Questions
How do I fix a whole web root safely?
find /var/www -type d -exec chmod 755 {} + and find /var/www -type f -exec chmod 644 {} +, then chown -R www-data: /var/www. Never chmod -R 777.
chmod & permissions cheat sheet
The whole permission system fits on one page. Print it, or keep the chmod calculator open for anything interactive.
Fits on one A4 / Letter page in portrait; use “Save as PDF” in the print dialog to keep a copy.
Reading permissions
| -rwxr-xr-x | type, owner rwx, group r-x, others r-x |
| r = 4, w = 2, x = 1 | add per group → octal digit |
| rwx r-x r-x | = 7 5 5 = 755 |
| d l c b p s | directory, symlink, char dev, block dev, pipe, socket |
Common modes
| 644 | files: owner rw, everyone r |
| 755 | directories, scripts, binaries |
| 600 / 700 | private file / directory (SSH keys, .env, ~/.ssh) |
| 664 / 775 | group-writable file / directory |
| 2775 | shared dir: new files inherit the group (setgid) |
| 1777 | /tmp: anyone writes, only owners delete (sticky) |
| 4755 | setuid binary (passwd, sudo) |
| 777 | almost always wrong |
Symbolic chmod
| u g o a | user (owner), group, others, all |
| + - = | add, remove, set exactly |
| chmod u+x f | owner may execute |
| chmod go-w f | group and others lose write |
| chmod a=r f | everyone read only |
| chmod u=rwx,g=rx,o= f | = 750 |
| chmod -R u=rwX,go=rX dir | recursive; X = execute only for dirs and already-executable files |
| chmod g+s dir | setgid on a directory |
| chmod +t dir | sticky bit |
| chmod --reference=a b | copy a's mode to b |
Special bits (leading octal digit)
| 4 setuid | run as the file's owner; shows as s in owner x |
| 2 setgid | run as group; on dirs: inherit group; s in group x |
| 1 sticky | in dirs: only owner may delete; t in others x |
| S / T | capital = special bit set without execute (usually a mistake) |
Ownership
| chown user file | change owner (root only) |
| chown user:group file | owner and group |
| chown -R www-data: /var/www | recursive; empty group = user's login group |
| chgrp group file | group only (member can do it) |
| chown -h | change the symlink itself, not the target |
umask
| umask 022 | files 644, dirs 755 (default) |
| umask 077 | files 600, dirs 700 (private) |
| umask 002 | files 664, dirs 775 (group work) |
| UMask=0077 | in a systemd [Service] |
Finding and fixing
| find . -type f -perm -o+w | world-writable files |
| find / -perm -4000 -type f | setuid binaries |
| find . -type d -exec chmod 755 {} + | fix dirs only |
| find . -type f -exec chmod 644 {} + | fix files only |
| stat -c '%a %U %G %n' * | octal mode, owner, group, name |
| ls -ld dir | the directory itself, not its contents |
ACLs (when rwx is not enough)
| getfacl file | show; a + in ls -l means one exists |
| setfacl -m u:alice:rw file | give alice rw |
| setfacl -m d:g:dev:rwx dir | default ACL for new files in dir |
| setfacl -b file | remove all ACLs |
Remember
- Directory
x= may enter;r= may list;w= may create/delete entries. - Deleting a file needs
won the directory, not on the file. - root ignores rwx (but not the execute bit for running).
- “Permission denied” is often ownership; check
ls -lbeforechmod 777.