Only the owner of a file may change its permissions.
As jackweirdy commented, only the owner of a file (or root
) can change the file's permissions. Being a member of a group that has some kind of access to the file does not impart the ability to change the file's permissions.
The idea is that a file is owned by a user (whether that user represents a real person, or not), and that user is the one who decides who gets access to the file. Permissions for access by users (who are not the owner) in the group-owner of the file are controlled by the user who owns the file. If anyone in the file's group-owner could change the file's permissions, this security model would be broken.
For example, consider these permissions, as in your specific situation:
-rw-rw-r--
The owner can read and write the file but cannot execute it. The users in the group-owner besides the owner of the file can also read and write the file but not execute it. Others may only read the file.
Suppose www-data
(or someone with the ability to run commands as www-data
or as root
) set those permissions with the intention of keeping other users in the group-owner from executing the file. If other users in the group-owner could change the permissions, they could run:
chmod g+x file-a.png
And then they would gain the ability to execute the file. Such an ability would render group permissions worthless.
In contrast, the reason for user permissions, even though the user owns the file, isn't to restrict the owner from doing anything with the file, but is rather to protect the user from doing things with the file they don't want to do. For example, files that aren't programs, or that might be programs but have just been obtained from an untrusted source like the Internet, tend to have the execute bit set to 0 even for the owner, for their own benefit. In this case, it's helpful and necessary for the owner to be able to change this.
A separate problem with allowing members of the group-owner (who aren't the owner) from changing permissions is that this is a separate ability not accounted for by r
, w
, or x
. Even if the group had read, write, and execute permissions wouldn't necessarily mean that they should be able to change the permissions. (For example, suppose you have a file where the owner is not a member of the group-owner. If members of the group-owner could change the permissions, they could deprive the owner of permissions. The owner could change this back...but this would still break any automated tasks the user had scheduled that use the file.)
Allowing People to Become The Owner
When a file is owned by a user like www-data
who doesn't represent any actual person, you might want to allow some people to perform actions as that user. sudo
doesn't just facilitate allowing select users to run commands as root
. It also facilitates allowing select users to run command as other specified users. You could set things up so that everyone in the www-data
group has the ability to run commands as the www-data
user, including changing permissions on files owned by www-data
. (Make sure you understand the implications of this, though. Depending on how your system is configured, users in www-data
may be able to schedule tasks to run as www-data
, and will be able to do anything at all to any file owned by www-data
and to any process run as www-data
.)
See man sudoers
for information about how to set this up. If you decide you want to do this and you have trouble, you could post a separate question about it.
Allowing Non-Owners to Change the File's Permissions?
I think it may be possible to allow some users who don't own a file to change some or all of the file's permissions, using Access Control Lists. I've hardly used ACLs on Ubuntu though. If you're interested in accomplishing this, you might want to post another question asking if it's possible and, if so, how to do it.