Chmod vs Chown: Linux File Permissions vs Ownership Explained

"Permission Denied." It is arguably the most common and frustrating error encountered by developers, sysadmins, and DevOps engineers working in a Linux environment. Whether you are trying to execute a bash script, deploy a web application (where you might need a Docker Volume Permissions Helper to resolve container mount issues), or allow Nginx to read an index file, access control is at the heart of Linux security.

When trying to fix a "Permission Denied" error, users often scramble between two fundamental commands: chmod and chown. While they are frequently used together and seem conceptually similar, they control completely different layers of the Linux security and access model.

In this comprehensive guide, we will break down exactly what chmod and chown do, how Linux evaluates permissions from the inside out, and provide real-world examples and common server presets.

1. Chmod: Changing Who Can Do What (File Modes)

The chmod command stands for "change mode." It determines the access permissions of a file or directory. It dictates what actions are allowed, but it does not dictate who actually owns the file.

In the Linux permission model, every file and directory has permissions divided into three distinct classes of users:

• Owner (User/u): The individual user who owns the file.
• Group (g): A collection of users associated with the file.
• Others (o): All other users on the system (the public).

For each of these three classes, three possible actions can be granted or denied:

• Read (r): For files, allows viewing the contents. For directories, allows listing the files inside.
• Write (w): For files, allows modifying the contents. For directories, allows creating, deleting, or renaming files inside.
• Execute (x): For files, allows running the file as a program or script. For directories, allows entering the directory (using cd) and accessing files within it.

Using Numeric (Octal) Chmod

The most common way to use chmod is with octal numbers. Each permission is assigned a numerical value: Read = 4, Write = 2, Execute = 1. You add these numbers together to get the permission for a class.

# Gives the Owner read/write/execute (4+2+1=7), 
# Group read/execute (4+1=5), 
# and Others read/execute (4+1=5)
chmod 755 script.sh

Common octal presets:

• 644: Standard for files. Owner can read/write. Group and Others can only read.
• 755: Standard for directories and executables. Owner has full control. Group and Others can read and execute (enter).
• 600: High security. Only the Owner can read and write. Used for SSH keys (id_rsa) and secret config files.
• 777: Warning! Everyone can read, write, and execute. Never use this in production.

2. Chown: Changing Who Owns the File (Ownership)

The chown command stands for "change owner." It determines the identity of the user and group that own the file. It assigns the labels of "Owner" and "Group" that chmod relies on.

Every file in Linux has exactly one Owner and exactly one Group.

For instance, when you upload files to a web server as the root user, the files are owned by root. However, your web server (like Apache or Nginx) usually runs as a restricted user named www-data. If the files are owned by root and the permissions restrict "Others" from reading, the web server will throw a 403 Forbidden error.

To fix this, you change the ownership to the web server user:

# Syntax: chown user:group filename
sudo chown www-data:www-data index.html

# Recursively change ownership for an entire directory
sudo chown -R www-data:www-data /var/www/my-website

3. How Permissions and Ownership Interact

To truly master Linux security, you must understand how the operating system evaluates these rules. Linux evaluates permissions from the inside out, stopping at the first match:

1. Is the user the Owner? If the user trying to access the file matches the file's Owner (set by chown), Linux checks only the Owner permissions (the first digit in chmod). It ignores the rest.
2. Is the user in the Group? If the user is not the owner, but belongs to the file's Group, Linux checks only the Group permissions (the second digit).
3. Fallback to Others: If neither of the above is true, Linux checks the Others permissions (the third digit).

Crucial Security Concept: Let's say you configure a directory with chmod 700 (read, write, execute ONLY for the owner). If the owner of that directory is set to root, no other user on the system will be able to access it, regardless of what group they belong to. The web server will be blocked. To fix it, you either change the owner (chown www-data:www-data) or you open up the permissions for Others (chmod 755). Changing the owner is almost always the more secure choice.

4. Summary Comparison Table

Feature	Chmod (Change Mode)	Chown (Change Owner)
Core Function	Defines what actions (read/write/execute) are allowed.	Defines who (user/group) actually owns the asset.
Analogy	Setting the locks and keys on the doors of a house.	Transferring the legal deed of the house to a new person.
Privileges Required	Any user can run chmod on files they already own.	Requires sudo (root) to give ownership to another user.
Common Commands	chmod 755 folder/ chmod +x script.sh	chown www-data:www-data file.txt chown -R john:developers app/

5. Troubleshooting "Permission Denied" Workflows

When facing a permission error, do not immediately jump to chmod 777. Follow this diagnostic workflow:

Step 1: Check the current state

Run ls -l filename to see both ownership and permissions.

$ ls -l script.sh
-rw-r--r-- 1 root root 1024 May 26 10:00 script.sh

Analysis: Owned by root. Owner has rw, Group has r, Others have r. No execute permission.

Step 2: Ask "Who needs access, and what do they need to do?"

• If you need to execute it yourself, but you are not root: You need to either take ownership (sudo chown $USER script.sh) or add execute permission for Others (sudo chmod o+x script.sh).
• If a web server needs to read it: Ensure the web server user owns it (sudo chown www-data:www-data script.sh) OR ensure Others have read access (sudo chmod 644 script.sh).

Advanced Troubleshooting & Edge Cases

While the standard chmod and chown rules apply to 99% of daily Linux operations, there are specialized edge cases and advanced permission structures that can completely override your standard octal values. If you have set the ownership correctly and applied chmod 777 (which you shouldn't do) but still get a "Permission Denied" error, you are likely hitting one of these advanced security layers.

1. Access Control Lists (ACLs)

Standard Linux permissions are limited because a file can only have one Owner and one Group. What if you need to grant read access to User A, write access to User B, and no access to User C, without creating a convoluted custom group? This is where Access Control Lists (ACLs) come in.

ACLs allow you to define fine-grained permissions for specific, individual users or secondary groups that override the base chmod settings. If you run ls -l and see a plus sign (+) at the end of the permission block (e.g., -rw-rwxr--+), it means an ACL is active on that file.

How to fix: You cannot manage ACLs with standard chmod or chown commands. You must use the getfacl command to view the hidden permissions, and setfacl to modify them. For instance, getfacl filename.txt will reveal exactly which users have invisible access rights that might be overriding your expected behavior.

2. The Sticky Bit, SUID, and SGID

Beyond the standard Read (4), Write (2), and Execute (1) permissions, Linux features three special permission bits that dramatically alter how files and directories behave.

• SUID (Set User ID): When applied to an executable file (e.g., chmod 4755 script.sh), the script will execute with the privileges of the file's Owner, rather than the privileges of the user running the command. This is how the sudo command works (it is owned by root and has the SUID bit set), allowing normal users to temporarily elevate their privileges.
• SGID (Set Group ID): When applied to a directory (e.g., chmod 2755 /var/shared), any new files created inside that directory will automatically inherit the Group ownership of the parent directory, rather than the primary group of the user who created the file. This is essential for collaborative team folders.
• The Sticky Bit: When applied to a directory (e.g., chmod 1777 /tmp), it restricts file deletion. Inside a sticky directory, only the file's Owner, the directory's Owner, or the root user can delete or rename a file, even if the directory permissions are wide open (777). This is universally used on the /tmp folder to prevent users from deleting each other's temporary files.

3. Immutable Files (chattr)

If you are the root user, you try to run chmod or chown on a file, and you receive an "Operation not permitted" error, the file is likely marked as immutable.

The chattr command changes extended file system attributes. If the immutable bit (+i) is set on a file, it cannot be modified, deleted, renamed, or linked, even by the root user. The permissions cannot be changed, and the owner cannot be altered.

How to fix: Use the lsattr filename command to check for the i flag. If it is present, you must remove it using sudo chattr -i filename before you can run your chmod or chown commands successfully.

Frequently Asked Questions

What is the main difference between chmod and chown?

chmod (change mode) changes file permissions—specifically what read, write, and execute actions are allowed. chown (change owner) changes file ownership—specifically which user and group own the file.

Do I need root access to run chmod and chown?

You can run chmod on any file you own without root access. However, you must use sudo (root access) to run chown to change a file's owner to another user, or to change the ownership of system-owned files. This prevents users from "giving away" files to bypass storage quotas.

Should I run chmod or chown first?

Generally, you should run chown first to establish the correct owner and group structure (e.g., setting web files to www-data), and then use chmod to restrict or grant specific access levels based on that ownership structure.

What does chmod +x do?

It is the symbolic way to add the Execute permission. It allows a file to be run as a program or script. It is the equivalent of adding '1' to the octal permission value.