Skip to content
ENPT

chmod cheat sheet

This chmod cheat sheet fits Linux and macOS file permissions on one printable page: what each octal digit means, 25 common modes such as 755, 644 and 600, the special bits, the symbolic u+x syntax, umask results and the find commands that fix a whole tree.

Paper

Fits one page: A4, Letter.

chmod

Linux and macOS file permissions: octal, symbolic, special bits

25 common modesReviewed 2026-09-27

Octal digits

  • 0---No permission
  • 1--xExecute only
  • 2-w-Write only
  • 3-wxWrite and execute
  • 4r--Read only
  • 5r-xRead and execute
  • 6rw-Read and write
  • 7rwxRead, write and execute

-rwxr-xr-x = type, then owner, group and others

Symbolic syntax

  • u g o aWho: owner (user), group, others, all
  • + - =Add, remove, set exactly
  • r w xRead, write, execute
  • XExecute only for directories and files already executable
  • s tsetuid or setgid (with u or g), sticky

Directories and programs

  • 777rwxrwxrwxEveryone can do everything; almost always a mistake
  • 775rwxrwxr-xDirectories a team edits together
  • 770rwxrwx---Team directory hidden from everyone else
  • 755rwxr-xr-xDefault for directories, scripts and programs
  • 750rwxr-x---Group can read, others locked out
  • 744rwxr--r--Owner runs it, others may read it
  • 711rwx--x--xOthers can pass through, not list
  • 700rwx------Owner only: ~/.ssh, private scripts

Regular files

  • 666rw-rw-rw-World-writable file; device nodes like /dev/null
  • 664rw-rw-r--File a group edits, everyone reads
  • 660rw-rw----Group-shared data, private from others
  • 644rw-r--r--Default for regular files and web content
  • 640rw-r-----Configs and logs a service group reads
  • 600rw-------Owner only: SSH keys, credentials

Read-only and locked

  • 555r-xr-xr-xRead-only directory or program
  • 544r-xr--r--Locked script only the owner runs
  • 500r-x------Private and write-protected
  • 444r--r--r--Read-only for everyone
  • 440r--r-----/etc/sudoers, hardened wp-config.php
  • 400r--------Owner reads only: .pem keys, secrets
  • 000---------Nobody but root; quarantine, /etc/shadow

Special bits: setuid, setgid, sticky

  • 4755rwsr-xr-xsetuid Program runs as the file owner
  • 4644rwSr--r--setuid, no execute Set but useless: nothing to run
  • 2775rwxrwsr-xsetgid Directory: new entries inherit its group
  • 2755rwxr-sr-xSetgid program or group-inheriting folder
  • 1777rwxrwxrwtsticky Only owners delete their files (/tmp)

Symbolic examples (start → result)

  • +x644→755Executable for all, minus the umask (022)
  • u+x644→744Owner may run it
  • go-w664→644Group and others lose write
  • a+r600→644Everyone may read
  • o=755→750Others lose every permission
  • u=rw,go=r755→644Set exactly, ignoring the old mode
  • g=u740→770Group copies the owner
  • u+s755→4755Setuid program
  • g+s775→2775New entries inherit the group
  • +t777→1777Sticky: shared temp directory

umask: new file / new directory

  • 022644 rw-r--r-- / 755 rwxr-xr-x
  • 002664 rw-rw-r-- / 775 rwxrwxr-x
  • 027640 rw-r----- / 750 rwxr-x---
  • 077600 rw------- / 700 rwx------

Recursive changes and checks

  • find . -type d -exec chmod 755 {} +Directories only
  • find . -type f -exec chmod 644 {} +Regular files only
  • chmod -R u=rwX,go=rX .Both in one pass: X skips data files
  • find . -name '*.sh' -exec chmod +x {} +Make every shell script executable
  • find . -perm -002 ! -type lWorld-writable entries (symlinks skipped)
  • find / -xdev -type f -perm -4000 2>/dev/nullSetuid programs on this file system
  • stat -c '%a %A %n' <file>Octal and ls form, Linux (GNU)
  • stat -f '%Mp%Lp %Sp %N' <file>Same on macOS and BSD
Source: GNU coreutils manual, chmod(1)www.arielton.com/cheatsheets/chmod

What is on the sheet

The symbolic examples show a starting mode and the mode you end up with, computed by the same implementation of GNU chmod rules that the chmod reference on this site tests against the real chmod binary. That matters for the tricky ones: a bare +x respects the umask, and X only adds execute to directories and to files that were already executable.

The find block covers the job people actually get wrong, which is setting directories to 755 and files to 644 in one tree without making every file executable. The umask rows show what new files and directories get under the four umasks you are likely to meet.

How to print it on one page

Pick the paper above the sheet and press Print / Save as PDF. The page measures the sheet at that paper width and scales it to fill one page, never below 7pt, then hides the site header, footer, ads and buttons. It always prints black on white, whatever theme you are reading in.

In the print dialog keep Scale on Default (100%) and Margins on Default. To get a PDF, choose Save as PDF as the destination. Safari ignores the paper size a page asks for, so select the same paper in its dialog.

Embed or link to this cheat sheet

Linking to this page from your docs, wiki or README is the best way to share it: readers always get the current version and the print button. Copy one of these:

HTML
<a href="https://www.arielton.com/cheatsheets/chmod">chmod cheat sheet (printable)</a> by <a href="https://www.arielton.com/">Arielton Oberek</a>
Markdown
[chmod cheat sheet (printable)](https://www.arielton.com/cheatsheets/chmod) by [Arielton Oberek](https://www.arielton.com/)

If your team wants the same treatment for an internal API, a CLI or a style guide, write to contact@arielton.com.

Frequently asked questions

What does chmod 755 mean?
rwxr-xr-x: the owner can read, write and execute, and the group and everyone else can read and execute. It is the usual mode for directories, scripts and programs.
How do I set 755 on directories and 644 on files at the same time?
Run find . -type d -exec chmod 755 {} + and then find . -type f -exec chmod 644 {} +, or do both in one pass with chmod -R u=rwX,go=rX . where the capital X keeps execute on directories and on files that already had it.
What is the difference between chmod +x and chmod u+x?
u+x adds execute for the owner only. A bare +x adds it for owner, group and others, minus any bit your umask blocks: with the common umask 022, a 644 file becomes 755.
Does chmod work the same on macOS?
Octal and symbolic modes behave the same on macOS and BSD. What differs is the tooling around it: to print a mode as a number, GNU stat takes -c '%a' while macOS stat takes -f '%Lp'.

Last reviewed by Arielton Oberek.