Users and groups
Linux knows each user by a number, the user ID (UID). The file /etc/passwd lists them: here alice is 1000, bob 1001 and carol 1002. Regular users start at 1000. root, UID 0, is the administrator.
A group is a named set of users with its own number, the group ID (GID), listed in /etc/group. Here the group team (GID 1003) holds alice and bob. carol is not in it.
A file's mode
Every file records one owner and one group. ls -l shows them: notes.txt belongs to user alice and group team. The ten characters at the start, -rw-r-----, are its mode: who may do what.
The first character is the type: - means an ordinary file. Then come three sets of three: for the owner, for the group, and for everyone else (others). r means read, w write, x execute. A dash means that bit is off.
Each set is also one digit: r is worth 4, w 2 and x 1. Add the bits that are on. rw- is 6, r-- is 4 and --- is 0, so this mode is 640. chmod accepts these numbers too.
The kernel checks
bob runs cat notes.txt. His process carries his UID and groups, and asks the kernel to open the file for reading. He is not the owner, but he is in team, so the kernel uses the group bits: r is on. Allowed.
carol tries the same. She is not the owner and not in team, so the kernel uses the others bits: ---. Read is off, so the open fails and cat prints Permission denied. Only one set counts: the first that matches.
Changing the rules
Only the owner (or root) may change a file's mode, and alice owns this one. chmod g+w adds write for the group. ls -l now shows -rw-rw----, which is 660.
bob asks to open notes.txt for writing. Same check: not the owner, in team, so the group bits count: rw-. Write is on, so it is allowed. carol is still refused: the others bits did not change.
root, UID 0, may read and write any file: its processes hold the capability CAP_DAC_OVERRIDE. sudo runs one command as root after asking for your own password. Use it with care: as root, a typo can delete anything.
What happens
;; step 1/10 · users /etc/passwd one line per user name:password:UID:GID:comment:home:shell root:x:0:0:root:/root:/bin/bash alice:x:1000:1000::/home/alice:/bin/bash bob:x:1001:1001::/home/bob:/bin/bash carol:x:1002:1002::/home/carol:/bin/bash x the password itself is kept in /etc/shadow
The users, their numbers and the group team are an example. On Debian, Ubuntu and Fedora the first regular user gets UID 1000 and, by default, a personal group of the same name. The ls -l lines on the card are cut after the group; the full line also shows the size, date and name. Strictly, the kernel compares the file with the process's filesystem user and group IDs, which normally equal its effective IDs. The order is fixed: owner, then group, then others; once one matches, the others are not looked at, so an owner with fewer rights than the group is still held to the owner bits.