6 | rw- |
Read and write |
| 7 | rwx |
Read, write, and execute |
Examples:
chmod 644 config.ini
chmod 755 start-server.sh
chmod 700 private-save-directory644gives the owner read/write access and everyone else read-only access. It is a common choice for text, configuration, and save files that do not need to run.755gives the owner full access and group/others read and execute access. It is appropriate for an executable script or a directory that others must traverse, but it is usually too permissive for ordinary documents.700keeps a private directory accessible only to its owner.
A leading fourth digit can represent special bits such as set-user-ID, set-group-ID, or the sticky bit. For a shared directory, the set-group-ID form is commonly written as 2775; the leading 2 makes newly created files inherit the directory’s group.
Symbolic mode
Symbolic syntax identifies the class, an operator, and the bits: u (user/owner), g (group), o (others), or a (all three), followed by + to add, - to remove, or = to set exactly.
chmod a=r,u+w notes.txt
chmod g-w,o-rwx shared-save
chmod u+x start-server.shThe first example sets read-only access for everyone, then adds owner write access, resulting in owner rw- and group/others r--. Symbolic mode is useful when you want to preserve unrelated bits—for example, adding execute for the owner without replacing existing group permissions.
Files and directories need different permissions
On a regular file, read permits opening its contents, write permits modifying or truncating them, and execute permits running it as a program. A text-based game configuration normally needs read/write for its service account but does not need execute.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →On a directory, read permits listing names, write permits creating, deleting, or renaming entries, and execute permits traversing the directory and accessing entries when their names are known. A user may therefore need x on every parent directory in a path even if the target file itself is readable.
Do not use a blanket chmod -R 755 on a tree of documents, saves, or configuration files. It marks every regular file executable. If you intentionally need a broad recursive adjustment while avoiding that mistake, the GNU manual demonstrates:
chmod -R a=,+rwX project-directoryHere X adds execute only to directories and to files that were already executable. Review the result with find or ls -l before exposing the tree to a service or other users; a targeted command for a known set of files is safer than any blanket change.
Change the owner or group with chown
Set the user owner
sudo chown gameserver /srv/game-server/save.datOnly root can change a file’s user owner. Use sudo when your account is allowed to administer the machine. If the target user does not exist, the command fails rather than creating an account.
Set both user and group
sudo chown gameserver:games /srv/game-server
sudo chown gameserver:games /srv/game-server/save.datThe user:group form is explicit and easier to audit. It is the preferred form when a service must run as one account while sharing files with a named group.
Change only the group with chown or chgrp
sudo chown :games /srv/game-server/mods
sudo chgrp games /srv/game-server/modsA leading colon with no user changes only the group; chgrp expresses that intention directly. An ordinary user can select only a group that user belongs to. Root can assign any existing group.
Rank #4
On GNU chown, writing a user followed by a colon with no group (for example, chown gameserver: file) sets the user owner and the owner’s login group. Ubuntu 25.10 and newer use the Rust-based uutils implementation by default; a report from one Ubuntu 26.04 test found chown USER: FILE changed the owner but left the group unchanged. Because that behavior may vary by implementation, specify USER:GROUP whenever the group matters. GNU chown remains available on those systems as gnuchown.
Apply changes recursively without damaging a tree
Add -R to recurse through a directory and its contents:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo chown -R gameserver:games /srv/game-server
sudo chmod -R 750 /srv/game-serverRecursion affects every descendant, including files that may need different modes, generated logs, sockets, and links. Prefer separate passes when files and directories need different policies. For example, set directory traversal and file readability independently after inspecting the tree, rather than forcing one mode onto everything.
Take a dry look first:
find /srv/game-server -maxdepth 2 -printf '%M %u %g %pn'Save the current ownership and mode information or make a backup before a large change. If a command reports an error partway through, do not assume the entire tree changed; inspect representative files and rerun a narrower command.
Handle symbolic links deliberately
By default, chown follows a symbolic link and changes the target. To change the link object itself, use -h:
Best Value
sudo chown -h gameserver:games /srv/game-server/currentFor chgrp, -h or the long option --no-dereference requests the link itself. The manual also documents -H and -R combinations for recursive operations. Be especially cautious with recursive ownership changes in directories containing links to locations outside the intended project; following those links can alter files elsewhere.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallchmod generally operates on the target reached through a symbolic link because a link has no independent permission bits that control access. If you need to protect the target, resolve the path and change the real file deliberately.
Build a safe shared directory for a game project
Suppose an administrator and a deployment account both maintain files in /srv/game-server, and both are members of the games group. A controlled setup is:
- Create or verify the group and membership using your distribution’s account-management tools, then start a new login session so group membership is refreshed.
- Assign the service account and group explicitly:
sudo chown -R gameserver:games /srv/game-server - Set the directory’s set-group-ID bit and a group-writable mode:
sudo chmod 2775 /srv/game-server - Give ordinary files only the access they need. Do not make configuration files executable merely because the parent directory is executable.
- For users who need exceptions beyond owner/group/other, use POSIX ACL tools:
setfaclto grant a named user or group andgetfaclto inspect the resulting ACL. ACL entries supplement the basic mode; document them so a laterchmodchange does not surprise the team.
The set-group-ID directory causes new entries to inherit the directory’s group, which prevents each contributor’s private login group from fragmenting access. It does not, by itself, make every new file group-writable; the creating program’s mode and the process umask still matter.
Fix “Permission denied” methodically
Work from the path outward rather than repeatedly adding permissions:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Identify the process account. A service launched by systemd, a container, or a game panel may run as a different user than your shell. Confirm that account and its supplementary groups.
- Inspect every parent directory. The process needs execute permission on each directory in the path. A readable target file is not enough if a parent directory blocks traversal.
- Check owner and group. Use
ls -ldon each directory andls -lon the target. Correct ownership withchown user:grouponly when the service should own the data; otherwise use a shared group. - Check the mode. Add the minimum required bit with symbolic
chmodwhere possible. Avoid making a file world-writable or an entire tree executable as a shortcut. - Check ACLs.
getfacl pathcan reveal a named-user entry or a mask that changes the effective permission shown by the basic mode. - Check links and mounts. A symlink may lead to a target with different ownership, and a mounted filesystem may impose its own rules. Resolve the path before changing anything recursively.
Many web-server and Docker deployment failures attributed to “permissions” are ownership mismatches: the process is running under an account that cannot write files created by an administrator. Correcting the owner or shared group is safer than setting 777, which grants write access to everyone.
Quick Recap
Common mistakes and their safer replacements
| Mistake | Why it causes trouble | Safer approach |
|---|---|---|
chmod -R 777 project |
Every local user and service can modify every descendant. | Set a service owner or shared group, then grant only the required group bits. |
chmod -R 755 project |
Regular files become executable, and sensitive files may be readable by others. | Use separate directory and file policies; use X only when a recursive operation is truly needed. |
| Changing only the target file | A parent directory without execute permission still blocks access. | Inspect and fix traversal permissions on every parent directory. |
Using chown -R on a tree containing links |
Default symlink handling can modify link targets. | Inspect links first and use -h or a narrower path when the link itself is the object you intend to change. |
Assuming chown USER: has identical behavior everywhere |
GNU and uutils implementations can differ on the omitted-group case. | Write USER:GROUP explicitly and verify with ls -l. |
Quick command reference
| Goal | Command |
|---|---|
| Inspect a file | ls -l file |
| Inspect a directory itself | ls -ld directory |
| Make a file owner-read/write, others-read | chmod 644 file |
| Make an owner-run script executable | chmod u+x script.sh |
| Set owner and group | sudo chown user:group path |
| Set only the group | sudo chgrp group path |
| Change ownership recursively | sudo chown -R user:group directory |
| Change a symlink’s own owner | sudo chown -h user:group symlink |
| Set group inheritance on a shared directory | sudo chmod 2775 directory |
| Inspect extended ACLs | getfacl path |
A final safety checklist
- Confirm the exact path; use
ls -ldbefore changing a directory. - Decide whether the problem is mode, owner, group, ACL, or parent-directory traversal.
- Use the narrowest command and explicit
user:groupnotation. - Use
sudoonly for the command that requires administrative rights. - Review symlinks before recursive operations; use
-hor--no-dereferencewhen the link itself must change. - Verify the result with
ls -l,ls -ld, and, when relevant,getfacl. - On Ubuntu 25.10 or newer, verify which
chownimplementation is active and specify the group explicitly.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
