Check User Permissions in Linux: 5 Commands

The fastest way to check user permissions in Linux is the ls -l command, which shows the permission string for every file and directory in your current location. For a deeper look at what a specific user can do, use namei -l /path/to/file to trace permissions across every parent directory, or sudo -l -U username to list the sudo privileges granted to that account. This article covers the essential commands, how to read their output, and how to troubleshoot common permission problems.

Why Permission Checking Matters

Linux is a multi-user operating system, and permissions are the core mechanism that keeps one user from reading, modifying, or executing another user’s files. Every file and directory has an owner, a group, and a set of three permission triads (read, write, execute) that apply to the owner, the group, and everyone else. Misconfigured permissions are a leading cause of “Permission denied” errors, broken web servers, and security vulnerabilities. Knowing how to check permissions quickly is a fundamental skill for system administrators, developers, and anyone who manages a Linux server.

The Core Commands: ls, stat, and namei

The most common way to check permissions is with ls -l. The output looks like this:

-rw-r--r-- 1 alice devs 1024 Mar 12 10:30 report.txt

The first character is the file type (- for regular file, d for directory, l for symlink). The next nine characters are the permissions: rw- for the owner (alice), r-- for the group (devs), and r-- for others. Here, alice can read and write, while the group and others can only read. To see permissions for a specific file without listing the whole directory, use stat -c '%A %a %U %G' filename. The %A shows the symbolic permissions, %a shows the octal value (e.g., 644), and %U and %G show the owner and group.

For directories, permissions work slightly differently: read (r) lets you list the directory’s contents, write (w) lets you create or delete files inside it, and execute (x) lets you enter the directory (cd into it). A directory with rwxr-xr-x allows the owner full access, while the group and others can list and enter but not modify.

When a file is nested inside several directories, ls -l on the file itself doesn’t tell you if you can actually reach it. The namei command solves this: namei -l /home/alice/docs/report.txt shows the permissions of every component from the root down to the file, making it easy to spot a directory that lacks execute permission for your user.

Checking Permissions for a Specific User

The commands above show permissions for the owner, group, and others, but what if you need to know whether a particular user (who isn’t the owner and isn’t in the group) can access a file? You can use sudo -u username test -r /path/to/file to test read access as that user, or sudo -u username test -w /path/to/file for write access. The test command returns no output but exits with status 0 if the test succeeds, and 1 if it fails. To see the result, run echo $? immediately after.

For sudo privileges, sudo -l -U username lists the commands that user is allowed to run with sudo. This is essential for auditing administrative access. If you don’t have sudo rights yourself, you can only see your own privileges with sudo -l.

Using find and getfacl for Advanced Checks

The find command can locate files with specific permission settings. For example, find /var/www -type f -perm -002 finds files that are writable by “others” (world-writable), which is often a security risk. To find files with setuid or setgid bits, use find / -perm -4000 (setuid) or find / -perm -2000 (setgid).

When POSIX ACLs (Access Control Lists) are in use, the standard ls -l output is incomplete. Use getfacl filename to see all ACL entries, including named users and groups. If you see a + sign at the end of the permission string in ls -l, that indicates an ACL is present.

Common Permission Problems and How to Diagnose Them

The classic “Permission denied” error can have several causes. Here is a quick troubleshooting checklist:

• Check the file’s owner and group with ls -l or stat.
• Verify that every parent directory has execute (x) permission for your user. Use namei -l to see the full path.
• If you’re using sudo and still getting denied, check that the file isn’t on a filesystem mounted with noexec or nosuid options (run mount to see).
• Look for ACLs with getfacl; a deny entry can override the traditional permissions.
• Check for immutable attribute with lsattr filename; if the i flag is set, even root cannot modify the file until it’s removed with chattr -i.

How to Change Permissions (Briefly)

While checking is the focus, you’ll often need to fix what you find. The chmod command changes permissions. For example, chmod 755 script.sh sets owner to read/write/execute and group/others to read/execute. The chown command changes the owner and group: chown alice:devs file.txt. Be careful when using recursive flags (-R); they can unintentionally change permissions on many files.

Frequently Asked Questions

What does the number 755 mean in Linux permissions?

The number 755 is the octal representation of the permission bits. The first digit (7) is the owner’s permissions: 4 (read) + 2 (write) + 1 (execute) = 7. The second digit (5) is the group’s permissions: 4 (read) + 1 (execute) = 5. The third digit (5) is the same for others. So 755 means the owner can read, write, and execute; everyone else can read and execute.

How do I check if a user has sudo access?

Run sudo -l -U username (as a user with sudo privileges) to see the list of allowed commands. If you are the user in question, simply run sudo -l and enter your password. The output will show the commands you can run with sudo, or a message that you are not allowed to run sudo.

Why does ls -l show a ‘+’ at the end of the permissions?

The plus sign indicates that the file or directory has an extended Access Control List (ACL). The standard permission string only shows the owner, group, and others, but ACLs can grant permissions to additional specific users or groups. Use getfacl to view the full list of ACL entries.

What is the difference between chmod and chown?

chmod changes the permission bits (read, write, execute) on a file or directory. chown changes the ownership—which user and group own the file. Both are often needed together; for example, to give a file to a new user and make it readable by a group, you’d use chown first, then chmod.

How can I see all files a user can access in a directory?

There’s no single command that lists every file a user can access, because access depends on the permissions of every parent directory and any ACLs. However, you can use find /path -user username to list files owned by that user, and find /path -group groupname to list files owned by a group. For a comprehensive audit, use namei on each file or write a script that tests access with sudo -u username test -r.

Related

• Fix Forza Horizon 3 PC Crashing: Proven Solutions
• Fix WhatsApp Camera Zoomed In Problem
• Fix Laptop Crashing When Watching Videos