chmod Cheat Sheet
Linux file permissions: symbolic and octal modes, common combos, and pitfalls.
chmod changes permission bits on files and directories. Permissions are evaluated for the owner, group, and other users, with directory permissions controlling traversal and listing as well as file access.
Reading `ls -l`
A mode such as -rwxr-x--- begins with the file type, then has three permission triples: user, group, and other.
ls -l script.sh
# -rwxr-x--- 1 ada developers 842 Jul 28 09:00 script.sh
| Position | Example | Meaning |
|---|---|---|
| First character | - | Regular file; d means directory; l means symlink. |
| Characters 2–4 | rwx | Owner permissions. |
| Characters 5–7 | r-x | Group permissions. |
| Characters 8–10 | --- | Other-user permissions. |
s / t | rws, t | Special set-ID or sticky bits when present. |
Permission triples
For regular files, read permits content inspection, write permits modification, and execute permits running the file. For directories, read lists entries, write changes entries, and execute permits traversal.
| Symbol | Numeric value | Meaning |
|---|---|---|
r | 4 | Read. |
w | 2 | Write. |
x | 1 | Execute or traverse. |
- | 0 | Permission absent. |
# user=rwx, group=r-x, other=---
chmod 750 deploy.sh
Octal modes
Each octal digit is the sum of the three bits for one class. A leading fourth digit can represent special bits, such as setuid, setgid, or sticky.
| Octal | Bits | Symbolic |
|---|---|---|
| 0 | --- | None |
| 1 | --x | Execute |
| 2 | -w- | Write |
| 3 | -wx | Write + execute |
| 4 | r-- | Read |
| 5 | r-x | Read + execute |
| 6 | rw- | Read + write |
| 7 | rwx | Read + write + execute |
| Mode | Typical use |
|---|---|
755 | Executable files or traversable public directories. |
644 | Ordinary readable files. |
600 | Private user-readable files. |
700 | Private executable directories or scripts. |
640 | Owner read/write, group read, no other access. |
chmod 755 script.sh
chmod 644 config.example
chmod 600 ~/.ssh/config
Symbolic modes
Symbolic syntax identifies a class, an operator, and permissions. Omitting the class uses the process umask for many commands, so specify the class when precision matters.
chmod u+x script.sh
chmod go-w shared.txt
chmod a=r public.txt
chmod u=rw,go=r report.txt
chmod u+rwx,g+rx,o-rwx private-dir
| Form | Meaning |
|---|---|
u | User/owner. |
g | Group. |
o | Other. |
a | All three classes. |
+ | Add permissions. |
- | Remove permissions. |
= | Set exactly these permissions. |
Recursive changes
-R applies changes below a directory. It is often safer to handle directories and files separately so directories receive execute permission while data files do not.
find project -type d -exec chmod 755 {} +
find project -type f -exec chmod 644 {} +
chmod -R u+rwX,go+rX project
Pitfalls and special cases
Avoid 777 as a default: it allows any user to modify or execute content. A directory needs x for access, and changing a symlink usually affects its target because chmod follows the link on common systems.
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 1777 /tmp/shared
References
man chmod- GNU Coreutils: chmod invocation