Linux permission denied: diagnose and fix it from the terminal
A step-by-step guide to finding out why Linux says 'permission denied' and fixing it with stat, groups, chown, and chmod.
What this covers
“Permission denied” is one of the most common Linux errors, and the fix depends entirely on why access was refused: a missing permission bit, wrong ownership, a group you don't belong to, or a program that rejects overly open permissions. This guide walks you from diagnosis to fix to verification.
Symptom
Inspect the file's permissions with stat
Before changing anything, see what the permission bits actually are. stat shows the owner, group, and rwx modes in both octal and symbolic form, so you can tell whether you're missing execute, write, or read access. If your user or group doesn't hold the needed bit, that's the source of the denial.
stat shows the full file status: the three timestamps (atime/mtime/ctime), inode number, and permission bits in both octal and rwx form.
$ stat file.txtCheck which groups you belong to
Many 'permission denied' errors come down to group membership — the file may be writable by a group you're not in. Run groups with your username to list your memberships. If a relevant group (sudo, docker, www-data, etc.) is missing, you know the fix is membership or ownership, not chmod.
Check which groups grant a user their sudo, docker, or file permissions — the first diagnostic for 'permission denied'.
$ groups aliceTake ownership if the file belongs to the wrong user
If the file was created by root (for example, after running a copy or service as root) and your user needs to work with it, change the owner with chown. Use this when ownership — not just permission bits — is the problem, and record the previous owner so you can revert if needed.
Assign a file or whole directory tree to a different user and group, common after root-created copies or when fixing web server permissions.
$ sudo chown user:group file-or-dir▾ Undo
$ sudo chown previous-owner:previous-group file-or-dirGrant the missing permission with chmod
If the diagnosis showed your user or group lacks a needed bit, add it with chmod. The classic case is an executable that needs the execute bit for its owner. Use symbolic modes to add only what's needed rather than opening the file to everyone. Re-run stat afterwards to confirm the bit is set.
Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.
$ chmod u+x script.sh▾ Undo
$ chmod u-x script.shSpecial case: SSH refuses an overly open private key
Not all permission denied errors mean too little access — SSH refuses private keys that are readable by others. If the error appears when connecting with ssh, tighten the key to owner-only permissions with chmod 600 and try the connection again.
Set owner-only permissions on your SSH private key with chmod 600 so ssh will use it and other users can't read it.
$ chmod 600 ~/.ssh/id_ed25519 && ls -l ~/.ssh/id_ed25519Check your umask if new files keep coming out restricted
If permission denied keeps appearing on files you just created, your umask may be stripping permissions at creation time. View the current umask and adjust it for the shell so newly created files and directories get the access you expect going forward.
The forgotten octal that decides how open every new file is — run `umask` to see it, `umask 027` to tighten it for this shell.
$ umask 027▾ Undo
$ umask 022How to confirm it worked
Re-run the original command that failed. Also re-run stat on the file to confirm the permission bits and ownership now match what you intended.
Undo everything
Every command above can be reverted. Run these in order to undo all of it.
$ umask 022
chmod u-x script.sh
sudo chown previous-owner:previous-group file-or-dirReview before running — some steps may not be independent.
Sources
- stat(1) - Linux manual pageEvidence: stat displays file status including size, blocks, inode, permissions, and Access/Modify/Change timestamps; -c allows a custom output format.
- groups(1) — print group memberships a user is inEvidence: Documents groups printing the group names for a specified user, defaulting to the current user.
- chown(1) — change file owner and groupEvidence: The chown man page documents setting owner and group via 'owner[:group]' syntax and the -R option to operate recursively.
- chmod(1) — change file mode bitsEvidence: The chmod man page describes both symbolic modes like u+x (who operator permissions) and octal modes like 755 for setting mode bits.
- ssh(1) — Linux manual page (private key permissions)Evidence: ssh refuses to load identity files that are readable by others, requiring owner-only permissions on private keys.
- umask(2) — set file mode creation maskEvidence: Explains that umask bits are cleared from requested permissions when files are created, and that the mask is inherited by children.
Last verified: 2026-09-21
Related guides
A problem-fix walkthrough for a full Linux disk: find the culprit filesystem, remove space hogs, sweep caches, and verify the space came back.
A step-by-step terminal checklist to check disk health on Linux: rule out full space and inodes, read the SMART self-assessment, and check live I/O per process.
Follow a Linux log file in real time with less +F, tail -f and journalctl -f -u, and confirm that new lines are actually arriving as events happen.