Linux File Permissions and chmod Explained
How Linux permissions work: owner, group, others, rwx, octal like 755 and 644, symbolic mode, setuid and sticky bit, with safe server defaults.
Editorial disclosure: Pyalm publishes and maintains the products and free tools discussed on this site. Regulatory statements are linked to primary sources where applicable. No independent professional review is claimed unless a reviewer is explicitly named.
Every file and directory on Linux and macOS has permissions that say who can read it, change it or run it. They are behind countless "permission denied" errors — and behind countless insecure servers where someone ran chmod 777 to make an error go away.
Reading ls -l
-rwxr-xr-- 1 deploy www 4096 Oct 16 09:30 deploy.shThe first column breaks down as: - (file; d would be a directory), then three groups of three: owner rwx, group r-x, others r--.
The three permissions
| Letter | Value | On a file | On a directory |
|---|---|---|---|
| r | 4 | Read contents | List the names inside |
| w | 2 | Modify contents | Create, rename, delete entries |
| x | 1 | Run it as a program | Enter it (cd) and access items |
Add the values per class to get one digit: rwx = 7, rw- = 6, r-x = 5, r-- = 4, --- = 0.
Octal numbers you'll actually use
| Mode | Symbolic | Typical use |
|---|---|---|
| 644 | rw-r--r-- | Ordinary files — owner edits, everyone reads |
| 755 | rwxr-xr-x | Directories and executable scripts |
| 600 | rw------- | Private files: SSH private keys, .env, credentials |
| 700 | rwx------ | Private directories (like ~/.ssh) |
| 664 | rw-rw-r-- | Files shared with a group |
| 777 | rwxrwxrwx | Avoid — anyone on the system can modify it |
chmod 644 index.html
chmod 755 deploy.sh
chmod 600 ~/.ssh/id_ed25519
chmod -R u=rwX,go=rX public/ # capital X: execute only on directoriesSymbolic mode
Instead of numbers, change specific bits:
chmod u+x script.sh # add execute for the owner
chmod g-w file.txt # remove write for the group
chmod o= secret.txt # remove all access for others
chmod a+r readme.md # everyone can readSpecial bits
A fourth leading digit sets special permissions:
- setuid (4) — runs with the file owner's privileges (the reason
passwdcan edit protected files). - setgid (2) — runs with the group's privileges, or makes new files in a directory inherit its group.
- sticky bit (1) — on a shared directory like /tmp, users can only delete their own files.
In symbolic form a lowercase s or t means the execute bit is also set; a capital S or T means it isn't.
Safe defaults for web servers
- Files 644, directories 755.
- Config with secrets 600 and owned by the service account.
- Never 777. If a web app "needs" it, the real fix is correct ownership (
chown) or group membership. - Upload directories should be writable by the app user but never executable by the web server.
- The web server user should own as little as possible.
Debugging "Permission denied"
ls -lthe file and every directory in its path — you need execute on each parent directory.- Check who you are:
id. - Check ownership and group membership.
- On systems with SELinux or AppArmor, a policy can deny access even when permissions look right.
Calculate it
Tick the permissions in the free Chmod Calculator to get the octal value, symbolic form and a ready-to-paste command, or enter a number like 755 to see what it allows. Pair it with a strong password generator and the hash generator when hardening a server, and schedule maintenance with the cron expression generator.
Servers, deployment and hardening
If you'd rather have deployments, permissions and backups handled by people who do it every day, see custom software and infrastructure work at Pyalm or get in touch.