ExamFinch.com My Study

Study guide

5.1 List, Set, and Change Standard ugo/rwx Permissions

Practice this exam

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

5.1 List, Set, and Change Standard ugo/rwx Permissions

Key Takeaways Explain This Topic AI

ls -l shows type, ugo/rwx mode, link count, owner, group, size, timestamp, and name—read that line before every ownership or mode change.

chmod accepts symbolic mode (u/g/o/a with +-= and rwxXst) and octal mode (for example 755, 640); both are valid on RHEL and appear on RHCSA tasks.

chown user:group path changes owner and group; chgrp group path changes only the group—use absolute paths and verify with ls -l afterward.

Directories need execute (x) to be entered or traversed; files need execute to run as programs—missing directory x is a classic “permission denied” trap.

Special bits SUID, SGID, and sticky appear in the same rwx slots (s/S/t/T); treat them as an extension of mode reading now—full security policy comes later.

Last updated: August 2026

Standard ugo/rwx permissions are a daily RHCSA skill. On Red Hat Enterprise Linux, every file and directory has an owner user, an owner group, and a mode that grants or denies read (r) , write (w) , and execute (x) to the user (u) , group (g) , and other (o) classes. EX200 tasks may ask you to create shared directories, lock down configuration files, or fix “permission denied” after a copy as root. Modes and ownership you set on disk persist across reboot —there is no separate “enable” step for ordinary permissions.

Why Permissions Matter on the Exam

Performance scenarios commonly include:

  • A project directory that only members of a named group may write
  • A script that must be executable by its owner but not world-writable
  • A config under /etc or an application tree that must be owned by a service account
  • Diagnosing why a user can list a directory but not cd into it (missing directory execute)

SELinux contexts and umask defaults appear under security objectives later. This section focuses on classic discretionary access control : list with ls -l , change mode with chmod , change owner/group with chown / chgrp .

  • Reading ls -l Output
  • Long listing is your primary verification tool: ls -l /path/to/file
  • ls -ld /path/to/directory # directory itself, not its contents

ls -la # include hidden names starting with .

  • stat /path/to/file # detailed mode, uid/gid numbers, timestamps
  • Example line: -rw-r--r--. 1 student developers 4096 Aug 5 10:00 report.txt
  • drwxr-x---. 2 root admins 6 Aug 5 09:30 shared
  • lrwxrwxrwx. 1 root root 11 Aug 5 08:00 link -> /etc/hosts
  • Field (left → right) Meaning
  • First character Type: - regular file, d directory, l symlink, c / b device, s socket, p pipe
  • Next nine characters Mode: user rwx, group rwx, other rwx

Optional trailing . or + SELinux indicator ( . ) or alternate access method such as ACL ( + )—note presence; deep ACL/SELinux work is elsewhere

  • Link count Hard links to this inode
  • Owner name User who owns the object
  • Group name Owning group
  • Size Bytes for files; often size of directory metadata for dirs
  • Timestamp mtime by default
  • Name Basename; symlinks show name -> target
  • Meaning of r, w, and x
  • Bit On a regular file On a directory
  • r Open/read file contents List directory entries ( ls )
  • w Modify/truncate file (if dir allows) Create, delete, rename entries in that directory
  • x Execute as program/script (with interpreter rules) Search/traverse: cd into it and access names by path

Exam trap: Directory write controls creating and deleting names inside the directory, not merely editing an existing file’s contents. File write controls content. Directory execute is required to use a path component even if you know the exact filename—without x on each directory in the path, access fails with “Permission denied.”

Who matches which class?

Kernel checks, in order:

If the process effective UID matches the file owner → use the user (owner) rwx triad.

Else if any process group matches the file group → use the group triad.

Else → use other .

There is no “union” of group and other for the same process. Owner bits apply exclusively when UIDs match—even if group bits are wider. That surprises people who expect group write while owning the file with mode --- on user.

chmod: Symbolic Mode

chmod changes the mode. Symbolic form is precise and readable: chmod WhoWhatWhich file...

Who: u user, g group, o other, a all (ugo). Multiple letters allowed: ug .

What: + add, - remove, = set exactly (clears unspecified bits in that class).

Which: r , w , x ; also X (conditional execute—set x on dirs or already-executable files), and special s / t (light touch below).

  • Examples: chmod u+x script.sh # owner may execute
  • chmod go-w secrets.conf # remove write from group and other
  • chmod u=rw,g=r,o= report.txt # owner rw, group r, other nothing
  • chmod a+r README # everyone read
  • chmod g+w,o-rwx /projects/app # group write; strip other entirely
  • chmod -R g+X /srv/data # recursive: add group execute only where X applies

Multiple clauses can be comma-separated. Recursive -R walks trees—use carefully on system directories.

chmod: Octal (Numeric) Mode

Each triad is a 3-bit number: r=4 , w=2 , x=1 . Sum per class:

  • Octal digit Bits Symbolic
  • 0 --- none
  • 1 --x execute
  • 2 -w- write
  • 3 -wx write+execute
  • 4 r-- read
  • 5 r-x read+execute
  • 6 rw- read+write
  • 7 rwx all
  • Three digits set user, group, other : chmod 755 /usr/local/bin/tool # rwxr-xr-x
  • chmod 640 /etc/myapp/app.conf # rw-r-----
  • chmod 700 ~/.ssh # rwx------ (typical private dir)
  • chmod 600 ~/.ssh/id_ed25519 # rw------- (typical private key)
  • chmod 644 /var/www/html/index.html # rw-r--r--

A leading fourth digit sets special bits (for example 4755 for SUID + 755 ). For this objective, master three-digit modes first; recognize four-digit forms when you see them in stat or documentation.

When to prefer which form: Octal is fast for absolute policy (“make this 640”). Symbolic is safer for relative tweaks (“add group write without touching other bits”). Both appear in real admin work and exam write-ups.

Default Modes and umask (Preview)

New files are not always 666 and directories 777 on disk: the process umask clears bits from the creation mask. Typical interactive umask 022 yields files 644 and directories 755 . Managing default umask is a later security objective; for now, after touch or mkdir , verify with ls -l and adjust with chmod when the task specifies an exact mode.

  • chown and chgrp
  • chown chown user file
  • chown user:group file
  • chown user: file # user and that user's primary group (syntax variant)
  • chown :group file # group only (same idea as chgrp)
  • chown -R user:group /path # recursive tree

Only root (or a process with sufficient capability) can change ownership to another user in normal configurations. Ordinary users cannot “give away” files to others on modern Linux the way some legacy systems allowed.

  • Examples: sudo chown student:developers /home/student/project
  • sudo chown -R apache:apache /var/www/html
  • sudo chown root:root /etc/myapp/config
  • chgrp chgrp developers shared-dir
  • chgrp -R developers /srv/project

A file’s owner may change the group to a group they belong to (subject to policy); changing to an arbitrary group usually requires privilege. Prefer explicit chown user:group when both must change in one step.

  • Always re-list: ls -ld /srv/project
  • namei -l /srv/project/file.txt # optional: walk path permissions
  • Special Bits: Light Overview (SUID, SGID, Sticky)

The same nine mode slots can show s , S , t , or T instead of plain x when special bits are set. Full security design is later; RHCSA candidates must read them so ls -l never confuses you.

Bit Typical effect ls -l hint

SUID on executable file Process may run with file owner’s privileges rws or rwS in user execute slot ( s = SUID+x, S = SUID without x)

  • SGID on executable Process may run with file group’s privileges s / S in group execute slot
  • SGID on directory New files often inherit the directory’s group same group-slot notation on the directory

Sticky on directory Users with write on the dir may delete/rename only their own files (classic /tmp ) t / T in other execute slot ls -ld /tmp

# drwxrwxrwt. ... /tmp ← sticky bit (t) on other

  • ls -l /usr/bin/passwd
  • # -rwsr-xr-x. ... passwd ← SUID (s) on user execute

Symbolic special forms exist ( chmod u+s , g+s , +t ); octal uses the high digit ( 4 SUID, 2 SGID, 1 sticky). Do not set SUID/SGID casually on exam systems unless the task requires it—misuse is a security problem. For this chapter, interpret special bits when listing, and keep standard rwx changes correct.

  • Practical Exam Workflows
  • Lock down a config file
  • Requirement: owned by root, group root, mode 640 . sudo chown root:root /etc/myapp/app.conf
  • sudo chmod 640 /etc/myapp/app.conf
  • ls -l /etc/myapp/app.conf
  • Shared group directory (standard bits only)

Requirement: /projects/team owned by root:developers , mode 2775 appears in many real designs (SGID); if the task only says “group developers may rwx, others none,” start with ownership and 770 / 2770 as specified: sudo mkdir -p /projects/team

  • sudo chown root:developers /projects/team
  • sudo chmod 770 /projects/team
  • ls -ld /projects/team

If the grader later expects setgid collaboration, you will add g+s under security/shared-directory practice—here, nail ugo and ownership first.

  • Fix “cannot cd”
  • User can ls /data sometimes but fails deeper: namei -l /data/app/bin/tool
  • # Ensure each directory component has x for that user’s class
  • sudo chmod o+x /data /data/app # only if policy should allow other traverse

Prefer least privilege: grant group execute to the right group rather than world x when the task names a group.

  • Script must run chmod u+x ~/bin/backup.sh
  • # or: chmod 755 ~/bin/backup.sh
  • ls -l ~/bin/backup.sh

Shebang scripts still need read permission for the interpreter to read the text; execute alone is not always enough for scripts.

  • Common Pitfalls
  • Using chmod 777 as a blunt fix—works briefly, fails security-minded grading and real policy
  • Changing a file’s mode but leaving parent directories without traverse ( x ) for the user
  • Running as root, creating files under a user home, forgetting chown user:user
  • Confusing octal digit order (user-group-other) or mixing up 644 vs 664
  • Applying chmod -R from / or /etc by path typo—always check pwd and path
  • Misreading s / t as ordinary execute when diagnosing setuid programs or /tmp
  • Assuming group write helps the owner when owner triad is ---
  • RHEL 10 and Persistence Notes

Permission and ownership live in the filesystem inode metadata. After chmod / chown , a reboot keeps the settings. No systemctl enable is involved. If a task also involves a service reading the file, you may still need to restart that service for the application to reopen the path—but the mode itself is already durable.

Coreutils on RHEL provide GNU chmod , chown , chgrp , and ls . Prefer portable flags you will remember under stress: ls -l , ls -ld , chmod 640 , chown user:group .

Section Checkpoint

You should be able to decode any ls -l mode line, explain r/w/x on files versus directories, set exact modes with symbolic and octal chmod , change owner and group safely, verify every change, and recognize SUID/SGID/sticky notation without freezing. Those skills underpin later diagnose-and-correct permission objectives and shared multiuser directory designs.