chmod 755
chmod 755 sets rwxr-xr-x: the owner can read, write and execute, while the group and everyone else can read and execute but not modify. On a directory that means others can list and enter it but not create or delete files.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | Yes | No | Yes | 5 |
| Others (o) | Yes | No | Yes | 5 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | Read and run | List, enter and open entries |
| Others (o) | Read and run | List, enter and open entries |
Facts
| Octal | 755 (0755) |
|---|---|
| Symbolic | rwxr-xr-x |
| ls -l, file | -rwxr-xr-x |
| ls -l, directory | drwxr-xr-x |
| Equivalent symbolic command | chmod u=rwx,go=rx |
| Default umask that creates it | umask 022 for new directories |
| How Git records a file with it | 100755 (executable) |
| Special bits | None |
When to use it
- Directories in general, and web roots in particular: the WordPress guide says all directories should be 755 or 750.
- Scripts and compiled programs other people should be able to run: most programs in /usr/bin are installed as 755.
- It is what mkdir produces under the common umask 022, so a new directory is already 755.
When not to use it
- Regular files that are not programs (HTML, images, configs): use 644. Marking data as executable is harmless on its own but noisy in Git diffs and a hint of a sloppy chmod -R.
- Directories holding secrets, and home directories on shared servers: anyone can list names and read every readable file inside. Use 750 or 700.
- Your ~/.ssh directory: ssh(1) recommends it be accessible only by you, so use 700.
Commands
sudo chmod 755 /var/www/site
sudo chmod u=rwx,go=rx /var/www/site # same resultstat -c '%a %A %n' /var/www/site # Linux (GNU stat): 755 drwxr-xr-x
stat -f '%Lp %Sp %N' /var/www/site # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 755 and files to 644 separately:
sudo find /var/www/site -type d -exec chmod 755 {} +
sudo find /var/www/site -type f -exec chmod 644 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rwX,go=rX /var/www/site.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100755; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 755 mean?
- Owner 7 (read 4 + write 2 + execute 1), group 5 (read 4 + execute 1), others 5. In ls -l it shows as rwxr-xr-x.
- Should files be 755 or 644?
- Directories and executables 755, everything else 644. Directories need the execute bit to be entered; plain files do not need it and should not have it.
- Is chmod 755 secure?
- It is the normal public mode: nobody except the owner can change anything. It is not private, though: every account on the machine can read the contents, so do not use it for keys, credentials or personal data.
- How do I set 755 on all folders but not files?
- Use find to select directories only: find . -type d -exec chmod 755 {} +. Pair it with find . -type f -exec chmod 644 {} + for files.
Last reviewed by Arielton Oberek.