Linux File Permissions and chmod Numbers Explained
How read, write and execute permissions work for owner, group and others, what numbers like 755 and 644 mean, and which settings to avoid.
Reading the permission string
Running ls -l shows a string such as -rwxr-xr-- at the start of each line. The first character is the type: a dash for a file and d for a directory. The next nine characters are three groups of three, for the owner, the group and everyone else. In each group the letters r, w and x mean read, write and execute, and a dash means that permission is missing.
How the numbers work
Each permission has a value: read is 4, write is 2 and execute is 1. You add the values for each group to get one digit, and the three digits together form the chmod number.
- 7 is 4 + 2 + 1, which is read, write and execute.
- 6 is 4 + 2, which is read and write.
- 5 is 4 + 1, which is read and execute.
- 4 is read only.
- 0 is no access.
So 755 means the owner can read, write and execute, while the group and everyone else can read and execute. 644 means the owner can read and write, and everyone else can only read.
Settings you will use most
A few combinations cover most real situations.
- 644 for ordinary files such as web pages and documents.
- 755 for directories and for programs or scripts that others must run.
- 600 for private files such as SSH private keys, which SSH refuses to use if others can read them.
- 700 for private directories, such as the .ssh folder.
What the bits mean for directories
On a directory the meanings shift. Read lets you list the names inside, write lets you create or delete entries, and execute lets you enter the directory and reach the files inside it. This is why directories usually need the execute bit, and why a directory with read but no execute behaves in confusing ways.
Avoid 777
The setting 777 lets every user on the system read, change and run the file. It is a common quick fix when something fails with a permission error, but it removes all protection and is a real security risk on shared or public servers. Find out which user actually needs access and grant only that, for example by changing the owner or group with chown and chgrp.
Be careful with the recursive option. chmod -R 644 on a folder also removes the execute bit from directories and makes them unusable. Set files and directories separately.
Special bits and the default mask
A fourth leading digit can set special bits: 4 for setuid, 2 for setgid and 1 for the sticky bit. Setuid and setgid make a program run with the owner or group identity, and the sticky bit on a shared directory such as /tmp stops users deleting each other's files.
New files do not start at 777 or 666. The umask subtracts permissions from those defaults. A common umask of 022 gives new files 644 and new directories 755.