Changing Ownership

If permissions apply based on a file’s owner and group, how are ownership and the group itself set? The previous lesson’s table was incomplete: the nine bits said who could do what, but the answer to “who” was two numbers sitting in the file’s metadata, and how those numbers change was never explained.

This lesson covers the commands that change those two fields and — more importantly — who can change them. The restriction is not arbitrary; lift it, and the permission model itself becomes meaningless.

Transferring Ownership Requires Privilege

An ordinary user cannot hand off even a file they own:

$ ls -l data/raw/measurement-01.csv
-rw-r--r-- 1 student student 61 Jul 26 19:17 data/raw/measurement-01.csv
$ chown backup data/raw/measurement-01.csv
chown: changing ownership of 'data/raw/measurement-01.csv': Operation not permitted

The restriction has two reasons.

Disk quota. Space used is charged to the file’s owner. If transferring ownership were free, a user hitting their quota could reset it by handing their files off to someone else. Transfer is therefore left to root alone.

Privilege transfer. As will be seen in the special permission bits lesson, a file can be marked to run with its owner’s privileges when executed. If ownership transfer were free, preparing such a file and handing its ownership to a privileged account would be the shortest path to privilege escalation.

The restriction is one-directional: taking a file for yourself and giving it to someone else are both forbidden. The rule reads as “the owner does not change”; the only account that can change it is root.

Changing the Group

The rule for the group is different. A file’s owner can turn its group into any group they are a member of:

$ chgrp project data/raw/measurement-01.csv
$ ls -l data/raw/measurement-01.csv
-rw-r--r-- 1 student project 61 Jul 26 19:17 data/raw/measurement-01.csv

Turning it into a group they are not a member of is forbidden:

$ chgrp backup data/raw/measurement-01.csv
chgrp: changing group of 'data/raw/measurement-01.csv': Operation not permitted

This too is a consistent restriction: a user can only hand off a privilege they already hold. Handing a file to a group they do not belong to would mean granting that group’s members a claim on the user’s own data — or polluting that group’s namespace.

The memberships seen in the groups output in the previous lesson are used directly here: that list determines which groups a user can open their files to.

Two Fields, One Command

chown can take owner and group together; the two fields are separated by a colon.

$ chown student:student data/raw/measurement-01.csv
$ ls -l data/raw/measurement-01.csv
-rw-r--r-- 1 student student 61 Jul 26 19:17 data/raw/measurement-01.csv
$ chown :project data/raw/measurement-01.csv
$ ls -l data/raw/measurement-01.csv
-rw-r--r-- 1 student project 61 Jul 26 19:17 data/raw/measurement-01.csv

Leaving the owner part empty changes only the group; this form is equivalent to chgrp. The first command did not attempt to change the owner — the given value was already the current owner — so it required no privilege.

A numeric ID can be written instead of a name. In environments where name resolution does not work — rescue shells or bare container environments — this is the only option.

There is also a --reference option to match one file’s ownership to another’s; it is specific to the GNU tools and is used to align an entire tree to a sample file.

Opening a Tree to a Group

The project tree is about to be prepared for sharing with a group. The -R option applies the change recursively:

$ chgrp -R project data scripts docs archive
$ ls -l
total 16
drwxr-xr-x 2 student project 4096 Jul 26 19:11 archive
drwxr-xr-x 2 student project 4096 Jul 26 19:03 docs
drwxr-xr-x 2 student project 4096 Jul 26 18:49 scripts
drwxr-xr-x 4 student project 4096 Jul 26 19:08 data
$ ls -l data
total 8
lrwxrwxrwx 1 student project   22 Jul 26 19:08 current.csv -> raw/measurement-03.csv
drwxr-xr-x 2 student project 4096 Jul 26 19:10 raw
drwxr-xr-x 2 student project 4096 Jul 26 19:03 processed

The whole tree now belongs to the project group. But changing the group column alone does not deliver sharing: the group permission bits are still at r-x, meaning group members can read but not write. Write access requires the group bits to be opened too — that the two settings are independent is a commonly overlooked side of the permission model.

Whether newly created files also take on this group is a separate problem and is not solved by chgrp; its solution is in the special permission bits lesson.

Symbolic Links in Recursion

Recursive changes walk the tree, and the tree may contain a symbolic link. If the link’s target lies outside the tree, a “change the tree’s group” command can spill outside it.

The default behavior does not spill — the change applies to the link itself:

$ ls -l /tmp/lt/outside.txt /tmp/lt/dir/link
-rw-r--r-- 1 student student  2 Jul 26 19:23 /tmp/lt/outside.txt
lrwxrwxrwx 1 student student 14 Jul 26 19:23 /tmp/lt/dir/link -> ../outside.txt
$ chgrp -R project /tmp/lt/dir
$ ls -l /tmp/lt/outside.txt /tmp/lt/dir/link
-rw-r--r-- 1 student student  2 Jul 26 19:23 /tmp/lt/outside.txt
lrwxrwxrwx 1 student project  14 Jul 26 19:23 /tmp/lt/dir/link -> ../outside.txt

The link’s group has changed, the target’s has not. The previous lesson said links’ own permission bits are not used; that is why this change here has no practical effect either — what matters is that the target was left untouched.

If following links is explicitly requested, the result changes:

$ chgrp -R -L project /tmp/lt/dir
$ ls -l /tmp/lt/outside.txt /tmp/lt/dir/link
-rw-r--r-- 1 student project  2 Jul 26 19:23 /tmp/lt/outside.txt
lrwxrwxrwx 1 student project 14 Jul 26 19:23 /tmp/lt/dir/link -> ../outside.txt

With -L, the command followed the link and changed the group of the file outside the tree. If a directory writable by someone else exists inside the tree, a link placed there can steer a recursive command toward unintended targets.

The three-option distinction is defined in POSIX, and the rule of thumb is: -P does not follow links and is the default for recursive operations; -L follows every link; -H follows only links given directly on the command line. The general rule for recursive permission and ownership changes is not to change the default.

Without recursion, behavior on a link given directly as an argument is the reverse: the command follows the link and changes the target’s ownership. To target the link itself, the -h option is used.

Verification

Ownership changes are silent; no error means no output. So the result is verified with a separate command. The ls -ld form from the navigation lesson is required here: when a directory’s ownership is asked about, its own line must be read, not its contents.

Whether unexpected ownership remains anywhere in the tree can be tested with find; the criterion options carry the names -user and -group and list files that do not match.

One more verification point is metadata change’s effect on timestamps. Of the three times separated in the navigation lesson, only the last — metadata change time — is updated. Because content modification time is preserved, ls -lt ordering is unaffected.

Summary

• Transferring ownership is open only to root; the restriction prevents abuse of disk quotas and privilege transfer.
• A file’s owner can turn its group only into a group they are a member of.
• chown takes owner and group together separated by a colon; leaving the owner part empty changes only the group.
• Changing the group column does not deliver sharing by itself; the group permission bits must also be opened.
• Symbolic links are not followed by default in recursive changes; with -L they are, and the operation can spill outside the tree.
• An ownership change updates only the metadata change timestamp; content time is preserved.

Next Step

Some operations, like transferring ownership, require root privilege. But logging in and working as root all day means a single typo can affect the whole system. The next lesson covers privilege escalation: what the superuser is, how privilege is delegated temporarily and narrowly, and what the principle of least privilege means in practice.