Course: From Basic Science to Web Hosting

Module 04 — Linux Fundamentals

Linux Users, Groups, Ownership & Permissions

Difficulty: Beginner → Intermediate
Prerequisites: Lesson 017 — Linux Filesystem
Estimated time: 35–40 minutes

---

1. The Big Question

You have seen commands such as:

sudo -u www-data wp core download --allow-root

and you have worked with directories such as:

/storage/websites/templates.cresignsys.com/public/

A fundamental question is:

Who is allowed to read, modify, or execute these files?

Linux answers this using:

Users
Groups
Ownership
Permissions

These four concepts are essential for secure web hosting.

---

2. Why Permissions Exist

Imagine every program could modify every file.

A compromised website could potentially modify:

/etc/

or:

/root/

or another customer’s website.

That would be dangerous.

Linux therefore follows a basic principle:

Program
   ↓
Request access
   ↓
Kernel checks permissions
   ↓
Allow / deny

---

3. Users

A Linux system can have many users.

For example:

root
ubuntu
www-data

Each user has an identity recognized by the operating system.

The identity is represented internally by a:

UID

UID means:

User ID

For example:

root
 ↓
UID 0

The exact UID values of other users depend on the system.

---

4. Root User

root is the traditional privileged Linux user.

Its UID is:

0

Root can perform operations that ordinary users cannot.

For example:

sudo systemctl restart nginx

may execute the service-management operation with elevated privileges.

---

5. Normal User

Your login account might be something such as:

ubuntu

It normally does not have unrestricted access to the entire system.

When it needs administrative privileges, it can use:

sudo

if authorized.

---

6. What Is www-data?

On Ubuntu/Debian systems, web-server software commonly uses a restricted service account such as:

www-data

The exact service user depends on configuration.

For example:

Nginx
 ↓
www-data

or PHP-FPM workers may run as:

www-data

The purpose is security.

If a web application is compromised, restricting it to a low-privilege account can reduce the damage it can cause.

---

7. User vs Process

A user is an identity.

A process is a running program.

For example:

User:
www-data

Process:
php-fpm worker

The process runs with a user identity.

Conceptually:

PHP-FPM process
      ↓
runs as
      ↓
www-data

The Linux kernel uses that identity when checking access to resources.

---

8. Groups

Linux also has groups.

A group is a collection of users.

For example:

developers
webadmins
www-data

A user can belong to one or more groups.

Conceptually:

Users
 │
 ├── ubuntu
 ├── admin
 └── developer

Group
 │
 └── webadmins

Groups make permission management easier.

---

9. Group ID

Like users, groups have numerical identifiers.

This is called:

GID

meaning:

Group ID

The system internally uses UIDs and GIDs rather than relying only on names.

---

10. File Ownership

Every ordinary Linux file has ownership information.

At a basic level:

File
 ├── Owner
 └── Group

For example:

index.php
Owner: www-data
Group: www-data

---

11. View Ownership

Use:

ls -l

Example:

-rw-r--r-- 1 www-data www-data 1234 index.php

The important part is:

www-data www-data

which represents:

Owner = www-data
Group = www-data

---

12. Understanding ls -l

Consider:

-rw-r--r-- 1 www-data www-data 1234 index.php

Break it down:

-rw-r--r--
│
├── file type
│
├── owner permissions
├── group permissions
└── other permissions

The first character:

-

means it is a regular file.

A directory usually begins with:

d

For example:

drwxr-xr-x

---

13. Three Permission Categories

Linux traditionally evaluates three basic permission classes:

Owner
Group
Others

For example:

-rwxr-x---

can be separated into:

Owner  → rwx
Group  → r-x
Others → ---

---

14. Three Basic Permissions

The three basic permissions are:

r
w
x

They mean:

r = read
w = write
x = execute

---

15. Read Permission

For a regular file:

r

generally means the process can read the file’s contents.

For example:

cat index.php

requires appropriate read permission.

---

16. Write Permission

For a regular file:

w

means the process can modify the file contents, subject to other filesystem/security mechanisms.

For example:

nano test.txt

requires write access to save modifications.

---

17. Execute Permission

For a regular file:

x

allows it to be executed as a program/script when the other requirements for execution are satisfied.

For example:

./script.sh

requires execute permission on the script.

But for directories, x has a different meaning.

---

18. Execute Permission on Directories

This is extremely important.

For a directory:

x

generally means:

You can traverse/search the directory.

So directory permissions behave differently from file permissions.

---

19. Directory Read vs Execute

Suppose:

drwxr-x---

For a directory:

r

allows listing directory entries, subject to other permissions.

x

allows traversal/search.

Therefore:

Read directory

and:

Enter/traverse directory

are not exactly the same permission.

---

20. Example

Suppose:

/storage/websites/

has:

drwxr-x---

A user may be able to traverse the directory but not necessarily list its contents, depending on the exact permission combination and ownership/group membership.

This distinction becomes important when securing hosting directories.

---

21. Permission Numbers

Linux permissions can also be represented numerically.

The basic mapping is:

r = 4
w = 2
x = 1

Add them together.

---

22. Examples

Read only:

r--

means:

4

Write only:

-w-

means:

2

Execute only:

--x

means:

1

Read + write:

rw-

means:

4 + 2 = 6

Read + execute:

r-x

means:

4 + 1 = 5

Read + write + execute:

rwx

means:

4 + 2 + 1 = 7

---

23. Three Permission Numbers

Consider:

755

Separate it:

7 5 5

Meaning:

Owner → 7
Group → 5
Others → 5

And:

7 = rwx
5 = r-x
5 = r-x

Therefore:

755
=
rwxr-xr-x

---

24. Another Example: 644

644

means:

Owner → 6 = rw-
Group → 4 = r--
Others → 4 = r--

So:

644
=
rw-r--r--

This is commonly used for ordinary web files, depending on the hosting architecture.

---

25. chmod

The command used to change permissions is:

chmod

For example:

chmod 644 index.php

This sets:

Owner → read/write
Group → read
Others → read

---

26. chmod 755

For a directory:

chmod 755 public

means:

Owner → rwx
Group → r-x
Others → r-x

This is a common directory permission pattern.

But:

Do not blindly apply 755 or 777 everywhere.

Permissions should reflect what the service actually needs.

---

27. chmod 777

You may see:

chmod 777

This gives:

Owner  → rwx
Group  → rwx
Others → rwx

This is often overly permissive.

For a web server, it can create serious security problems.

Avoid using 777 as a generic solution to permission errors.

---

28. Ownership: chown

The command:

chown

means:

change owner

Example:

sudo chown www-data index.php

changes the owner to:

www-data

---

29. Owner + Group

You can specify both:

sudo chown www-data:www-data index.php

Meaning:

Owner = www-data
Group = www-data

---

30. Recursive Ownership

You can apply ownership to a directory and its contents:

sudo chown -R www-data:www-data /storage/websites/example.com/

The -R means:

recursive

But use recursive ownership changes carefully.

A mistake can affect thousands of files.

---

31. chgrp

The command:

chgrp

changes the group ownership.

Example:

sudo chgrp www-data index.php

Now:

Group = www-data

---

32. Why Ownership Matters for WordPress

Suppose WordPress wants to modify:

wp-content/

The PHP-FPM process might be running as:

www-data

Linux checks:

Who is requesting access?
        ↓
www-data
        ↓
Who owns the file?
        ↓
What are the permissions?

Then the kernel decides whether access is allowed.

---

33. The Permission Decision

Conceptually:

PHP-FPM
   ↓
www-data
   ↓
requests write access
   ↓
Linux kernel
   ↓
Check file owner/group/permissions
   ↓
ALLOW or DENY

This is why permissions matter so much in WordPress hosting.

---

34. Why Nginx Can Read a File

Suppose:

index.php

has:

-rw-r--r--

and is owned by:

ubuntu

The owner has:

rw-

Group:

r--

Others:

r--

If Nginx/PHP runs as an account that falls under “others”, it can read the file but cannot modify it.

---

35. Why WordPress May Not Be Able to Write

Suppose:

wp-content/

doesn’t provide write access to the PHP process’s identity.

WordPress might fail to:

Upload media
Install plugin
Update plugin
Create cache
Write generated files

The browser might show an error such as:

Unable to create directory

or:

Could not create temporary file

The correct solution is to understand ownership and required permissions—not automatically use chmod 777.

---

36. A Better Hosting Model

A more controlled architecture might be:

Website files
      ↓
Owner: deployment/admin user
Group: web group
      ↓
Nginx/PHP
      ↓
only required access

The exact model depends on your deployment workflow.

The important principle is:

Give each service only the permissions it actually needs.

---

37. The Principle of Least Privilege

This is a major security principle.

Instead of:

Everyone → Everything

use:

Each process
    ↓
Minimum required permissions

For example:

Nginx
 ↓
Read website files

PHP
 ↓
Read application files
 ↓
Write only where necessary

---

38. Why sudo Is Powerful

Suppose normal user:

ubuntu

runs:

sudo systemctl restart nginx

The system temporarily gives the command elevated privileges according to sudo policy.

Conceptually:

ubuntu
 ↓
sudo
 ↓
authorized elevated operation

Without sudo:

systemctl restart nginx

may fail because managing the service requires privileges the normal user doesn’t have.

---

39. sudo Does Not Mean “Make Everything Root Forever”

This is an important distinction.

When you run:

sudo command

you are asking the system to execute that particular command with elevated privileges according to the sudo configuration.

It does not permanently turn your account into root.

---

40. sudo -u

You have used:

sudo -u www-data ...

The -u option specifies another user identity.

For example:

sudo -u www-data whoami

can produce:

www-data

Conceptually:

ubuntu
 ↓
sudo
 ↓
execute as www-data
 ↓
program

---

41. Why This Is Useful for WordPress

Suppose WordPress should operate as:

www-data

You can execute a command as that user:

sudo -u www-data wp ...

This helps test whether the web-service user actually has access to the files.

---

42. --allow-root

You have also seen:

--allow-root

with WP-CLI.

This is a WP-CLI-specific option, not a Linux permission command.

It tells WP-CLI to permit execution as the root user when the command is otherwise being blocked for safety.

This is different from:

sudo

and different from:

chmod

---

43. Three Different Concepts

Keep these separate:

sudo
 ↓
Who executes a command?

chown
 ↓
Who owns a file?

chmod
 ↓
What permissions does the file have?

This simple distinction will prevent many Linux mistakes.

---

44. Practical Example

Suppose:

ls -ld /storage/websites/templates.cresignsys.com/public

returns something like:

drwxr-xr-x  www-data www-data ...

You can interpret it as:

Directory
Owner = www-data
Group = www-data

Owner:
rwx

Group:
r-x

Others:
r-x

---

45. Inspect a File

Use:

ls -l /storage/websites/templates.cresignsys.com/public/index.php

You might see:

-rw-r--r-- www-data www-data ...

Then:

Owner = www-data
Group = www-data

and:

Owner → rw-
Group → r--
Others → r--

---

46. Inspect the Whole Path

There is a subtle problem.

A file may have correct permissions while one of its parent directories prevents traversal.

For example:

/storage
   ↓
/websites
   ↓
/example.com
   ↓
/public
   ↓
index.php

The process needs appropriate traversal permissions on the directory path.

So troubleshooting permissions means checking:

File
+
Parent directories

not just the final file.

---

47. namei

A useful command is:

namei -l /storage/websites/templates.cresignsys.com/public/index.php

It can show the permissions and ownership of each component of the path.

Conceptually:

/
 ↓
storage
 ↓
websites
 ↓
templates.cresignsys.com
 ↓
public
 ↓
index.php

This is extremely useful for diagnosing “Permission denied.”

---

48. Linux Permission Flow

When a process accesses a file:

Process
  ↓
User identity
  ↓
Path traversal
  ↓
Directory permissions
  ↓
File ownership
  ↓
File permissions
  ↓
Kernel decision
  ↓
Allow / deny

This is the foundation.

---

49. Web Hosting Permission Flow

Now apply it to WordPress:

Browser
 ↓
Nginx
 ↓
PHP-FPM
 ↓
WordPress
 ↓
Filesystem request
 ↓
Linux kernel
 ↓
Ownership + permissions
 ↓
ALLOW / DENY

This explains many real hosting problems.

---

50. The Deeper Technology Chain

We can now extend our original chain:

Matter
 ↓
Electrons
 ↓
Electricity
 ↓
Electronics
 ↓
Transistors
 ↓
Digital logic
 ↓
CPU
 ↓
Computer
 ↓
Linux
 ↓
Kernel
 ↓
Filesystem
 ↓
Users
 ↓
Permissions
 ↓
Processes
 ↓
Services
 ↓
Nginx
 ↓
PHP-FPM
 ↓
WordPress
 ↓
Website

---

51. Quick Check

What is a UID?

A numerical identifier for a Linux user.

What is a GID?

A numerical identifier for a Linux group.

What does r mean?

Read.

What does w mean?

Write.

What does x mean?

Execute for files; generally traversal/search for directories.

What does chmod do?

Changes permissions.

What does chown do?

Changes ownership.

What does chgrp do?

Changes group ownership.

What does sudo -u www-data do?

Runs the specified command as www-data, subject to sudo authorization.

Why should you avoid chmod 777 as a generic fix?

Because it gives owner, group, and others read/write/execute permissions and can unnecessarily expose the website to modification.

---

Next Lesson — 019

Linux Processes: What Is Actually Running on Your Server?

We will go deeper into:

Program
 ↓
Process
 ↓
PID
 ↓
Parent process
 ↓
Child process
 ↓
Thread
 ↓
CPU
 ↓
RAM
 ↓
systemd
 ↓
Nginx
 ↓
PHP-FPM
 ↓
MySQL

Then we will use real commands:

ps
top
htop
pgrep
pstree
systemctl

to understand exactly what is running inside your web-hosting server.