Linux · users & permissions

chown

whose file is it

chown changes the owner and group recorded on a file. The permission bits say what the owner, the group and others may do; chown decides who those words refer to. Because giving a file away could be used to dodge quotas and blame, only root may change an owner.

chmod sets the rules for owner, group and others — chown says who the owner and group are.

Changes

Owner and group

written as user:group

Needs root

For the owner

always

Whole tree

-R

recursive

Group only

chgrp

or chown :group

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

root@netflow — bashcoreutils

# chown -v www-data:www-data /var/www/site/index.html

1changed ownership of '/var/www/site/index.html' from root:root to www-data:www-data

2# chown -R deploy: /var/www/site

# ls -ld /var/www/site

3drwxr-xr-x 4 deploy deploy 4096 Sep 30 10:31 /var/www/site

4# chown :www-data /var/www/site/uploads

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

user:group sets both at once

The file was created by root, so the web server could not write to it. -v reports the change that was made.

A trailing colon means "and their own group"

"deploy:" sets the owner to deploy and the group to deploy's login group. -R applies it to everything beneath.

Third and fourth columns are owner and group

ls -l confirms it. The permission bits did not change — only whom they apply to.

A leading colon changes only the group

The owner stays as it is; the group becomes www-data, so the web server can be given write access to just this directory.

Switches

A switch changes how the command behaves. These are the ones used day to day; man chown lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-R: Recursive: change a directory and everything beneath it.
-v: Verbose: print a line for every file processed.
-c: Changes: print a line only for the files that were actually changed.
-h: Change a symbolic link itself, not the file it points to.
--from=OWNER:GROUP: Change only the files currently owned by this user and group.
--reference=FILE: Copy the owner and group from another file.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo chown $USER: file

Takes ownership of a file for yourself and your own group.

sudo chown -R --from=root:root deploy: /srv/app

Changes only the entries currently owned by root, leaving everything else untouched.

sudo chown --reference=a.txt b.txt

Gives one file the same owner and group as another.

id deploy

Shows a user's numeric ID and every group they belong to — worth checking first.

In cybersecurity

Ownership decides who is allowed to change the permissions, so a wrong owner undermines every mode bit set afterwards.

Do not let the server own its code

If the web-server user owns the application files, a flaw in the application can rewrite the application. Give it only its upload and cache directories.

Recursive chown as root

A typo in the path of "chown -R" can re-own system directories and break the machine. Check the path, then run it.

Symbolic links

With -R, a link pointing outside the tree can redirect the change to a file elsewhere. chown does not follow them by default — do not add -L without a reason.

Filed under

Users & permissions

Read alongside

chmodChanges the permission bits on a file or directory — who may read it, write to it, and execute it.sudoRuns a single command as root, or as another user, after checking the caller is permitted to — and logs that it happened.