Ownership with chown and chgrp

1. Files store numeric identities

An inode records a numeric user ID and group ID. Tools resolve those numbers through local or network identity databases to display names. If the mapping is absent, ls -n and stat still reveal the authoritative numbers.

flowchart LR
  I["Inode metadata
UID 1001 / GID 2001"] --> N["Name-service lookup
local files, LDAP, SSSD, etc."]
  N -->|mapping exists| D["Display deploy:appteam"]
  N -->|mapping missing| X["Display numeric 1001:2001"]
  P["Process effective UID
and supplementary GIDs"] --> A["Permission-class selection"]
  I --> A

target="$HOME/devops-academy/linux/chapter06/lesson03"
mkdir -p -- "$target"
printf 'artifact=true
' > "$target/artifact.conf"

id
ls -ln -- "$target/artifact.conf"
stat -c 'uid=%u user=%U gid=%g group=%G mode=%a name=%n' -- "$target/artifact.conf"
getent passwd "$(id -u)"
getent group "$(id -g)"

Names are administrative labels. Numeric consistency matters when extracting archives, mounting shared storage, running rootless containers, or moving files between systems with different account databases.

2. Ownership changes have privilege boundaries

An ordinary user generally cannot transfer a file to another user. Otherwise, users could evade quotas or cause another identity to own hostile content. The owner may usually change a file’s group to one of the owner’s supplementary groups. Root or an appropriately privileged process can assign arbitrary owners and groups.

file="$HOME/devops-academy/linux/chapter06/lesson03/artifact.conf"
primary_group=$(id -gn)

# Safe for a file you own: assign your primary group explicitly.
chgrp -- "$primary_group" "$file"
# Equivalent group-only chown form.
chown -- ":$primary_group" "$file"
stat -c '%U:%G %u:%g %a %n' -- "$file"

3. Service ownership should follow responsibility

A typical deployment separates the identity that owns immutable application content from the identity that runs the service. For example, root or a deployment account may own binaries and configuration, while a service account receives write access only to runtime directories through group ownership or ACLs.

4. Recursive ownership changes can cross boundaries

chown -R can alter thousands of objects and may interact with symlinks or mount points in surprising ways. Use a precise root, preview with find, stay on one filesystem when appropriate, and avoid following untrusted links.

root="$HOME/devops-academy/linux/chapter06/lesson03/release"
mkdir -p -- "$root/bin" "$root/config" "$root/state"

# Preview owner/group state without changing it.
find "$root" -xdev -printf '%u:%g %m %y %p
' | LC_ALL=C sort

# Find objects that do not match the expected current owner/group.
expected_user=$(id -un)
expected_group=$(id -gn)
find "$root" -xdev \( ! -user "$expected_user" -o ! -group "$expected_group" \) -print

# Bounded repair for a tree you own.
chown -R -- "$expected_user:$expected_group" "$root"
find "$root" -xdev -printf '%u:%g %p
' | LC_ALL=C sort

On production paths, snapshot or inventory before repair. Package managers may expect specific ownership, and changing system paths recursively can make services unbootable or weaken security.

5. Numeric ownership explains container and archive surprises

Container processes and host processes may use different names for the same numeric IDs—or the same names for different IDs. Bind-mounted files are authorized by numeric identity. Archives can preserve numeric ownership, and privileged extraction may recreate it. Network filesystems may remap root or rely on centralized identity.

# Archive without requiring privileged owner restoration in the lab.
lab="$HOME/devops-academy/linux/chapter06/lesson03"
tar -czf "$lab/release.tar.gz" -C "$lab" release

# Inspect archive owner/group fields before extraction.
tar -tvzf "$lab/release.tar.gz"

# On extraction as an ordinary user, explicitly avoid restoring ownership.
mkdir -p -- "$lab/restored"
tar --no-same-owner -xzf "$lab/release.tar.gz" -C "$lab/restored"

6. Hands-on lab: audit deployment ownership

set -eu
lab="$HOME/devops-academy/linux/chapter06/lesson03"
root="$lab/deployment"
rm -rf -- "$root"
mkdir -p -- "$root/bin" "$root/config" "$root/state"
printf '#!/usr/bin/env bash
echo ready
' > "$root/bin/check"
printf 'port=8080
' > "$root/config/app.conf"
printf 'counter=0
' > "$root/state/runtime.db"
chmod 750 -- "$root/bin" "$root/bin/check"
chmod 640 -- "$root/config/app.conf"
chmod 700 -- "$root/state"

user=$(id -un)
group=$(id -gn)
chown -R -- "$user:$group" "$root"

{
  printf 'expected=%s:%s
' "$user" "$group"
  printf '=== numeric and named ownership ===
'
  find "$root" -xdev -printf '%U:%G %u:%g %m %p
' | LC_ALL=C sort
  printf '=== unexpected owners ===
'
  find "$root" -xdev \( ! -user "$user" -o ! -group "$group" \) -print
  printf '=== unresolved identities ===
'
  find "$root" -xdev \( -nouser -o -nogroup \) -print
} > "$lab/ownership-audit.txt"

cat -- "$lab/ownership-audit.txt"
test ! -s <(find "$root" -xdev \( ! -user "$user" -o ! -group "$group" \) -print)

7. Common ownership mistakes

8. Knowledge check

9. Summary

Ownership gives permission bits their identity context. Linux stores numeric UID/GID values, resolves them to names for display, restricts ownership transfer, and uses groups to represent shared roles. Safe ownership work is bounded, previewed, numerically audited, and conscious of archives, containers, network identity, and mount boundaries.

10. Further reading

• Linux man-pages: chown(2), chown(1), credentials(7), and user_namespaces(7).
• GNU Coreutils manuals for chown, chgrp, and ownership options.
• GNU Tar manual for ownership preservation and extraction controls.
• Name Service Switch documentation for account and group resolution.