chmod Explained

Every File Has Three Audiences

Each Unix file carries three permission triads — for the owner, the group, and everyone else. Each triad records three bits: read, write, andexecute. That is nine bits in total, plus three special bits that modify behavior.

Octal Math

Each permission is a power of two: r = 4, w = 2, x = 1. Add them to get each triad's digit. rw- = 6, r-x = 5, rwx = 7. The familiar chmod 755 is rwxr-xr-x: owner can read/write/execute; group and others can read and execute but not write.

Reading ls -l

The ten-character string starts with a file-type bit: - regular file, d directory, l symbolic link, c character device, b block device. The nine permission bits follow.

What Each Bit Means on Files vs Directories

• Read on a file — contents can be opened for reading
• Read on a directory — names of entries can be listed (ls)
• Write on a file — contents can be modified
• Write on a directory — entries can be added, renamed, deleted
• Execute on a file — the file can be run as a program
• Execute on a directory — the directory can be traversed (cd, path lookup)

Directory r without x means you can see the names but cannot cd or open the files. Directory x without r means you can traverse through but not list — common for restricted sharing.

Special Bits

• setuid (4000) — on an executable, runs as the owner. passwd uses this to let unprivileged users rewrite /etc/shadow.
• setgid (2000) — on a directory, new entries inherit the directory's group. Perfect for shared project folders.
• sticky (1000) — on a directory, only the owner of each file can delete or rename it. Set on /tmp so users can't nuke each other's temp files.

umask: The Permission Subtractor

When a program creates a new file it asks for a mode (usually 666) and new directories ask for 777. The process's umask is subtracted from that request. A umask of 022 (common default) means new files become 644 and new directories 755. Set a stricter umask 077 if you want fresh files to be private by default.

chmod + chown Together

Permissions are only half the story — ownership matters too. chown alice:web /var/www/site transfers the file to user alice and group web. If a shared directory has mode 2775 (setgid + rwxrwxr-x), every new file inside automatically gets group web and group-write permissions — no manual chmod after each upload.

Common Patterns

• chmod -R go-rwx ~/.ssh — lock down SSH keys
• chmod 600 ~/.ssh/id_ed25519 — private keys must be user-only or OpenSSH refuses to use them
• chmod +x deploy.sh — mark a script executable
• find . -type d -exec chmod 755 {} + — fix directory perms
• find . -type f -exec chmod 644 {} + — fix file perms
• chmod g+s /srv/shared — new entries inherit the group

Try It

Flip between numeric and symbolic notation with our free Unix Permissions Calculator. Need a strong SSH passphrase? The Password Generator is one click away.