In a nutshell Every file in Linux says who may read it, write it, and run it — for three classes: the owner, the owner's group, and everyone else. Reading that little
-rwxr-xr--string, and knowing the special bits like SUID, is the foundation of both locking a system down and climbing out of a low-privileged foothold.
The model, read straight off ls -l
The first character is the type (- file, d directory, l link); the next nine are three trios. Above: owner can read/write/execute, group can read/execute, others can only read. For a directory the bits shift meaning: r = list contents, x = enter/traverse, w = create/delete inside.
Analogy — a shared office document. The author (owner) can edit; the team (group) can read and use it; visitors (others) may only glance.
Octal — the numeric shorthand
r=4, w=2, x=1, summed per class:
| Digits | Means | Common for |
|---|---|---|
755 |
rwx / r-x / r-x | programs, directories |
644 |
rw- / r-- / r-- | normal files |
600 |
rw- / --- / --- | private files (SSH keys) |
777 |
rwx / rwx / rwx | everyone everything — a red flag |
chmod 600 id_rsa # lock an SSH key to its owner only
chmod +x script.sh # make a script runnable
chown www-data file # change the owner
The special bits — where privilege escalation hides
| Bit | Effect | Why it matters |
|---|---|---|
| SUID | runs as the file's owner, not you | a SUID-root binary you can run = root's power |
| SGID | runs as the file's group | same idea, group-level |
| sticky | on /tmp: only the owner can delete their files |
stops users deleting each other's |
find / -perm -4000 -type f 2>/dev/null # hunt every SUID file on the system
# an unexpected one, cross-referenced with GTFOBins, is often a road to root
600, never chmod 777, audit SUID binaries. Attacker: a world-writable file the system runs as root, or an unexpected SUID binary, is exactly the misconfiguration that turns a normal user into root. Reading permissions fluently is what lets you spot it (see Linux privilege escalation).