Which User Can Override File Permissions On A Linux Computer

You're staring at a "Permission denied" error. Again. The script won't run, the config file won't save, the log directory stays stubbornly empty. Even so, you've checked the ownership. You've checked the group. You've even tried chmod 777 in a moment of desperation (don't worry, we've all been there).

So who actually* gets the final say on a Linux filesystem? The short answer is root. The longer answer — the one that saves you hours of debugging — is more interesting.

What "Override" Actually Means Here

Before we get into specific users, let's be precise about what we're talking about. "Overriding file permissions" isn't a single superpower. It breaks down into a few distinct abilities:

• Reading a file you don't have read access to
• Writing to a file you don't have write access to
• Executing a file you don't have execute access to
• Changing the permission bits themselves (chmod)
• Changing the owner or group (chown, chgrp)
• Traversing a directory you don't have execute permission on

Different users — or more accurately, different contexts* — can do different subsets of these. The root user can do all of them. A file owner can do some. Practically speaking, a process with a specific capability can do others. And then there are the edge cases that trip people up constantly.

The Root User: Full Override, Always

This is the one everyone knows. The user with UID 0 — traditionally named root — bypasses all standard permission checks. Read, write, execute, traverse, change ownership, change mode, delete immutable files (with a caveat we'll get to). The kernel simply skips the permission logic for UID 0.

But here's what matters in practice: you should almost never be logged in as root directly.

Modern Linux distributions disable root login by default for good reason. conf, your shell forks, the sudobinary checks/etc/sudoers(or/etc/sudoers.Your shell? The editor process runs as root. That's why when you run sudo vim /etc/nginx/nginx. Instead, you use sudo to temporarily elevate a specific command. d/), verifies your user is allowed, and then executes vim as UID 0. Still your regular user.

This distinction matters. txt, the redirection happens in your* shell — before sudo even runs. txt or sudo sh -c 'echo "test" > /root/test.You need echo "test" | sudo tee /root/test.That's why that command fails. If you run sudo echo "test" > /root/test.Practically speaking, the echoruns as root, but the> happens as you. txt'.

The sudoers File: Who Gets Root Powers

Not every user can use sudo. The /etc/sudoers file (edited safely with visudo) controls this. A typical entry looks like:

%wheel  ALL=(ALL:ALL) ALL

This means: any user in the wheel group can run any command as any user on any host. Other common groups: sudo (Debian/Ubuntu), admin (some older systems). You can also grant specific commands only:

deploy  ALL=(www-data) NOPASSWD: /usr/bin/systemctl reload nginx

The deploy user can reload nginx as the www-data user without a password. Nothing else. This is the principle of least privilege — and it's how you avoid giving everyone full root override.

The File Owner: Partial Override

Here's where people get confused. The owner* of a file (the user shown in the third column of ls -l) has special rights — but not unlimited ones.

What the owner can do:

• Change the file's permission bits with chmod
• Change the file's group to any group they belong to with chgrp
• Read, write, or execute the file if the permission bits allow it* (ownership doesn't grant access; the bits do)

What the owner cannot do:

• Read a file they own but have no read permission on (without chmod first)
• Change the file's owner to another user (chown requires root)
• Bypass directory traverse permissions on parent directories

This last one bites people constantly. So you own /home/alice/project/config. Day to day, yaml. So naturally, permissions are 600. You can read it. But if /home/alice is 700 and you're not alice, you can't even reach* the file — the directory execute bit blocks you at the door. Ownership of the file doesn't help you traverse directories you don't have execute on.

The Sticky Bit Exception

There's one special case where ownership does* grant a deletion override: the sticky bit on directories. Practically speaking, when a directory has the sticky bit set (drwxrwxrwt — note the t at the end), users can only delete files they own or files in directories they own. Now, /tmp is the classic example. Anyone can create files there. But you can only delete your own* files — even though the directory is world-writable. Root, of course, ignores the sticky bit entirely.

Capabilities: The Granular Override

This is the modern, fine-grained answer that most tutorials skip. Since kernel 2.2, Linux split root's powers into distinct capabilities*. A process can have specific capabilities without being UID 0.

The capability that overrides file permissions is CAP_DAC_OVERRIDE (Discretionary Access Control Override). A process with this capability can:

• Read, write, and execute files regardless of permission bits
• Traverse directories regardless of execute bits

There's also CAP_DAC_READ_SEARCH — more limited, only allows read and directory search (traverse), not write.

If you found this helpful, you might also enjoy what is the x intercept of the function graphed below or which expression shows a way to find 20 of 950.

You can see a process's capabilities with getpcaps <pid> or check a binary's capabilities with getcap /path/to/binary. You can grant* capabilities to a binary with setcap:

setcap cap_dac_override+ep /usr/bin/mybackup

Now mybackup runs as your regular user but can read any file on the system. This is how tools like backup agents, antivirus scanners, and monitoring daemons work without running as root.

But — capabilities are inherited by child processes only if the binary has the effective and permitted flags set correctly (that's the +ep above). Shell scripts don't inherit capabilities cleanly. And capabilities on binaries are a security surface — audit them.

ACLs: Override Without Ownership

Access Control Lists (ACLs) let you grant specific users or groups permissions beyond the standard owner/group/other model. They don't "override" in the sense of bypassing — they extend* the permission model so the override isn't needed.

setfacl -m u:deploy:rwx /var/www/html
getfacl /var/www/html
# file: var/www/html
# owner: root
# group: www-data
user::rwx
user:deploy:rwx
group::r-x
mask::rwx
other::r-x

Now deploy has full access without being root, without owning the directory, and without changing the base permissions. The mask entry limits the maximum effective permissions for ACL entries — a safety valve.

ACLs are supported on ext4, xfs, btrfs, and most modern filesystems.

File Permissions: The Foundation

Unix-like systems have long relied on a simple but powerful permission model. Every file and directory has three sets of permissions: owner, group, and other. Each set can have read (r), write (w), and execute (x) bits. This system works well for basic access control, but it has limitations.

What happens when you need more granular control? What if a service needs to read system files without full root access? Or when multiple users need different levels of access to the same directory? The traditional model falls short.

The Sticky Bit: A Directory-Specific Override

Here ownership does* grant a deletion override: the sticky bit on directories. Which means when a directory has the sticky bit set (drwxrwxrwt — note the t at the end), users can only delete files they own or files in directories they own. /tmp is the classic example. That's why anyone can create files there. But you can only delete your own* files — even though the directory is world-writable. Root, of course, ignores the sticky bit entirely.

Capabilities: The Granular Override

This is the modern, fine-grained answer that most tutorials skip. Since kernel 2.2, Linux split root's powers into distinct capabilities*. A process can have specific capabilities without being UID 0.

The capability that overrides file permissions is CAP_DAC_OVERRIDE (Discretionary Access Control Override). A process with this capability can:

• Read, write, and execute files regardless of permission bits
• Traverse directories regardless of execute bits

There's also CAP_DAC_READ_SEARCH — more limited, only allows read and directory search (traverse), not write.

You can see a process's capabilities with getpcaps <pid> or check a binary's capabilities with getcap /path/to/binary. You can grant* capabilities to a binary with setcap:

setcap cap_dac_override+ep /usr/bin/mybackup

Now mybackup runs as your regular user but can read any file on the system. This is how tools like backup agents, antivirus scanners, and monitoring daemons work without running as root.

But — capabilities are inherited by child processes only if the binary has the effective and permitted flags set correctly (that's the +ep above). Shell scripts don't inherit capabilities cleanly. And capabilities on binaries are a security surface — audit them.

ACLs: Override Without Ownership

Access Control Lists (ACLs) let you grant specific users or groups permissions beyond the standard owner/group/other model. They don't "override" in the sense of bypassing — they extend* the permission model so the override isn't needed.

setfacl -m u:deploy:rwx /var/www/html
getfacl /var/www/html
# file: var/www/html
# owner: root
# group: www-data
user::rwx
user:deploy:rwx
group::r-x
mask::rwx
other::r-x

Now deploy has full access without being root, without owning the directory, and without changing the base permissions. The mask entry limits the maximum effective permissions for ACL entries — a safety valve.

ACLs are supported on ext4, xfs, btrfs, and most modern filesystems.

Choosing the Right Tool

Each mechanism serves different needs:

• Sticky bit: Best for shared directories where users should only delete their own files
• Capabilities: Ideal for system services that need specific elevated privileges without full root access
• ACLs: Perfect for granting targeted access to specific users or groups

In practice, you'll often combine these. A web server might use capabilities to read certificate files, while ACLs grant the web server group access to upload directories.

Security Considerations

Every override mechanism introduces complexity and potential attack vectors. Also, the sticky bit prevents accidental deletion but can be bypassed by root. But capabilities on binaries create privilege escalation paths if the binary is compromised. ACLs add permission layers that must be audited.

Always follow the principle of least privilege. Grant only the permissions needed, audit regularly, and understand that each override weakens the security boundary it creates.

The goal isn't to eliminate root or traditional permissions, but to supplement them where necessary. Modern Linux security relies on this layered approach — understanding when and how to use each tool safely.