chmod 750
chmod 750 sets rwxr-x---: the owner can read, write and execute, members of the group can read and execute (list and enter a directory) without changing anything, and everyone else has no access.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | Yes | No | Yes | 5 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | Read and run | List, enter and open entries |
| Others (o) | No access | No access |
Facts
| Octal | 750 (0750) |
|---|---|
| Symbolic | rwxr-x--- |
| ls -l, file | -rwxr-x--- |
| ls -l, directory | drwxr-x--- |
| Equivalent symbolic command | chmod u=rwx,g=rx,o= |
| Default umask that creates it | umask 027 for new directories |
| How Git records a file with it | 100755 (executable) |
| Special bits | None |
When to use it
- Home directories on shared machines: Ubuntu creates new home directories as 750 since release 21.04, so other users cannot browse yours.
- Application code the web server reads through group membership: owner deploy, group www-data, directories 750 and files 640. WordPress lists 750 as an accepted directory mode.
- It is what mkdir produces under umask 027, a common hardening setting.
When not to use it
- When the process that serves the files is neither the owner nor in the group: it lands in others, gets ---, and every request fails with 403 or permission denied.
- When the group members must write (uploads, caches): use 770 or 775 for those specific directories.
- On data files: the file-side twin is 640.
Commands
sudo chmod 750 /var/www/app
sudo chmod u=rwx,g=rx,o= /var/www/app # same resultstat -c '%a %A %n' /var/www/app # Linux (GNU stat): 750 drwxr-x---
stat -f '%Lp %Sp %N' /var/www/app # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 750 and files to 640 separately:
sudo find /var/www/app -type d -exec chmod 750 {} +
sudo find /var/www/app -type f -exec chmod 640 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rwX,g=rX,o= /var/www/app.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100755; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 750 mean?
- Owner 7 (rwx), group 5 (r-x), others 0 (---). Only the owner and the group can get in.
- What is the difference between 750 and 755?
- The last digit. 755 lets any account on the machine read and enter; 750 shuts out everyone who is not the owner or in the group.
- Why does nginx return 403 after chmod 750?
- nginx workers run as nginx or www-data. If that account is not in the directory's group it gets no access. Add it with usermod -aG yourgroup www-data and restart nginx, or change the group with chgrp.
Last reviewed by Arielton Oberek.