I have a file named file.txt with some contents located in /home/myuser directory and I change the permissions of that file to root.root and 644.

-rw-r--r-- 1 root root 1.4K Jan 15 07:09 file.txt

Then I switched to myuser and opened it with vim(without sudo) and tried to edit and save it :wq! and I got output like:

"file.txt" E949: File changed while writing
Press ENTER or type command to continue

Then I hit enter and then again :wq! and the output was :

WARNING: The file has been changed since reading it!!!
Do you really want to write to it (y/n)?

I hit y, the file got saved and exit from vim.

The question is why a file with ROOT privileges and read-only access for a user changed by the way?

PS: 1. myuser is a sudo user.

  1. The user permissions after saving the file changed to myuser.myuser as well.

    -rw-r--r-- 1 myuser myuser 1.4K Jun 27 18:57 file.txt

  • 1
    What are the permissions on the directory where the file lives? If the user has write access to it, they are able to delete the file and recreate it.
    – Kusalananda
    Jun 27, 2018 at 13:33
  • It is the home directory of myuser. So what is happening is deleting and recreating? PS: The user permissions after saving the file changed to myuser.myuser as well.
    – prado
    Jun 27, 2018 at 13:36
  • 1
    Does this answer your question? Regular user is able to modify a file owned by root
    – muru
    Nov 17, 2023 at 8:39
  • 1
    Does this answer your question? How does vim steal root owned files?
    – AdminBee
    Nov 22, 2023 at 16:33

1 Answer 1


Since the file lives in a directory that is writable by the user, the user has permissions to delete and recreate the file. This is more or less what vim does when you force write to the file.

$ ls -li file
3481899 -r--r--r--  1 root  wheel  6 Jun 27 15:48 file

$ vim file

$ ls -li file
3481905 -rw-r--r--  1 myself  myself  6 Jun 27 15:49 file

As you can see in this example, the file has been recreated and has a new inode number. The user and group has been set to the user who wrote the file, and the permissions have been set according to the user's umask.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .