Administering Linux servers and managing shared multi-user directory hierarchies frequently demands replicating exact security boundaries across scripts, configuration files, and application deployments. Traditionally, matching the permission bits and ownership credentials of an existing file requires a multi-step routine: executing ls -l or stat to inspect user and group IDs, calculating the corresponding octal permission mask (such as 755 or 640), and manually issuing separate chmod and chown commands against the destination file.
This traditional routine is inefficient, tedious, and prone to human calculation errors—particularly when deploying production web roots, Nginx configurations, or systemd unit definitions where a single incorrect permission bit can trigger execution failures or critical security leaks. Fortunately, both the chmod and chown core utilities provide a built-in, elegant solution: the --reference flag. This command-line parameter enables you to copy the exact permission bits, special execution flags, and user/group ownership from an authoritative template file directly to target files or entire directory trees. This tutorial explains how to use chmod --reference and chown --reference effectively across standard files, recursive folders, and automated deployment scripts.
Understanding How the Reference Parameter Operates
The GNU Coreutils implementations of chmod (change mode) and chown (change owner) incorporate the --reference=RFILE option to eliminate manual numerical entry:
- chmod –reference: Reads the complete permission bitmask of the reference file—including read (
r), write (w), execute (x), as well as special permissions like SUID, SGID, and the Sticky Bit—and applies that identical mode directly to the target file. - chown –reference: Extracts both the numeric User ID (UID) and Group ID (GID) associated with the reference file and applies both ownership attributes to the target file simultaneously.
- Eliminating Guesswork: You never need to remember whether a secure configuration file requires
600,640, or644. As long as you have one properly configured file on your system, you can clone its security attributes instantly.
When provisioning fresh servers or duplicating drive layouts alongside permission structures, pairing filesystem permission cloning with how to backup and clone GPT partition tables in Linux using sgdisk ensures comprehensive infrastructure consistency.
Copying File Permissions with chmod –reference
To copy the exact read, write, and execute permissions from a source template file to a target file, invoke chmod with the --reference parameter followed by the reference path and target path:
chmod --reference=source_template.conf destination_file.confFor example, if you are creating a new virtual host configuration inside /etc/nginx/sites-available/ and want it to match the strict security permissions of the existing default site configuration:
sudo chmod --reference=/etc/nginx/sites-available/default /etc/nginx/sites-available/custom_app.confTo verify that the permissions were duplicated accurately, inspect both files using the stat utility:
stat -c "%a %n" /etc/nginx/sites-available/default /etc/nginx/sites-available/custom_app.confBoth files will display identical three-digit or four-digit octal permission codes (such as 644).
Copying User and Group Ownership with chown –reference
While chmod governs access permissions, chown dictates which user and group possess the file. To clone both the user and group ownership simultaneously from a reference file to a target file, run:
sudo chown --reference=source_file target_fileFor example, when generating a new upload cache file inside an Apache or Nginx web root where files must be owned by the www-data:www-data service user:
sudo chown --reference=/var/www/html/index.php /var/www/html/new_cache.jsonYou can verify user and group replication using ls -l:
ls -l /var/www/html/index.php /var/www/html/new_cache.jsonApplying Reference Attributes Recursively to Directory Trees
When deploying application archives, Git repositories, or split data volumes, you often need to standardise an entire directory of mixed files to mirror an authoritative directory. If you manage large partitioned datasets, explore our guide on how to use the split command in Linux to divide large files.
To replicate permissions recursively across all files and subdirectories, combine the -R (recursive) flag with --reference:
sudo chmod -R --reference=/opt/production_app/ /opt/staging_app/To replicate ownership recursively across the same directory tree:
sudo chown -R --reference=/opt/production_app/ /opt/staging_app/Important Caution on Directory Execution Bits:
When using chmod -R --reference, remember that directories require execute (x) bits so that the kernel allows directory traversal, whereas standard data files should generally not have execution bits. If your reference file is a regular file without execute bits, applying it recursively across a directory tree will strip the execute flag from directories, preventing users from opening folders. Use recursive reference cloning primarily when the reference object matches the destination directory type.
Combining Reference Cloning in Shell Automation Scripts
The primary advantage of reference flags is automating infrastructure deployment scripts without hardcoding system-dependent usernames, groups, or octal modes. Consider this simple automated deployment snippet:
#!/bin/bash
TEMPLATE="/etc/myapp/config.template"
TARGET="/etc/myapp/config.production"
# Generate fresh production configuration
envsubst < "$TEMPLATE" > "$TARGET"
# Replicate security profile from master template
chmod --reference="$TEMPLATE" "$TARGET"
chown --reference="$TEMPLATE" "$TARGET"
echo "Configuration deployed with verified permission parity."By relying on --reference, the deployment script remains portable across Ubuntu, Debian, RHEL, Rocky Linux, and Arch Linux, automatically adapting to whichever local user and group policies govern the template file.