Linux File Permissions Explained for Security Professionals

Short answer: Every Linux file has permissions for three classes, the owner (user), the group, and others, each able to read (r), write (w), or execute (x). Those bits map to octal digits, so rwxr-xr-x is 755. Three special bits, setuid, setgid, and the sticky bit, extend this model and are exactly where many privilege-escalation findings live.

TL;DR: Linux file permissions are nine bits across three classes (user, group, other) expressed as octal; mastering the special bits — especially setuid — is what separates a basic sysadmin check from a real privilege-escalation audit.

Key Takeaways - Permissions apply to three classes (user, group, other) with three bits each (read, write, execute). - Octal is just the bits in numeric form: 755 is rwxr-xr-x, 644 is rw-r--r--. - The special bits add a leading digit: setuid = 4000, setgid = 2000, sticky = 1000. - Misconfigured permissions and stray setuid binaries are classic privilege-escalation paths, so this model is core security knowledge.

The model: three classes, three bits

Linux permissions answer two questions: who and what. The who is three classes, the file's owner (user), its group, and everyone else (other). The what is three actions, read, write, and execute. Combine them and you get the familiar nine-character string you see in ls -l, such as rwxr-xr-x.

This behavior is documented authoritatively in the chmod(1) manual page and the GNU Coreutils file-permissions reference.

Reading the bits as octal

The arithmetic is simple: read is worth 4, write 2, and execute 1. Add the values for each class. rwx is 4+2+1 = 7; r-x is 4+0+1 = 5. That is why 755 means rwxr-xr-x.

The special bits that matter for security

Beyond the nine standard bits, a leading octal digit encodes three special bits, documented in the chmod(2) system-call page:

• setuid (4000) — an executable runs with the privileges of its owner, not the user who launched it. A setuid-root binary runs as root. This is powerful and risky.
• setgid (2000) — similar, but for the group. On a directory, new files inherit the directory's group.
• sticky bit (1000) — on a shared directory like /tmp, only a file's owner can delete or rename it, even though everyone can write there.

So chmod 4755 file sets setuid plus rwxr-xr-x. In an assessment, hunting for unexpected setuid-root binaries is a standard privilege-escalation check, because a single misconfigured one can hand an attacker root.

find / -perm -4000 -type f 2>/dev/null   # list every setuid binary on the system

Why this is foundational security knowledge

Permissions are access control at the file level. Get them wrong and you expose credentials, let attackers overwrite trusted files, or leave a path from a normal user to root. Reading ls -l output fluently, and knowing what a stray 4755 means, is a skill you will use in almost every Linux engagement. It builds directly on the Linux commands every cybersecurity beginner should know and supports the hands-on work in the CEH practical exam preparation guide. Once permissions are solid, your next step is understanding how user context travels across the network — covered in Linux networking fundamentals for ethical hackers.

Frequently asked questions

What do the numbers in Linux permissions like 755 mean?

Each digit is a class (user, group, other) and sums three bits: read = 4, write = 2, execute = 1. So 7 is rwx, 5 is r-x, and 755 means rwxr-xr-x.

What is the difference between chmod and chown?

chmod changes a file's permission bits (what read, write, and execute are allowed for each class). chown changes which user and group own the file. They work together: ownership decides which class you fall into, and the bits decide what that class can do.

What are setuid, setgid, and the sticky bit?

They are special permission bits set with a leading octal digit. setuid (4000) runs an executable as its owner, setgid (2000) runs it as its group or makes a directory assign its group to new files, and the sticky bit (1000) stops users from deleting files they do not own in a shared directory.

Why are file permissions important in cybersecurity?

Permissions are file-level access control. Misconfigurations, such as world-writable sensitive files or unexpected setuid-root binaries, are common privilege-escalation paths, so reading and auditing permissions is core security work.

---

ThreatBlock's Linux Essentials course drills permission auditing on real systems so the model becomes second nature.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with hands-on experience in penetration testing and red teaming. Read more on the author page · Editorial policy.