Linux Users and Groups Explained: Why File Permissions Need Both

You’ve seen the letters rwx on files. Here is the system behind them and why it was designed this way

Photo by Kedibone Isaac Makhumisane on Unsplash

At some point you run ls -la in your terminal and the output looks like this.

-rw-r--r-- 1 sabit developers 4096 Jun 25 09:14 report.pdf

Most people look at this and understand roughly that some people can read the file and others can’t. But the full picture, what “sabit” and “developers” mean there, why there are two names, and how the permission letters connect to both of them, rarely gets explained clearly anywhere.

Here is exactly how it works.

What a user is in Linux

A user in Linux is any account that can log in and own files. Every file on your system has an owner, and that owner is always a user account.

When you set up Linux and created your account, a user was created for you. Your username might be “sabit” or “john” or whatever you chose. That user account is what the system recognises as you. When you create a file, your username gets stamped on it as the owner.

There’s also a special user called root that owns most system files and has unrestricted access to everything. You’ve already met root every time you’ve used sudo.

You can see your own username anytime.

whoami

You can see every user account that exists on your system.

cat /etc/passwd

Each line is one user. The format is username:x:UID:GID:info:home:shell. The UID is the numeric user ID the system actually uses internally to track ownership, your username is just a human-readable label for it.

What a group is in Linux

A group is a named collection of users. Its only purpose is to let you assign permissions to multiple people at once without setting individual permissions for each person separately.

Every user belongs to at least one group. When your account was created, Linux automatically created a group with the same name as your username and added you to it. That’s your primary group.

You can belong to additional groups on top of that. Being added to the sudo group is what gives a regular user the ability to run sudo commands. Being added to the docker group lets a user run Docker without needing sudo every time. Groups are how Linux manages access to shared resources across multiple users.

See every group you currently belong to.

groups

See every group on the system.

cat /etc/group

Why a file needs both an owner and a group

Look at that ls -la output again.

-rw-r--r-- 1 sabit developers 4096 Jun 25 09:14 report.pdf

The file has two names attached to it. sabit is the user owner. developers is the group owner.

This gives the system three distinct categories of people to assign permissions to.

The user owner, which is sabit in this case. One specific person.

The group owner, which is developers. Every user who belongs to the developers group.

Everyone else. Anyone on the system who is neither the owner nor a member of the developers group.

What rwx actually means across those three categories

The permission string -rw-r--r-- is ten characters. The first is a file type indicator. A dash means regular file. A d would mean directory.

The next nine characters are three groups of three, one group for each category.

rw-   r--   r--
 ↑     ↑     ↑
owner  group  everyone else

Each group of three can contain r, w, x, or a dash.

r means read permission. Can see the contents of the file.

w means write permission. Can modify or delete the file.

x means execute permission. Can run the file as a program or script.

A dash means that permission is not granted for that category.

So -rw-r--r-- means the owner can read and write but not execute. The group can only read. Everyone else can only read.

A file with -rwxr-x--- means the owner can read, write, and execute. The group can read and execute but not write. Everyone else has no permissions at all.

Changing who owns a file

chown changes the user owner or group owner of a file.

sudo chown sabit report.pdf

Changes the user owner to sabit.

sudo chown sabit:developers report.pdf

Changes the user owner to sabit and the group owner to developers in one command. The colon separates the two.

sudo chown :developers report.pdf

Changes only the group owner, leaving the user owner unchanged.

Changing the permissions themselves

chmod changes the permission string on a file.

The symbolic approach is the most readable.

chmod u+x script.sh

Adds execute permission for the user owner. u means user, g means group, o means others, a means all three at once.

chmod g-w report.pdf

Removes write permission from the group.

chmod o+r report.pdf

Adds read permission for everyone else.

The numeric approach uses a three-digit number where each digit represents the permissions for owner, group, and others.

chmod 644 report.pdf

6 is read and write for the owner. 4 is read only for the group. 4 is read only for everyone else. This matches -rw-r--r--.

chmod 755 script.sh

7 is read, write, and execute for the owner. 5 is read and execute for the group. 5 is read and execute for everyone else. The standard permission for executable scripts.

The numbers come from adding the values of each permission. Read is 4. Write is 2. Execute is 1. Add the ones you want. 4+2+1 gives you 7 for full access. 4+0+0 gives you 4 for read only.

Why this system exists

Linux was built from the beginning as a multi-user operating system. Multiple people logged into the same machine was not a special case, it was the default assumption. The user, group, and other permission model was designed to let an administrator control exactly who could do what to each file without having to manage every user individually.

Groups made it practical. Instead of giving fifty developers individual access to a shared project folder, you create one developers group, add them all to it, and set the group permission once. Add a new developer later and you add them to the group. That one change gives them access to every file the group owns.

The same logic applies on a single-user machine, just less visibly. The permission system still protects system files from being modified accidentally, separates your personal files from root-owned system files, and keeps processes running as different users from interfering with each other.

Understanding users and groups doesn’t just explain why ls -la shows two names on every file. It explains why sudo works the way it does, why some commands need elevated permissions and others don't, and why Linux is fundamentally more secure by default than operating systems that didn't build this distinction in from the start.

Thanks for reading! Most people learn Linux commands. Few learn how to think. Every Wednesday in Terminal to AI I share one practical terminal skill and one sharp lesson about information, decisions, and building a life that actually pays. Former smart contract auditor. Learning in public. Free to join. **Terminal to AI →**