chmod 500
chmod 500 sets r-x------: the owner can read and execute (list and enter a directory) but not write, and the group and everyone else have no access.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | No | Yes | 5 |
| Group (g) | No | No | No | 0 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read and run | List, enter and open entries |
| Group (g) | No access | No access |
| Others (o) | No access | No access |
Facts
| Octal | 500 (0500) |
|---|---|
| Symbolic | r-x------ |
| ls -l, file | -r-x------ |
| ls -l, directory | dr-x------ |
| Equivalent symbolic command | chmod u=rx,go= |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100755 (executable) |
| Special bits | None |
When to use it
- A private directory of scripts or binaries that should not be modified by accident, for example a bin directory holding vetted tools.
- Private scripts with embedded credentials that should run, never be edited in place, and never be read by others.
When not to use it
- Directories where the owner or its programs create files: writes fail until you add u+w.
- Anything another account must reach, including a service running as a different user.
- Data files: use 400.
Commands
chmod 500 bin
chmod u=rx,go= bin # same resultstat -c '%a %A %n' bin # Linux (GNU stat): 500 dr-x------
stat -f '%Lp %Sp %N' bin # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 500 and files to 400 separately:
find bin -type d -exec chmod 500 {} +
find bin -type f -exec chmod 400 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rX,go= bin.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100755; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 500 mean?
- Owner 5 (read 4 + execute 1), group 0, others 0: r-x------.
- Can root still read or change a 500 file?
- Yes. Root bypasses read and write permission checks, and can execute the file because at least one execute bit is set.
- What is the difference between 500 and 700?
- The owner write bit. With 500 even the owner cannot modify the file or create entries in the directory until they change the mode.
Last reviewed by Arielton Oberek.