This is a little embarrassing to ask, but I just set up a ubuntu server with openssh.

Is it possible to create a user that has read-only access to chmod **7 files if that user is not the owner, nor part of the group? In other words files with **7 permissions would appear as **4 when you're logged in as that user but would appear as **7 when you're logged in as other users.

3 Answers 3


The permission mask is defined as: {user, group, other}. So just chmod the file 664? The person who owns the file can read/write it, people in the same group can read/write it, and it's read-only for everyone else.

Otherwise please explain what problem it is that you're trying to solve; I get the sense that you're trying to bake a cake with a hammer.

  • 2
    +1 for bake a cake with a hammer Dec 30, 2011 at 19:57
  • isn't it chmod 664 instead of 662 for read-only access for other users?
    – user784637
    Dec 30, 2011 at 22:03
  • @LedZeppelin you're absolutely right - i must have brain fart'd. updated my comment.
    – MrTuttle
    Jan 3, 2012 at 17:54
  • Ahh that's what I was smelling... and here I thought it was the hammer I had baking in the oven...
    – Red Tux
    Jan 3, 2012 at 18:18

If I understand correctly, you want to set a file **7 but then limit a certain user's permissions to that file to read-only.

This is not possible (with standard shell/linux permissions).

You want to use groups in this case. Give your group full permissions and then make sure that user is not part of the group. Then change the group on the file you are trying to control.

  • It's possible, using two methods, SELinux and ACLs. You can even make it so that only root user cannot view a file with 777 permissions using SELinux.
    – Red Tux
    Jan 3, 2012 at 18:19
  • That's what I meant by standard shell/linux permissions. With ACL/SElinux you can certainly put in some very fine limits. Jan 3, 2012 at 19:33

If you want to have a file which all users but one can access, then make the file world readable (o+r), and then put the user who should not have access to it into a group, put the file into that group and make the file g-r. This would be more useful if files could be in multiple groups. Or look at extended ACLs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.