Victor's room

Quick Summary: The error chown: changing ownership of '<file>': Operation not permitted (Errno 1 / EPERM) occurs in Linux when a process attempts to reassign the user or group ownership of an inode without the necessary privileges or filesystem capabilities. Common root causes include running chown as an unprivileged user, attempting ownership changes on immutable files (chattr +i), encountering NFS root_squash barriers, or operating inside unprivileged containers where CAP_CHOWN is dropped.

Understanding the Root Causes

Unlike classic BSD systems where users can voluntarily surrender ownership of files they own, Linux enforces strict POSIX compliance: only the superuser (root) or a process granted the CAP_CHOWN capability may reassign user ownership. The operation fails under the following conditions:

• Unprivileged Execution: A regular non-root user attempts to give away a file, even one they created. Regular users can only change group ownership (via chgrp) to a group they actively belong to.
• Extended Immutable File Attributes: Files or directories marked with the +i (immutable) or +a (append-only) ext4/xfs flags reject all metadata changes, even when executed by root.
• NFS Network Storage (root_squash): Remote Network File System shares configure root_squash by default, automatically remapping incoming root client requests to the unprivileged nobody user.
• Container Capabilities & User Namespaces: Docker or Kubernetes pods running without CAP_CHOWN or operating inside rootless user namespaces attempting to map host UIDs.

Step 1: Quick Fix – Execute with Elevated Privileges and Verify chgrp

Confirm whether root elevation resolves the error, or use chgrp if you only need to share file access among members of a common supplementary group:

# Elevate to root privilege using sudo
sudo chown www-data:www-data /var/www/html/index.php

# If you are an unprivileged user wanting to share access with a group you belong to:
# Check your current group memberships:
groups

# Change only the group ownership without changing the owner UID:
chgrp developers project-file.txt
chmod 775 project-file.txt

Step 2: Remove Extended Immutable Attributes (chattr)

If running sudo chown as root still fails with Operation not permitted, check for filesystem-level immutability attributes:

# Inspect extended file attributes using lsattr
lsattr /path/to/target_file

# Example output displaying immutable flag:
# ----i---------e---- /path/to/target_file

# Remove the immutable (+i) and append-only (+a) flags using chattr:
sudo chattr -i /path/to/target_file
sudo chattr -a /path/to/target_file

# Re-run the ownership change:
sudo chown user:group /path/to/target_file

Step 3: Resolve NFS root_squash and Container Capability Drops

For network filesystems or containerized workloads, configure server-side export options or container security profiles:

# Scenario A: NFS Export Configuration on the Storage Server
# Edit /etc/exports on the NFS server:
sudo nano /etc/exports

# Replace root_squash with no_root_squash for authorized administrative clients:
/srv/nfs/data 192.168.1.50(rw,sync,no_root_squash,no_subtree_check)

# Apply NFS export updates immediately:
sudo exportfs -rav

# Scenario B: Docker / Container CAP_CHOWN capability
# Ensure the container has the CAP_CHOWN capability in docker-compose.yml:
# cap_add:
#   - CHOWN

Verification & Testing Steps

Inspect file metadata and ownership IDs to ensure that the ownership changes were written to the filesystem:

# Verify user and group ownership with ls -l
ls -l /path/to/target_file

# Verify exact numeric UID and GID mapping using stat
stat -c "%U (%u) : %G (%g)" /path/to/target_file

# Expected output:
# www-data (33) : www-data (33)

# Test writing to the file as the newly assigned owner
sudo -u www-data touch /path/to/target_file

Troubleshooting Summary Comparison

Environment / Context	Primary Root Cause	Recommended Solution
Standard Terminal	Non-root user running chown	Execute with sudo or use chgrp
Root Elevation Fails	Immutable attribute set (+i)	Run sudo chattr -i <file>
NFS Network Share	NFS server root_squash active	Set no_root_squash in /etc/exports
Docker / Kubernetes	Dropped CAP_CHOWN capability	Add cap_add: [CHOWN] or adjust securityContext