How chmod numbers work
Every file has three permission sets: for its owner (u), its group (g), and others (o). Each set has three bits: read (4), write (2), execute (1). Add the bits to get one octal digit per set, and write the three digits in owner-group-others order.
rwx r-x r-x
7 5 5 → chmod 755
r = 4, w = 2, x = 1
rwx = 4+2+1 = 7 rw- = 4+2 = 6 r-x = 4+1 = 5 r-- = 4An optional fourth digit in front sets the special bits: setuid (4), setgid (2) and sticky (1). chmod 1777 /tmp is the classic example.
What the bits mean for files and directories
| Bit | On a file | On a directory |
|---|---|---|
| Read (r) | Open and read the contents | List the names in it (ls) |
| Write (w) | Modify the contents | Create, rename and delete entries (requires x too) |
| Execute (x) | Run it as a program or script | Enter it and access entries by name (cd, open files inside) |
| setuid (4) | Runs with the owner's user ID (passwd) | Ignored on Linux |
| setgid (2) | Runs with the owner group's ID | New files inherit the directory's group, useful for shared project folders |
| sticky (1) | No effect on Linux | Only a file's owner (or root) can delete or rename it, as in /tmp |
A directory without execute permission is unusable even with read: you can list names but cannot open anything. That is why directories get 755 or 750 rather than 644.
Sensible defaults
644for ordinary files,755for directories and executables. These are whatumask 022produces.600for private keys, credentials and~/.ssh/authorized_keys;700for~/.sshitself. SSH refuses keys that are readable by others.664/775in a shared group directory with setgid (2775) so everyone's files stay in the group.- Avoid
777. It makes the file writable by every account on the machine and is almost never the fix for a permission error; the right fix is usually ownership (chown) or a group.
Symbolic mode
chmod also accepts symbolic changes, which are relative and safer for scripts because they leave the other bits alone:
chmod u+x script.sh # add execute for the owner
chmod go-w file # remove write from group and others
chmod a=r file # everyone: read only (444)
chmod -R g+rwX shared/ # recursive; X adds execute only to directories and already-executable files
chmod u=rwx,g=rx,o= file # 750The calculator's symbolic field accepts the nine-character ls -l form (a leading type character such as d or - is ignored) and the u=…,g=…,o=… form.
Reading permissions
$ ls -l
-rw-r--r-- 1 ada dev 1024 Feb 11 09:30 notes.md
drwxr-x--- 2 ada dev 4096 Feb 11 09:30 private/
-rwsr-xr-x 1 root root 68208 Feb 1 10:00 /usr/bin/passwd
$ stat -c '%a %A %n' notes.md
644 -rw-r--r-- notes.mdAn s in an execute position means setuid or setgid with execute; an uppercase S means the special bit is set but execute is not, which is almost always a mistake. Likewise t versus T for the sticky bit.