The Linux Permissions Triangle
In the Linux operating system, security and access control are built around a strict hierarchy. Every single file and directory on the system is governed by three distinct entities:
- The Owner (the specific user who created the file).
- The Group (a collection of users who share specific access rights).
- Others (everyone else on the system).
While the chown (change owner) command is used to transfer absolute ownership of a file to a new individual user, the chgrp (change group) command is used to reassign a file to a different team or department.
Imagine you have a file named marketing_budget.pdf. Currently, it is owned by the user alice and belongs to the finance group. If Alice wants to share this file so the entire marketing team can edit it, she does not need to give up her personal ownership. She simply needs to change the file’s group association to the marketing group.
Step 1: Viewing Current Group Ownership
Before you can change a group, you need to see who currently owns the file.
Open your terminal and use the long-listing format of the ls command:
ls -l marketing_budget.pdf
The output will look something like this:
-rw-rw-r-- 1 alice finance 45000 Oct 14 09:30 marketing_budget.pdf
In this output, alice is the owner, and finance is the group.
Step 2: Changing the Group Ownership
To change the group ownership of a file, use the chgrp command followed by the new group name, and then the filename.
Crucial Rule: To change a file’s group, you must either be the root user (using sudo), OR you must be the owner of the file and a member of the new group you are trying to assign.
Assuming you have the correct permissions, type:
chgrp marketing marketing_budget.pdf
If you run ls -l again, you will see the change reflected instantly:
-rw-rw-r-- 1 alice marketing 45000 Oct 14 09:30 marketing_budget.pdf
Now, any user who is a member of the marketing group can access the file based on the group permissions.
Step 3: Changing Groups for an Entire Directory (Recursive)
If you have just created a new shared folder containing hundreds of documents (e.g., /var/www/html/ for a web server) and you need to assign the entire folder structure to the www-data group, doing it file-by-file is impossible.
You can apply the group change to a directory and every single file inside it by using the -R (Recursive) flag.
sudo chgrp -R www-data /var/www/html/
(Note: Because changing core system directories requires elevated privileges, this command is prefaced with sudo).
Step 4: Using a Reference File
Sometimes, you want to make the permissions of a new file match an old file exactly, but you cannot remember the specific group name used on the old file.
Instead of looking it up, you can use the --reference flag. This tells Linux, “Look at File A, and make the group of File B exactly the same.”
chgrp --reference=old_report.txt new_report.txt
The new_report.txt file will instantly inherit whatever group is assigned to old_report.txt.
Why Use chgrp Instead of chown?
You might notice that the chown command can also change groups (using the syntax chown user:group filename). So why does chgrp exist?
chgrp is preferred when you only want to affect the group and want to ensure you do not accidentally alter the primary user ownership by making a typo in a complex chown string. It is safer, more specific, and clearly communicates the intent of the command in administrative scripts.