chmod permissions, every common mode explained
chmod sets who may read, write and execute a file using three octal digits, one each for the owner, the group and everyone else, where read is 4, write is 2 and execute is 1: 755 means rwxr-xr-x and 644 means rw-r--r--.
Directories and programs
| Mode | Symbolic | Typical use |
|---|---|---|
| chmod 777 | rwxrwxrwx | Everyone can do everything; almost always a mistake |
| chmod 775 | rwxrwxr-x | Directories a team edits together |
| chmod 770 | rwxrwx--- | Team directory hidden from everyone else |
| chmod 755 | rwxr-xr-x | Default for directories, scripts and programs |
| chmod 750 | rwxr-x--- | Group can read, others locked out |
| chmod 744 | rwxr--r-- | Owner runs it, others may read it |
| chmod 711 | rwx--x--x | Others can pass through, not list |
| chmod 700 | rwx------ | Owner only: ~/.ssh, private scripts |
Regular files
| Mode | Symbolic | Typical use |
|---|---|---|
| chmod 666 | rw-rw-rw- | World-writable file; device nodes like /dev/null |
| chmod 664 | rw-rw-r-- | File a group edits, everyone reads |
| chmod 660 | rw-rw---- | Group-shared data, private from others |
| chmod 644 | rw-r--r-- | Default for regular files and web content |
| chmod 640 | rw-r----- | Configs and logs a service group reads |
| chmod 600 | rw------- | Owner only: SSH keys, credentials |
Read-only and locked
| Mode | Symbolic | Typical use |
|---|---|---|
| chmod 555 | r-xr-xr-x | Read-only directory or program |
| chmod 544 | r-xr--r-- | Locked script only the owner runs |
| chmod 500 | r-x------ | Private and write-protected |
| chmod 444 | r--r--r-- | Read-only for everyone |
| chmod 440 | r--r----- | /etc/sudoers, hardened wp-config.php |
| chmod 400 | r-------- | Owner reads only: .pem keys, secrets |
| chmod 000 | --------- | Nobody but root; quarantine, /etc/shadow |
Special bits: setuid, setgid, sticky
| Mode | Symbolic | Typical use |
|---|---|---|
| chmod 1777 | rwxrwxrwt | Shared scratch space: /tmp, /var/tmp |
| chmod 2775 | rwxrwsr-x | Team folder where new files keep the group |
| chmod 2755 | rwxr-sr-x | Setgid program or group-inheriting folder |
| chmod 4755 | rwsr-xr-x | Setuid program that runs as its owner |
Symbolic commands
| Command | What it does |
|---|---|
| chmod +x | Make a script executable |
| chmod u+x | Execute for the owner only |
| chmod a+r | Readable by everyone |
| chmod go-w | Undo group and world write |
| chmod -R | Change a whole tree safely |
How to read an octal mode
Each digit is the sum of read (4), write (2) and execute (1) for one class of users, in the order owner, group, others. 7 is 4+2+1 (rwx), 5 is 4+1 (r-x), 6 is 4+2 (rw-), 4 is read only and 0 is nothing. The GNU coreutils manual and the chmod(1) man page define the same layout.
A fourth digit in front holds the special bits. It is optional: chmod 755 and chmod 0755 set the same mode on files.
| Digit | Bits | Meaning |
|---|---|---|
0 | --- | No permission |
1 | --x | Execute only |
2 | -w- | Write only |
3 | -wx | Write and execute |
4 | r-- | Read only |
5 | r-x | Read and execute |
6 | rw- | Read and write |
7 | rwx | Read, write and execute |
Special bits and how ls shows them
The special bits take over the execute slot of a class in ls -l. Lowercase s or t means the execute bit is also set; uppercase S or T means it is not, which on a program usually signals a mistake.
| Bit | Value | Example | ls -l | Effect |
|---|---|---|---|---|
| setuid | 4000 | chmod 4755 | rwsr-xr-x | Program runs as the file owner |
| setuid, no execute | 4000 | chmod 4644 | rwSr--r-- | Set but useless: nothing to run |
| setgid | 2000 | chmod 2750 | rwxr-s--- | Directory: new entries inherit its group |
| sticky | 1000 | chmod 1777 | rwxrwxrwt | Only owners delete their files (/tmp) |
Execute on files versus directories
On a file, execute lets the kernel run it. A script also needs read, because the interpreter has to open it. On a directory, execute is search permission: you need it on every directory in a path to reach a file, and read only lets you list names.
This is why a tree needs two modes (usually 755 for directories and 644 for files) and why chmod -R with a single number goes wrong.
Checking a file's mode
ls -l shows the symbolic form. For the octal number, GNU stat takes -c and BSD or macOS stat takes -f; on macOS %Lp prints only the nine permission bits, so add %Mp for the special-bit digit.
ls -l file
stat -c '%a %A %n' file # Linux (GNU)
stat -f '%Mp%Lp %Sp %N' file # macOS / BSDFrequently asked questions
- What does chmod stand for?
- Change mode. A file's mode is its set of permission bits, and chmod is both the command and the system call that changes it.
- What are the most common chmod values?
- 755 for directories and programs, 644 for regular files, 700 and 600 for private directories and files such as ~/.ssh and SSH keys, and 1777 for shared temporary directories like /tmp.
- What is the difference between chmod and chown?
- chmod changes what the owner, group and others may do. chown changes who the owner and group are. Only root can give a file away with chown; the owner can chmod their own files.
- Does chmod follow the umask?
- Numeric modes ignore the umask. Symbolic modes without a user class, such as +x or -w, skip the bits set in the umask; with u, g, o or a they do not.
- Who can run chmod on a file?
- The file's owner and root. Group members cannot change the mode even if they have write permission on the file.
Last reviewed by Arielton Oberek.