File permissions

Every file on your phone carries a small set of permissions. They decide who can read it, who can change it, and who can run it. Termux prints those permissions as a ten-character string at the start of every ls -l line. Once you can read that string, you can tighten the permissions on a file that holds a key or a password. You can also loosen them on a script you want to run.

What you'll be able to do

• Read the ten-character mode string that ls -l prints for every file.
• Explain the user, group and others classes and the r, w and x flags.
• Convert between the letters rwx and the octal values 4, 2 and 1.
• Set common modes such as 644, 755, 600 and 666 with chmod.
• Spot a world-writable file and say why it is a risk.

Step 1: Read the mode string

Change into your home directory and list the files with the long form. The -l flag asks ls for one line per file. That line starts with the mode string.

cd ~
ls -l

total 8
drwx------ 2 u0_a123 u0_a123 4096 Jan 20 10:12 storage
-rw-r--r-- 1 u0_a123 u0_a123  220 Jan 20 10:15 notes.txt
-rwxr-xr-x 1 u0_a123 u0_a123  512 Jan 20 10:18 run.sh

The mode string is the first field on each line. In -rw-r--r-- the leading - says this is a regular file. A d instead means a directory. An l means a symbolic link. The remaining nine characters are three groups of three.

Step 2: user, group and others

The three groups are the file's owner (user), the owner's group (group), and everyone else (others). Each group holds three flags, in the order read, write, execute.

• r lets you read the file.
• w lets you change the file.
• x lets you run the file as a program, or enter a directory.

Each flag has an octal value. Add the values in a group to get one digit for that group.

Flag	Meaning	Octal value
r	read	4
w	write	2
x	execute	1
-	no permission	0

So rwx is 4 + 2 + 1 = 7, rw- is 4 + 2 = 6, r-- is 4, and --- is 0.

Step 3: Read a single file

To keep the output short, list one file at a time. Here notes.txt is readable and writable by you. Everyone else can only read it.

ls -l notes.txt

-rw-r--r-- 1 u0_a123 u0_a123 220 Jan 20 10:15 notes.txt

The mode is -rw-r--r--. As octal digits that is 644. This is the default for new files.

Step 4: Change permissions with octal chmod

chmod takes a three-digit octal number, one digit for user, group and others. To make notes.txt private, use 600. Then only you can read and write it.

chmod 600 notes.txt
ls -l notes.txt

-rw------- 1 u0_a123 u0_a123 220 Jan 20 10:15 notes.txt

The group and others digits are now 0, so nobody else can touch the file. To make a shell script runnable by everyone, use 755.

chmod 755 run.sh
ls -l run.sh

-rwxr-xr-x 1 u0_a123 u0_a123 512 Jan 20 10:18 run.sh

Here the user digit is 7 (read, write, execute). The group and others digits are 5 (read and execute, but not write).

Step 5: Add one permission with chmod +x

When you only want to add execute permission and leave the rest alone, use the symbolic form. A + adds, a - removes, and the letters name the flag.

chmod +x run.sh
ls -l run.sh

-rwxr-xr-x 1 u0_a123 u0_a123 512 Jan 20 10:18 run.sh

You can also name a class. chmod u+x adds execute for the user only. chmod go-w removes write from group and others.

Step 6: Apply a mode to a whole directory

The -R flag makes chmod walk into a directory and apply the mode to every file and folder inside. Create a private folder and lock it down.

mkdir mydir
chmod -R 700 mydir
ls -ld mydir

drwx------ 2 u0_a123 u0_a123 4096 Jan 20 10:20 mydir

The -d flag on ls shows the directory entry itself rather than its contents. Mode 700 gives you full access. Group and others get nothing.

Step 7: Change the owner with chown

chown changes which user and group own a file. You give it a user, a colon, and a group. This is a root-only operation, so on a stock phone it fails.

chown root:root notes.txt
ls -l notes.txt

-rw------- 1 root root 220 Jan 20 10:15 notes.txt

Step 8: Understand the world-writable risk

The last group is others, which means every other user and every other app on the device. Give others write permission and anything on the phone can replace the file's contents. Mode 666 is the classic mistake.

chmod 666 notes.txt
ls -l notes.txt

-rw-rw-rw- 1 u0_a123 u0_a123 220 Jan 20 10:15 notes.txt

Every account can now edit notes.txt. Mode 777 is worse, because it also grants execute. A world-writable file in a directory on your path lets an attacker replace a command with their own and have you run it.

Quick reference

Command	What it does
ls -l	List files with the ten-character mode string
ls -ld DIR	Show the mode of a directory itself
chmod 600 FILE	Give the owner read and write only
chmod 755 FILE	Owner read, write and execute; others read and execute
chmod 666 FILE	Make a file world-writable (risky)
chmod +x FILE	Add execute permission
chmod -R MODE DIR	Apply a mode to a directory and everything inside
chown USER:GROUP FILE	Change the owner and group (needs root)

Next steps

• File permissions challenge: world-writable to hunt down unsafe modes on your own files.
• Pipes and redirection to move command output around before you lock files down.
• Managing packages to see where the system stores its own files and how their modes differ.