What is chmod?
chmod (change mode) is a Unix/Linux command that sets file and directory permissions. Every file has three permission categories: Owner (the user who created it), Group (users in the file's group), and Others (everyone else). Each category can have Read, Write, and Execute permissions.
How Octal Values Work
Each permission has a numeric weight: Read = 4, Write = 2, Execute = 1. Add them together for each role:
- 7 (4+2+1) = Read + Write + Execute (rwx)
- 6 (4+2) = Read + Write (rw-)
- 5 (4+1) = Read + Execute (r-x)
- 4 (4) = Read only (r--)
- 3 (2+1) = Write + Execute (-wx)
- 2 (2) = Write only (-w-)
- 1 (1) = Execute only (--x)
- 0 = No permissions (---)
The three digits in chmod 755 represent Owner (7), Group (5), Others (5).
Symbolic Notation
Symbolic notation uses letters: r (read), w (write), x (execute), - (no permission). The 9-character string is grouped in threes: rwxr-xr-x = Owner(rwx) + Group(r-x) + Others(r-x).
You can also use symbolic mode with chmod: chmod u=rwx,g=rx,o=rx filename is equivalent to chmod 755 filename. Use + to add and - to remove permissions: chmod g+w filename adds write permission for the group.
Recursive Chmod (chmod -R)
Use chmod -R to change permissions recursively on a directory and all its contents: chmod -R 755 /var/www/html. This applies the same permission to every file and subdirectory inside.
However, files and directories usually need different permissions. A better approach is to set them separately:
- Directories to 755:
find /path -type d -exec chmod 755 {} +
- Files to 644:
find /path -type f -exec chmod 644 {} +
This ensures directories are traversable (need execute) while files remain non-executable.
Making Files Executable (chmod +x)
chmod +x filename adds execute permission for all users. This is the fastest way to make a script runnable. For finer control:
- chmod u+x: Add execute for the owner only
- chmod g+x: Add execute for the group only
- chmod o-x: Remove execute for others
- chmod a+x: Add execute for all (same as +x)
After adding execute permission, run a script with ./script.sh. If you see "Permission denied", you likely need to run chmod +x script.sh first.
Default Permissions and umask
Linux uses umask to determine default permissions for new files and directories. The default umask is typically 022, which means:
- New files: 666 - 022 =
644 (rw-r--r--)
- New directories: 777 - 022 =
755 (rwxr-xr-x)
Check your current umask with the umask command. A more restrictive umask like 077 creates files as 600 and directories as 700, giving access only to the owner.
Security Best Practices
- Never use 777 in production. It gives everyone full access including write and execute.
- SSH keys must be 600 or 400. SSH refuses to use keys with broader permissions.
- Web files should be 644 (files) and 755 (directories). The web server user needs read access; only the owner should write.
- Scripts need execute (x) permission. Use 755 for scripts that others may run, 700 for private scripts.
- Principle of least privilege: Always grant the minimum permissions needed.