permissions

Overview

Linux permissions decide who may read, write, or run each file. In CTFs they are everywhere: a flag file you cannot read yet, a script you need to make executable, or a misconfigured permission that becomes the whole solution. This lesson teaches you to read the permission string in ls -l, understand the three permission types and three identity classes, and change permissions safely in authorized practice.

Learning objectives

• Interpret the ten-character permission string shown by ls -l.
• Distinguish the read, write, and execute permissions.
• Distinguish the owner, group, and others identity classes.
• Change permissions with chmod using both symbolic and numeric (octal) notation.

Core concept

Every file and directory has an owner (a user) and an associated group, plus a set of permissions describing what three classes of identity may do:

• Owner (u) — the user who owns the file.
• Group (g) — members of the file's group.
• Others (o) — everyone else.

For each class there are three permissions:

• Read (r) — view the file's contents (or list a directory).
• Write (w) — modify the file (or create/delete entries in a directory).
• Execute (x) — run the file as a program (or enter/traverse a directory).

Note the twist for directories: x means "may enter and traverse," and r means "may list." You can sometimes access a known file inside a directory you cannot list, if you have execute but not read on it.

How it works

In ls -l, the first column is a ten-character string like -rwxr-xr--:

-  rwx  r-x  r--
|   |    |    |
|   |    |    +--- others: read only
|   |    +-------- group: read + execute
|   +------------- owner: read + write + execute
+----------------- file type ( - = file, d = directory, l = symlink )

You change permissions with chmod. There are two notations:

• Symbolic: chmod u+x script.sh adds execute for the owner; chmod go-w file removes write from group and others; chmod a+r file adds read for all.
• Numeric (octal): each class gets a digit that is the sum of read=4, write=2, execute=1. So rwx = 7, r-x = 5, r-- = 4. chmod 755 file means owner rwx (7), group r-x (5), others r-x (5). chmod 644 file means owner rw-, group and others r--.

Ownership itself is changed with chown (owner) and chgrp (group), which usually require elevated privileges.

Practical example

A CTF challenge hands you a solver script but running it fails:

$ ls -l solve.sh
-rw-r--r-- 1 player player 128 Sep 25 10:00 solve.sh

$ ./solve.sh
bash: ./solve.sh: Permission denied

The permission string -rw-r--r-- shows no x anywhere, so nobody may execute it. You add execute for the owner and run it:

$ chmod u+x solve.sh
$ ls -l solve.sh
-rwxr--r-- 1 player player 128 Sep 25 10:00 solve.sh
$ ./solve.sh
flag{chmod_gave_me_execute}

Equivalently, chmod 744 solve.sh would have produced -rwxr--r--. Reading the permission string told you exactly what was missing before you touched anything.

Cybersecurity relevance

Permissions are one of the most common sources of real-world misconfiguration, and CTFs mirror this constantly. A world-writable script that a privileged process runs, a flag file accidentally left readable by "others," or a private key with permissions so loose that tools refuse to use it — all are permission problems. Learning to read ls -l at a glance lets you spot when something is too open or too closed. Defensively, applying least privilege (grant only the access needed, no more) is a core hardening principle, and permission literacy is where it starts.

Common mistakes

• Confusing the octal digits — remember read=4, write=2, execute=1, then add per class.
• Using chmod 777 to "make it work"; this grants everyone full access and is almost always wrong and insecure.
• Forgetting execute on directories, so you cannot cd into them even with read.
• Assuming you need root for everything — you can usually chmod files you already own.

Key takeaways

• Permissions apply to three classes (owner, group, others) with three rights each (read, write, execute).
• The ls -l string decodes as type + owner + group + others, three characters each.
• chmod sets permissions symbolically (u+x, go-w) or numerically (755, 644) where r=4, w=2, x=1.
• On directories, execute means traverse and read means list; avoid 777 and follow least privilege.

Check your understanding

• What does the permission string -rwxr-x--- allow the owner, the group, and others to do?
• Which chmod command would make a file readable and writable by its owner but only readable by everyone else, in numeric form?
• Why is chmod 777 almost always the wrong fix for a "permission denied" error?