Linux organizes the entire system under a single hierarchical tree rooted at /. A few top-level directories deserve attention: /etc holds system-wide configuration such as /etc/passwd, /etc/shadow, /etc/group, /etc/fstab, /etc/hosts, /etc/hostname, /etc/resolv.conf, and service-specific files like /etc/ssh/sshd_config; /var stores variable data — logs, spools, caches, and package-manager histories; /home contains per-user home directories; /usr contains the bulk of user-land programs and read-only data; /tmp holds short-lived temporary files and is often wiped at reboot; /proc is a virtual filesystem exposing kernel data structures such as /proc/cpuinfo, /proc/meminfo, /proc/loadavg, and the per-process directory /proc/[PID]; and /dev exposes device files representing block and character devices. Understanding these conventions is essential because nearly every administration task — finding logs, tweaking behavior, or diagnosing a misbehaving service — starts by navigating this layout.
Every file and directory carries three permission sets — owner, group, and others — each expressed as read (r = 4), write (w = 2), and execute (x = 1). The chmod command adjusts them either numerically (e.g., chmod 755 file yielding rwxr-xr-x) or symbolically with letters u/g/o/a for who, +/-/= for the action, and r/w/x for the right, so chmod u+x script.sh makes a script runnable by its owner. The default permissions for newly created files and directories come from umask, which subtracts bits from the maximum (666 for files, 777 for directories); an umask of 022 produces 644 on new files and 755 on new directories, while 077 tightens that to 600 and 700. Persistence is achieved by exporting the umask in ~/.bashrc or the global /etc/profile, and viewing it with umask or umask -S for symbolic output.
Three special permission bits extend the basic model. The SUID bit, set numerically as 4xxx (e.g., chmod 4755 file), causes a program to execute with the file owner's privileges, visible in ls as an s in the owner's execute slot — this is what allows utilities like passwd to write to protected files while running as a normal user. The SGID bit (2xxx) does the same for the group and, when applied to a directory, makes new files inherit the directory's group, which simplifies collaborative folders. The sticky bit (1xxx), often seen as a t on world-writable directories such as /tmp (configured as 1777), ensures only the file's owner (or root) can rename or delete their own files inside it. Ownership itself is managed by chown, which can set user, group, or both simultaneously (chown user:group file, with a leading colon to change only the group), recursively via -R, while chgrp changes group only and is the only ownership command regular users may run on files they do not own. Only root can change the user owner of a file.
When owner/group/other granularity is not enough, POSIX ACLs add per-user and per-group entries. Enabled at mount time via mount -o acl (often the default for ext4), ACLs are inspected with getfacl and modified with setfacl: setfacl -m u:alice:rw file grants alice read and write, -m g:dev:rwx dir/ grants the group full directory access, -d -m u:alice:r dir/ sets a default ACL inherited by newly created files inside, while -x removes a specific entry and -b clears the entire ACL. As soon as any ACL is in place, ls -l appends a + after the mode string to flag it. The chmod symbolic notation is also worth restating: combinations like chmod go-w file (remove write from group and others) or chmod a=r file (read-only for everyone) cover most recurring cases without arithmetic.