chmod 744
chmod 744 sets rwxr--r--: the owner can read, modify and execute the file, and the group and everyone else can read it but not run it directly or change it.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | Yes | No | No | 4 |
| Others (o) | Yes | No | No | 4 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | Read the contents | List names only; cannot enter or open entries |
| Others (o) | Read the contents | List names only; cannot enter or open entries |
Facts
| Octal | 744 (0744) |
|---|---|
| Symbolic | rwxr--r-- |
| ls -l, file | -rwxr--r-- |
| ls -l, directory | drwxr--r-- |
| Equivalent symbolic command | chmod u=rwx,go=r |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100755 (executable) |
| Special bits | None |
When to use it
- Scripts that only their owner should launch (root-owned maintenance scripts, cron jobs) where the source itself is not secret.
- It is what chmod u+x produces on a file that was 644.
When not to use it
- As a security control for shell, Python or other interpreted scripts: anyone who can read the file can run it with bash backup.sh or python3 tool.py, because the interpreter only needs read. If the content must be protected, use 700.
- On directories: group and others get read without execute, so they can list the names but cannot open, stat or cd into anything. That half-access is rarely what anyone wants.
- Scripts that contain passwords or tokens: 744 makes them readable by every account.
Commands
chmod 744 backup.sh
chmod u=rwx,go=r backup.sh # same resultstat -c '%a %A %n' backup.sh # Linux (GNU stat): 744 -rwxr--r--
stat -f '%Lp %Sp %N' backup.sh # macOS and BSDApplying it to a whole tree
Do not apply 744 recursively. On directories it leaves group and others able to list names but not enter, which breaks access to everything below. Set 744 on the individual scripts and keep directories at 755.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100755; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 744 mean?
- Owner 7 (rwx), group 4 (r--), others 4 (r--). The owner can run the file; everyone else can only read it.
- Can other users still run a 744 script?
- Not as ./backup.sh, which returns permission denied. But they can pass it to the interpreter (bash backup.sh), since that only needs read access. Compiled binaries do need the execute bit.
- Is 744 or 755 better for scripts?
- Use 755 when others are meant to run the script, 744 when only the owner is, and 700 when the content itself should be private.
Last reviewed by Arielton Oberek.