YanoSec
Progress0 of 152 lessons complete

Course / 03 Command line / Lesson 08 of 19

Owner, group, and chown

Estimated time: 15 min reading · 15 min activity

The same permission letters can allow one person to edit a report and another only to read it. The owner and owning group columns connect those letters to identities. Reading the mode without those relationships leaves the access question incomplete.

The owner is the user identity that owns a file. The owning group is the file's assigned group. A user can belong to several groups without becoming the owner. chmod changes permission bits; chown requests a change in ownership, subject to privilege rules.

Before you begin

Estimated time
15 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Use Bash in your owned Ubuntu practice environment as an ordinary user. The supplied text files use UTF-8, a text encoding; where shown, LC_ALL=C requests consistent text ordering. Work only under your own new ~/yanosec-lab directory, never a host share or personal/system file. Refuse an existing exercise destination rather than overwriting it. No account, paid platform, or remote target is required. Optional extensions take about 10–15 minutes and are not part of the time above. A virtual machine is optional. You can also finish the reasoning from the printed evidence.
Without a lab
The page supplies the files, source and text records needed for the activity. Without a shell, follow the numbered steps on paper, label each result as predicted, and use the separate evidence supplied by the question. Running commands can wait until your lab is available. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, such as HTTPS; saving a correct result also needs usable browser storage. Missing tools, managed or mobile hosts, or a deferred guest setup never require buying a service. Keep owned lab files for review; do not use broad deletion.

After this lesson you can:

  • Identify the owner and owning group in a labeled listing.
  • Apply the correct class to a stated actor.
  • Explain chmod versus chown without making a privileged ownership change.

01Example

Read this fictional abbreviated listing from left to right. Labels identify the owner and owning group before you apply the mode. It omits extra ls -l columns such as size and time; it is not a literal terminal result.

mode       | owner | owning group | filename
-rw-r----- | desk  | club         | note.txt

Owner desk: read/write
Non-owner club member: read
Others: no ordinary rights

Assume ordinary mode checks and accessible parent directories.

02Do not confuse membership and file association

The worked listing labels four columns so you can read the relationship directly. A real ls -l listing also includes a link count, file size and time information. Those extra fields do not change the owner-before-group order, but they make guessing from word position unreliable without understanding the format.

For a fresh paper case, read: -rw-r----- | mila | tutors | schedule.txt. Mila uses the owner rights. A non-owner member of tutors uses the group rights. Someone in neither class uses others. The filename describes a file, not another identity.

Changing rights and changing ownership solve different problems. chmod can change what a class is allowed to do; chown can change which user or group is associated with the file. Neither operation should be used merely to interpret a listing.

The form chown user:group file names a requested owner and group separated by a colon. It is explanatory syntax here. Ordinary users cannot freely assign arbitrary owners, and group changes have restrictions. Do not run it with fictional names or create accounts for this activity.

The fixed desk / club / note.txt row selects exactly one class per actor: owner rw-, non-owner club member r--, other ---.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Immutable source: -rw-r----- · owner desk · group club

Ordinary-file assumptions: accessible ancestors, no ACL and no root or privilege override. No chmod is performed.

Result model

Selected result model: Worked desk / club / note.txt row

[ − ]Type onlyordinary file; excluded
Ownerrw-4 + 2 + 0 = 6
Groupr--4 + 0 + 0 = 4
Others---0 + 0 + 0 = 0
Select exactly one applicable actor class

Owner: read allowed; write allowed; execute absent. Only this class applies.

Owner classification takes precedence even when the owner also belongs to the group. Rights never accumulate across columns.

Owner desk selects rw- even if also a group member; rights are not added across classes.

Follow the explanation

  1. Owner desk selects rw- even if also a group member; rights are not added across classes.
  2. A non-owner club member selects r-- only.
  3. An unrelated user selects ---; ordinary mode checks and accessible parent directories are assumed.

Both complete ordinary-file models

Worked desk / club / note.txt row
-rw-r----- · first dash excluded from totals
ClassTripletWeightsDigit
Ownerrw-4 + 2 + 0 = 66
Groupr--4 + 0 + 0 = 44
Others---0 + 0 + 0 = 00

In 640 the non-owner group member can read and cannot write. In the separate 620 model that class can write and has no read permission. The owner stays 6 and others stay 0.

The type dash contributes no digit. Choose one class: owner first, otherwise group member, otherwise other. No ACL, inaccessible ancestor or privilege override is modeled. Directory entry removal and special bits are outside this ordinary-file model.

The fixed desk / club / note.txt row selects exactly one class per actor: owner rw-, non-owner club member r--, other ---.

03Try the labeled rows

First use the fresh mila/tutors example above to practice reading columns. The worksheet retains separate reference and question rows; leave those unsolved until you reach the question. Use mila/tutors for the guided steps.

The numbered steps use printed analysis. If you kept the note from the previous lesson, an optional ls -l can compare the column layout with a real owned file. You need no ownership change, extra account or administrative command. Stop with a written explanation.

Connect permission classes to identities

Fresh paper row:
-rw-r----- | mila | tutors | schedule.txt
Identify the owner and group before applying the bits. A non-owner
tutors member uses group rights, not the owner triplet. Compare your
reasoning with the separate labeled rows below.

Not literal ls -l output.
Columns: mode | owner | owning group | filename
Worked: -rw-r----- | desk | club | note.txt
Reference row: -rw------- | reviewer | editors | draft.txt
Separate question evidence: -rw-r----- | analyst | learners | report.txt
Question: -rw-r----- analyst learners report.txt
Which name is the owning group? Use one word.
chmod changes mode bits; chown changes ownership subject to privileges.
No live ownership change is requested for this stage.

Download the ownership rows and question case

  1. Use only the fresh mila/tutors/schedule.txt row for these steps. Identify mila as owner and tutors as owning group. The filename identifies the file rather than another user.
  2. For a non-owner member of tutors, read the middle permission triplet. It gives read without write. Compare this with owner mila, whose first triplet gives read/write.
  3. Explain which kind of change would alter permission bits and which would alter ownership. Expected: chmod for mode, chown for ownership, both subject to actual rights.
  4. If using the guest, inspect ls -l ~/yanosec-lab/rights/permission-note.txt only if that is your actual retained activity path. Record varying columns privately. If missing, use the complete labeled card rather than creating privileged ownership changes.
  5. Stop with the note. Nothing is changed; no ownership reset is necessary.

04Optional challenge

Allow about ten extra minutes. On paper, transfer a report from analyst to reviewer through an approved administrative action while leaving its mode unchanged. Explain why that change can make a different permission class apply to each person. Do not run chown with these fictional accounts.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Ownership card A: fictional abbreviated listingOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Columns: mode | owner | owning group | filename
-r--rw---- | lina | writers | outline.txt
Lina owns this file and also belongs to writers.
Oren belongs to writers and does not own the file.
Teo is neither the owner nor a member of writers.
Consider writing the file contents, not deleting its name.
Assume ordinary mode checks, accessible parent directories, no ACLs,
no privilege overrides and no other restrictions.

Ownership card B: independent requested changesOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Request M: keep the current owner and group; add owner write permission.
Request N: keep the permission bits; assign the file to a different owner.
Request P: inspect the displayed owner, group and mode without changing them.
Classify the kind of command that requests each change.
These are paper requests, not instructions to change real ownership.

Ownership card C: optional approved transfer on paperOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Before: -rw-r----- | vera | readers | agenda.txt
Vera and Zed both belong to readers; nobody else is involved.
Approved change: owner becomes Zed. Group and mode stay unchanged.
Afterward Vera no longer owns the file. Zed now owns it.
Nox is neither the owner nor a member of readers, before or after the transfer.
Assume ordinary mode checks and accessible parents, without ACLs or overrides.

06Explain ownership and access

Optional self-check: explain why changing a file owner can change a person's access even when its mode stays the same.

Check your explanation: identify the owner and owning group separately; assign one class per actor; connect the required operation to its permission bit; distinguish chown from chmod; keep the ordinary-mode assumptions beside your conclusion.

07Common mistakes

If owner and group are swapped, locate the labeled case columns. A real ls -l has additional columns; use its manual before treating arbitrary words as owner/group.

If a user is in learners, do not grant the owner triplet unless that user also owns the file. Match identity before decoding rights.

If a guessed chown command is denied or references nonexistent accounts, stop. Fictional names are analysis labels; no account creation or privileged ownership fix belongs in this activity.

References

  • Ubuntu 24.04 packaged manual: chown(1)

    Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.

  • Ubuntu 24.04 packaged manual: ls(1)

    Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.