Essential commands

Essential commands — read permissions with ls -l, change them with chmod, understand the umask

Mental model: on a shared Linux box the same files are touched by many users and
services, so every file carries an owner, a group, and three classes of access — the
owning user, the group, and everyone else (other). Each class gets three bits: read (r),
write (w), execute (x). ls -l shows you those bits; chmod changes them, either in octal
(one digit per class: read 4 + write 2 + execute 1) or symbolically (edit named bits with
u/g/o and +/-); and the umask is the mask the kernel subtracts from the default when a new
file is born, which is why fresh files aren't world-writable.

1 - Read the bits with a long listing
    ls -l f
      -rw-r--r-- 1 root root 0 Jul  4 22:18 f
    # Read the first field left to right:
    #   -            file type: - is a regular file (d dir, l symlink, ...)
    #   rw-          owner (user) class: read + write, no execute
    #   r--          group class: read only
    #   r--          other class: read only
    # Then: link count (1), owner (root), group (root), size (0), mtime, name (f).

2 - Tighten it with octal
    chmod 640 f
    ls -l f
      -rw-r----- root root f
    # Each octal digit is one class; add 4 (read) + 2 (write) + 1 (execute):
    #   6 = 4+2   -> owner  rw-
    #   4 = 4     -> group  r--
    #   0 =       -> other  ---
    # Result bit-by-bit:  rw- r-- ---   ==  -rw-r-----
    # Other lost its read bit; the file is now owner rw, group read, other nothing.

3 - Edit the same bits by name (symbolic)
    chmod u+x,g-r f
    ls -l f
      -rwx------
    # Symbolic form edits the SAME underlying bits, by name instead of number:
    #   u+x   give the user (owner) execute
    #   g-r   take read away from the group
    # Applied on top of rw-r----- :
    #   owner  rw-  + x  -> rwx
    #   group  r--  - r  -> ---
    #   other  ---       -> ---
    # Result bit-by-bit:  rwx --- ---   ==  -rwx------
    # Full owner access, nothing for group or other.

4 - Why new files aren't wide open — the umask
    umask
      0022
    # The umask is a mask of bits the kernel REMOVES from the base permissions when a
    # file or directory is created. 0022 clears the write bit for group (2) and other (2).
    #   Files  base 666 (rw-rw-rw-)  minus umask 022  ->  644  (rw-r--r--)
    #   Dirs   base 777 (rwxrwxrwx)  minus umask 022  ->  755  (rwxr-xr-x)
    # That's why a freshly created file lands at rw-r--r-- without you running chmod.
    # (The leading 0 is the special-bits field: setuid/setgid/sticky — here unused.)

What each part does
    ls -l            print the type + rwx bits per class + owner + group per file
    -rw-r--r--       type(-) | owner(rw-) | group(r--) | other(r--)
    chmod 640        octal: per-class digit, read 4 + write 2 + execute 1
    chmod u+x,g-r    symbolic: same bits, edited by class (u/g/o) and +/-/=
    umask            the mask subtracted from base perms on every new file

Gotchas
    - Octal is absolute, symbolic is relative. chmod 640 sets all nine bits at once;
      chmod g-r only touches the group read bit and leaves everything else as it was.
    - Read the ten characters in groups of three after the type: positions 2-4 owner,
      5-7 group, 8-10 other. -rw-r----- is NOT owner rw + everyone r; it's owner rw,
      group r, other nothing.
    - execute means different things: on a file it means "runnable"; on a directory it
      means "may enter / traverse it". A directory without x is unreadable in practice.
    - umask does not add permissions, it only removes them — it can never make a new
      file more permissive than its 666/777 base, only less.

Verify
    ls -l f                 # -rw-r--r-- 1 root root ... f   (start state)
    chmod 640 f && ls -l f  # -rw-r-----   octal set owner rw, group r, other ---
    chmod u+x,g-r f         # symbolic: +execute for owner, -read for group
    ls -l f                 # -rwx------   owner rwx, group ---, other ---
    umask                   # 0022         the default-permission mask