Permissions, and why root is scary

Linux file permissions are nine switches: read, write and execute for the owner, the group and everyone else, written rwxr-xr-x or as a number like 755.

Every file answers three questions: what can its owner do, its group (a named set of accounts, like "team"), and everyone else. Nine switches, that is the entire system. You just uploaded deploy.sh and it will not run. Flip switches and watch every readout update live.

$ ls -l deploy.sh
-rw-r--r--  1 you team  512 Aug 19 10:04  deploy.sh  # octal: 644
readwriteexecute You owner Group team Everyone else
$ chmod deploy.sh
Youowner of the file
Samteammate · in group "team"
The strangerany other account on the box
777 means anyone on this machine can rewrite your deploy script. If any account is ever compromised, world-writable files are the first thing attackers go looking for. This is also why nginx dropped to www-data in block 02: less power means less damage.

What you just learned

Those cryptic strings like -rwxr----- are just the nine switches printed in a row, and the octal number is the same switches as digits. Two spellings, one dial.

And root? Root is the account the switches do not apply to. Every guess the attackers you will meet in block 05 throw at your server tries root first, because root does not ask permission. That is why programs drop privileges, why you deploy as a normal user, and why 777 "fixes" everything while quietly unlocking every door.

Keys, not rules. The owner key ring, the team key ring, the everyone key ring. Root carries the master key, which is exactly why you do not hand it out.
You can name it now: say this to your AI
Fix the permissions on deploy.sh so only my user can run it, my group can read it, and everyone else gets nothing.
The AI answers "chmod 740" in one second. The point is that you now know what you asked for.

Seen on a real server

bash: ./deploy.sh: Permission denied
The execute switch is off for you. chmod 755 deploy.sh turns it on for everyone; 740 keeps strangers out.
-rwxr-xr-x
How ls -l prints 755: owner rwx, group r-x, everyone r-x. Same switches, two spellings.

Every command you have run so far did one small job. Next: what happens when you chain them.