chmod: change file mode bits
Usage (octal mode):
chmod octal-mode files...
Usage (symbolic mode):
chmod [references][[operator][modes]] files...
references is a combination of the letters
which specify which user's access to the
files will be modified:
u the user who owns it
g other users in the file's group
o other users not in the file's group
a all users
If omitted, it defaults to all users,
but only permissions allowed by the
umask are modified.
operator is one of the characters
+ add the specified file mode bits
to the existing file mode bits of each
- removes the specified file mode bits
from the existing file mode bits of each
= adds the specified bits and removes unspecified bits, except the
setgid bits set for directories, unless explicitly specified.
mode consists of a combination of the letters
rwxXst, which specify which permission bits are to be modified:
x (lower case
X) execute (or search for directories)
X (capital) execute/traverse only if the file is a directory
or already has an execute bit set for some user category
s setuid or setgid (depending on the specified
t restricted deletion flag or sticky bit
mode can consist of one of the letters
in which case case the mode corresponds to the permissions
currently granted to the owner (
u), members of the file's group (
or users in neither of the preceding categories (
The various bits of
- Access control (see also
rwx — read (
r), write (
w), and execute/traverse (
- Read (r) affects if a file can be read, or if a directory can be listed.
- Write (w) affects if a file can be written to,
or if a directory can be modified (files added, deleted, renamed).
- Execute (x) affects if a file can be run,
use for scripts and other executable files.
- Traverse (x), also known as "search",
affects whether a directory can be traversed;
i.e., whether a process can access (or try to access) file system objects
through entries in this directory.
t — sticky bit (
t), and setgid (
s) on directories
- The sticky bit only affects directories. Will prevent anyone except file owner, and root, from deleting files in the directory.
- The setgid bit on directories will cause new files and directories
to have the group set to the same group,
and new directories to have their setgid bit set
(see also defaults in
s — setuid, setgid, on executable files
- This can affect security in a bad way, if you don't know what you are doing.
- When an executable is run, if one of these bits is set,
then the user/group of the executable
will become the effective user/group of the process.
Thus the program runs as that user.
setcap for a more modern way to do this.
chattr: change file attributes
chattr operator[attribute] files...
operator is one of the characters
+ adds the selected attributes to be to the existing
attributes of the
- removes the selected
= overwrites the current set of attributes the files have with the specified
attribute is a combination of the letters
which correspond to the attributes:
a append only
d no dump
e extent format
j data journaling
m don't compress
s secure deletion
t no tail-merging
x direct access for files
C no copy on write
D synchronous directory updates
F case-insensitive directory lookups
P project hierarchy
S synchronous updates
T top of directory hierarchy
There are restrictions on the use of many of these attributes.
For example, many of them can be set or cleared only
by the superuser (i.e., root) or an otherwise privileged process.
Usage (set attribute):
setfattr -n name -v value files...
setfattr -x name files...
name is the name of the extended attribute to set or remove
value is the new value of the extended attribute
setfacl: change file access control lists
setfacl option [default:][target:][param][:perms] files...
option must include one of the following:
--set set the ACL of a file or a directory, replacing the previous ACL
--modify modify the ACL of a file or directory
--remove remove ACL entries of a file or directory
target is one of the letters
ugmo (or the longer forms shown below):
users permission of a named user identified by
defaults to file owner UID if omitted
group permission of a named group identified by
default to owning group GID if omitted
mask effective rights mask
other permissions of others
perms is a combination of the letters
rwxX, which correspond to the permissions:
X execute only if the file is a directory or already has execute permission for some user
perms may be an octal digit (
7) indicating the set of permissions.
setcap capability-clause file
capability-clause consists of a comma-separated list of capability names followed by a list of operator-flag pairs.
The available operators are
-. The available flags are
p which correspond to the Effective, Inheritable and Permitted capability sets.
= operator will raise the specified capability sets and reset the others. If no flags are given in conjunction with the
= operator all the capability sets will be reset. The
- operators will raise or lower the one or more specified capability sets respectively.
chcon [-u user] [-r role] [-t type] files...
user is the SELinux user, such as
role is the SELinux role (always
object_r for files)
type is the SELinux subject type
chsmack: change SMACK extended attributes
SMACK is Simplified Mandatory Access Control Kernel.
chsmack -a value file
value is the SMACK label to be set for the
SMACK64 extended file attribute
setrichacl: change rich access control list
richacls are a feature that will add more advanced ACLs.
Currently a work in progress, so I can not tell you much about them. I have not used them.
See also this question Are there more advanced filesystem ACLs beyond traditional 'rwx' and POSIX ACL?
and man page