How Unix permissions work
Every file has three sets of three permission bits: for the file's owner, for its group, and for everyone else. Each set can allow reading (r, value 4), writing (w, 2) and executing (x, 1). Add the values in each set and you get one octal digit, which is why permissions are written as three digits: rwxr-xr-x is 4+2+1, 4+1, 4+1 = 755.
For directories the same bits mean slightly different things: read lists the entries, write creates and deletes entries, and execute allows entering the directory and reaching the files inside. A directory without x is unusable even with r.
The special bits
A fourth, leading digit holds three more bits. setuid (4) makes an executable run as its owner, which is how passwd can edit a root-owned file. setgid (2) does the same for the group, and on a directory makes new files inherit the directory's group, which is what shared project folders want. sticky (1) on a directory stops users deleting each other's files; /tmp is 1777.
Symbolic mode
chmod also accepts changes rather than absolute values: u+x adds execute for the owner, go-w removes write from group and others, a=r sets everyone to read only. X (capital) adds execute only to directories and files that already have it somewhere, which makes chmod -R a+rX the safe way to open a tree for reading.
umask
New files start at 666 and directories at 777, minus the umask. The common umask 022 gives 644 and 755; 077 gives 600 and 700 (private). umask with no argument shows the current value.
Common values
| Octal | Symbolic | Use |
|---|---|---|
| 644 | rw-r--r-- | Ordinary files, web content |
| 755 | rwxr-xr-x | Executables, scripts, directories |
| 600 | rw------- | Private keys, .env, password files |
| 700 | rwx------ | ~/.ssh and other private directories |
| 664 / 775 | rw-rw-r-- / rwxrwxr-x | Group-collaborative files / directories |
| 2775 | rwxrwsr-x | Shared directory with group inheritance |
| 1777 | rwxrwxrwt | /tmp |
| 4755 | rwsr-xr-x | setuid programs such as passwd, sudo |
Questions
What does chmod 755 mean?
Owner can read, write and execute; group and others can read and execute. It is the normal mode for programs, scripts and directories.
What does chmod 777 do, and why is it bad?
It lets every user on the system read, write and execute the file. On a shared or internet-facing machine that means anyone, including a compromised service, can modify it. It is almost never the right fix for a permission error; usually ownership (chown) or a 755/644 is.
Why does my script say “permission denied”?
It lacks the execute bit. Run chmod +x script.sh (or 755). If it is on a filesystem mounted noexec, or the shebang line points to a missing interpreter, you get the same message.
What does the s or t in ls -l mean?
Lower-case s in the owner or group execute position means setuid or setgid is set together with execute; upper-case S means the special bit is set without execute (usually a mistake). t and T are the same for the sticky bit. Paste the string into the symbolic box to decode it.
What is the difference between chmod and chown?
chmod changes the permission bits; chown changes which user and group own the file. Many “permission denied” problems are ownership problems: the bits are right but for the wrong user.
How do I set permissions recursively?
chmod -R. To avoid making every file executable, use chmod -R u=rwX,go=rX dir, where capital X applies execute only to directories and already-executable files.