chmod: Permissions, Numeric Modes & Examples

Our Linux server support engineers correct permission problems daily; this page documents chmod itself — the permission model it manipulates, numeric and symbolic modes, recursion, the special bits, and the mistakes that create security incidents. Syntax follows the POSIX specification and the GNU coreutils implementation found on most Linux distributions.

The permission model

Every file has three permission sets — one for the owning user (u), one for the owning group (g), and one for other (o), meaning everyone else. Each set holds three bits: read (r), write (w), and execute (x). On a directory, read means listing entries, write means creating or deleting entries, and execute means entering the directory and accessing entries by name. A directory without x is unusable even with r set.

The first column of ls -l shows the full mode string:

-rwxr-xr--  1 deploy www-data  4096 Aug  2 10:14 release.sh

Decoded left to right: the first character is the file type (- regular file, d directory, l symlink). Then three triplets: rwx — the owner (deploy) can read, write, and execute; r-x — members of group www-data can read and execute; r-- — everyone else can only read. A dash means the bit is off. The permission bits are stored in the file's inode; the full description of the mode field is in inode(7).

Numeric (octal) modes

Each triplet maps to one octal digit: r = 4, w = 2, x = 1, added together. rwx = 7, r-x = 5, rw- = 6, r-- = 4. Three digits set user, group, other in that order. chmod 754 release.sh produces the rwxr-xr-- string above.

A fourth, leading digit sets the special bits described below; chmod 4755 is 755 plus setuid. When the leading digit is omitted, GNU chmod leaves existing setuid/setgid bits on directories in place unless explicitly cleared, per the coreutils manual.

Symbolic mode

Symbolic mode changes bits relative to the current mode instead of replacing it. The grammar is who operator permission: who is u, g, o, or a (all); the operator is + (add), - (remove), or = (set exactly); permissions are r, w, x, plus s and t for the special bits.

chmod u+x deploy.sh        # add execute for the owner
chmod g-w shared.conf      # remove group write
chmod a=r NOTICE.txt       # set exactly r-- r-- r-- for everyone
chmod u=rwx,g=rx,o= app/   # multiple clauses, comma-separated (equals 750)
chmod go-rwx ~/.ssh        # strip everything from group and other
chmod a+X bin/             # capital X: execute only if a dir or already executable

Omitting who (chmod +x file) applies to all classes but respects the umask. The capital X is the practical difference between symbolic and numeric mode: chmod -R a+rX dir makes directories traversable without marking every data file executable. Full syntax is in chmod(1).

Recursion, and files versus directories

chmod -R applies the mode to a directory and everything beneath it. With a numeric mode this is usually wrong for mixed trees, because files and directories need different modes — 644 on a directory makes it untraversable, 755 on files marks them all executable. The standard pattern separates the two with find(1):

find /var/www/example -type d -exec chmod 755 {} +
find /var/www/example -type f -exec chmod 644 {} +

The {} + form batches paths into few chmod invocations. chmod -R u+rwX,go+rX,go-w dir achieves a similar result in one command via the capital X. chmod never changes the mode of a symbolic link's target when given the link during recursion; GNU chmod ignores symlinks encountered in a -R traversal.

Special bits: setuid, setgid, sticky

setuid (octal 4000, symbolic u+s): an executable with setuid runs with the file owner's effective user ID rather than the invoking user's. /usr/bin/passwd is mode 4755 and owned by root, which is how an ordinary user edits /etc/shadow. Shown as rwsr-xr-x in ls output. Setuid on shell scripts is ignored by the Linux kernel; setuid on directories is ignored on most systems. Background: Wikipedia: setuid.

setgid (octal 2000, symbolic g+s): on an executable, it runs with the file group's effective group ID. On a directory it changes inheritance — new files created inside take the directory's group instead of the creator's primary group, and new subdirectories inherit the setgid bit. chmod 2775 /srv/shared is the standard setup for a group-collaboration directory. Shown as rwxrwsr-x.

sticky bit (octal 1000, symbolic +t): on a directory, users can delete or rename only entries they own, even when the directory itself is world-writable. /tmp is mode 1777 (rwxrwxrwt) for exactly this reason. chmod 1777 /var/scratch reproduces the arrangement. On modern systems the bit has no effect on regular files.

Common scenarios

chmod, chown, and chgrp

chmod changes what the three classes may do; it never changes who the classes are. chown user:group file changes the owning user and group, and chgrp changes the group alone. Permission problems are often ownership problems: if the web server runs as www-data and a file is owned by root with mode 640, the fix is chown or chgrp, not widening the mode to 644 or 666. Only root may change a file's owner; the owner may change its group to any group they belong to. Related command pages: crontab and ssh command, both of which fail in specific ways when file modes are wrong.

Common mistakes

• chmod 777 on a web server is a security defect, not a fix. It makes every file writable by every local user and by the web server process itself, so any code-execution bug in the application can rewrite the application. When a permission error goes away after 777, the correct mode was narrower and the real problem was ownership. Red Hat's documentation team covers the reasoning in Linux file permissions explained.
• Recursive chmod on system paths. chmod -R against /, /etc, /usr, or /var strips setuid bits from binaries like sudo and su and breaks package-manager assumptions; recovery generally means reinstalling packages or restoring from backup. There is no built-in undo.
• Numeric recursion over mixed trees — the file-versus-directory problem covered above.
• Forgetting execute on directories. A file with mode 644 is still unreadable if any parent directory lacks x for that user.

umask

umask sets the default for new files: it is a mask of bits to remove from the mode a program requests at creation. Programs typically request 666 for files and 777 for directories; with the common umask 022, new files arrive as 644 and directories as 755. umask 077 yields 600/700. It is a per-process attribute, set in shell startup files with umask 022, and it explains why files never need a post-creation chmod on a correctly configured system. chmod adjusts existing files; umask governs new ones.

When to hand it over

Permission faults on production servers tend to be entangled with ownership, SELinux contexts, and service users, and blanket chmod runs make them worse. Our Linux server administration team handles permission audits, web-root hardening, and recovery from bad recursive chmod runs as standard cases. An engineer is available on live chat 24/7.