Every file on Linux belongs to a user and a group. Permissions (set with chmod) decide what the owner, the group and everyone else may do; chown decides who the owner and group are. Most “permission denied” problems on web servers are really ownership problems.

Syntax

chown [options] USER[:GROUP] FILE...

Changing ownership requires root, so you’ll usually use sudo. (A regular user can change a file’s group to another group they belong to, using chgrp.)

Examples

sudo chown alice report.txt                 # owner only
sudo chown alice:developers report.txt      # owner and group
sudo chown :developers report.txt           # group only (same as chgrp)
sudo chown alice: report.txt                # owner, and group = alice's login group
sudo chown -R www-data:www-data /var/www/site   # recursive

Check the result:

ls -l report.txt
stat -c '%U:%G %n' report.txt

Recursive changes

-R applies to a directory and everything beneath it:

sudo chown -R deploy:www-data /var/www/example.com

Double-check the path before pressing Enter. sudo chown -R user:user / var/www — note the stray space — would change ownership of the whole system, which is very hard to undo. Tab completion helps avoid such typos.

To change only some files, combine with find:

sudo find /var/www/site -user root -exec chown www-data:www-data {} +
sudo find /srv/data -group olduser -exec chgrp newgroup {} +

By default, chown link changes the target of a symbolic link. To change the link itself, use -h:

sudo chown -h alice:alice mylink

With -R, symlinks are not followed unless you add -L (follow all) or -H (follow those given on the command line). The default (-P, don’t follow) is the safe choice.

Copy ownership from another file

sudo chown --reference=/var/www/site/index.php /var/www/site/new-file.php

Numeric IDs

You can use UIDs and GIDs instead of names — useful in containers or when restoring files from another server where names map to different numbers:

sudo chown 1000:1000 file
sudo chown -R 33:33 /srv/data      # 33 = www-data on Debian/Ubuntu
id www-data                        # show a user's UID and GIDs

This matters with Docker bind mounts: a container process running as UID 1000 writes files that show up on the host as owned by whichever host user has UID 1000.

Only change matching ownership

sudo chown -R --from=root:root www-data:www-data /var/www/site

Only files currently owned by root:root are changed — a handy fix after accidentally running a deploy as root.

Verbose output

sudo chown -v alice file      # report every file
sudo chown -c -R alice dir    # report only files that actually changed

Web server ownership patterns

Pattern 1 — the web server owns everything. Simple, common on single-site servers:

sudo chown -R www-data:www-data /var/www/example.com

Downside: if the application is compromised, the attacker can modify every file, including code.

Pattern 2 — a deploy user owns the code; the web server can only write where it must. More secure:

sudo chown -R deploy:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 750 {} +
sudo find /var/www/example.com -type f -exec chmod 640 {} +
sudo chown -R www-data:www-data /var/www/example.com/storage /var/www/example.com/uploads

The web server (group www-data) can read the code but write only to storage and uploads.

The web server user differs by distribution: www-data on Debian/Ubuntu, nginx or apache on AlmaLinux/Rocky. PHP-FPM pools can run as their own user, which is the best isolation for multiple sites on one server.

chgrp

chgrp changes only the group:

sudo chgrp -R developers /srv/project

Combine it with the setgid bit so new files inherit the group automatically:

sudo chmod 2775 /srv/project

Troubleshooting

  • chown: changing ownership of 'file': Operation not permitted — you need sudo; or the file is on a filesystem that doesn’t support Unix ownership (FAT/exFAT, some network mounts); or the file is immutable (lsattr file shows i; remove with chattr -i).
  • chown: invalid user: 'alice' — the user doesn’t exist on this system. Check with id alice.
  • Ownership reverts — something else (a deploy script, a container, a cron job) is writing the files. Find out what creates them.

Next: understand the permission bits themselves in chmod explained, or the full model in Linux file permissions explained. Managing users? See Debian user and permission management.

  • Linux
  • Permissions
  • Command Line