In this article
When you run ls -l you see something like -rwxr-xr-x. That string of ten characters is the whole access policy for the file: who may read it, who may write it and who may run it. chmod changes it. The three-digit number you type after it, such as 755, is just a compact way of writing those nine switches.
Reading the permission string
Take -rwxr-xr-x. The first character is the file type (- for a normal file, d for a directory, l for a link). The next nine are three triplets, in this order: owner, group, others.
- 1-A regular file. A `d` here would mean a directory.
- 2rwxOwner: can read, write and execute.
- 3r-xGroup: can read and execute, but not write.
- 4r-xOthers (everyone else): can read and execute, but not write.
Written as numbers this is 7, 5, 5, so the command is chmod 755 filename.
Why the numbers are 4, 2 and 1
Each triplet is three on-or-off switches, which is a three-digit binary number. Read is the left bit (4), write the middle (2) and execute the right (1). Adding the values you want gives a single digit from 0 to 7.
| Digit | Binary | Symbolic | Meaning |
|---|---|---|---|
| 0 | 000 | --- | No access |
| 1 | 001 | --x | Execute only |
| 2 | 010 | -w- | Write only |
| 3 | 011 | -wx | Write and execute |
| 4 | 100 | r-- | Read only |
| 5 | 101 | r-x | Read and execute |
| 6 | 110 | rw- | Read and write |
| 7 | 111 | rwx | Full access |
Three digits, eight options each: 8 × 8 × 8 = 512 possible permission settings before the special bits.
The values you will actually use
| Mode | Symbolic | Typical use |
|---|---|---|
644 | rw-r--r-- | Web pages, images, config files. Owner edits, everyone else reads. |
755 | rwxr-xr-x | Scripts, programs and folders. Everyone can run or enter, only the owner changes. |
600 | rw------- | SSH private keys, secrets. Only the owner can touch it. |
700 | rwx------ | Private folders and personal scripts. |
664 | rw-rw-r-- | Shared project files, where the group may edit. |
775 | rwxrwxr-x | Shared project folders for a team group. |
640 | rw-r----- | Files a service group may read but others may not, such as some logs. |
444 | r--r--r-- | Read-only for all, even the owner. |
If you are unsure, start with 644 for files and 755 for folders and tighten from there.
The more bits that are set, the more people can do. 777 sets all nine.
What the permissions mean on folders
On a folder the bits do slightly different jobs. This catches many people out.
ls.A folder with read but no execute shows its file names but denies access to the files themselves.
Why 777 is a bad habit
A stubborn 'permission denied' error tempts people to run chmod 777. It works because it removes every barrier, including the ones that were protecting you. On a shared server or a website folder, any other user or any compromised process can now change or replace the file.
- Anyone can edit or replace the file
- Uploaded malware can overwrite your scripts
- Hides the real cause of the error
- Use
chownso the right user owns the file - Give only the access that is needed
- Fixes the cause, not the symptom
Most 'permission denied' errors are really about the wrong owner or group. Check with ls -l before changing the mode.
Symbolic mode: change one bit at a time
You do not have to type numbers. Letters let you add or remove a single permission without touching the rest.
| Command | What it does |
|---|---|
chmod u+x script.sh | Give the owner (user) execute permission |
chmod go-w file | Remove write from group and others |
chmod a+r file | Give everyone read permission (a = all) |
chmod u=rw,go=r file | Set exactly rw- for owner and r-- for group and others (same as 644) |
chmod -R 755 folder | Apply 755 to the folder and everything inside it |
Careful with -R. Setting 755 on every file makes data files executable, which is rarely what you want.
umask: the default for new files
New files do not start at 777. The system removes the bits named in the umask. A umask of 022 removes write from group and others, so new folders start at 755 and new files at 644. Files never start with execute, which is why you must chmod a new script yourself.
| umask | New folders | New files | Meaning |
|---|---|---|---|
022 | 755 | 644 | Common default. Others may read. |
002 | 775 | 664 | Group may write, used for shared teams. |
027 | 750 | 640 | Others get nothing. |
077 | 700 | 600 | Private. Only the owner has access. |
Note the numbers are not a plain subtraction in every case. The umask switches bits off, so check the result with ls -l.
The special fourth digit
You may see four-digit modes like 4755 or 2775. The extra leading digit sets three special bits.
- 4setuidA program runs with the rights of its owner, not the person who started it.
passwduses this. Dangerous on scripts. - 2setgidOn a program, it runs with the group's rights. On a folder, new files inherit the folder's group, useful for team folders.
- 1sticky bitOn a folder, only a file's owner can delete it.
/tmpuses this (mode 1777).
In the symbolic string these show as s in place of x for setuid and setgid, and t for the sticky bit.
A quick checklist
- Look first. Run
ls -lto see the current owner, group and mode. - Fix ownership before mode when a service cannot read a file.
- Use 644 for files, 755 for folders and programs.
- Use 600 or 700 for anything secret.
- Avoid -R with 777. Use
findwith-type fand-type dto set different modes for files and folders.
Questions people ask
What does chmod 755 mean?
It gives the owner read, write and execute (7), and the group and everyone else read and execute (5 each). It is the usual setting for programs and folders.
What does chmod 644 mean?
The owner can read and write (6), while the group and others can only read (4). It is the usual setting for normal files such as web pages.
Why is chmod 777 dangerous?
It lets every user on the system read, change and run the file. On web servers this can let attackers replace your files.
How do I calculate a chmod number?
Add read = 4, write = 2 and execute = 1 for each of the owner, group and others. For example rw- is 4 + 2 = 6 and r-x is 4 + 1 = 5.
What is umask?
It is a setting that removes permission bits from newly created files and folders. With a umask of 022, new folders are 755 and new files are 644.
What do the first characters in ls -l mean?
The first character is the type: a dash for a file, d for a directory, l for a link. The next nine characters are the owner, group and others permissions.