Linux permissions: who can read, write and run a file

Every Linux file has an owner, a group and three sets of rwx bits. Reading them is the first skill on any server.

The idea

A permission string like rwxr-xr-- is three groups of three bits: owner, group and everyone else. r = 4, w = 2, x = 1, so each group is one octal digit. The kernel checks only the group that applies to you: owner first, then group, then other.

Code

// What "chmod 754 deploy.sh" means, decoded the way the kernel checks it
static string Decode(string octal)
{
    string who = "";
    foreach (char d in octal)
    {
        int bits = d - '0';
        who += (bits & 4) != 0 ? "r" : "-";
        who += (bits & 2) != 0 ? "w" : "-";
        who += (bits & 1) != 0 ? "x" : "-";
    }
    return who; // owner, group, other
}

Tips

• ls -l shows the mode, owner and group. chmod changes the mode, chown changes the owner, sudo runs one command as root.
• Least privilege: a web server process should own as little as possible and never run as root.
• 777 means anyone on the machine can change the file. In an interview, saying why 777 is dangerous earns more than the command itself.
• Other commands worth knowing: ps and top (processes), ss (open ports), grep and journalctl (logs), curl (talk HTTP from the shell).

In the .NET library

On Linux, ASP.NET Core apps usually run as a dedicated service user under systemd or in a container with a non-root user, so a bug in the app cannot rewrite system files.