chmod 770
chmod 770 sets rwxrwx---: the owner and the group can read, write and execute (or list, modify and enter the directory), and all other accounts have no access at all.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | Yes | Yes | Yes | 7 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | Read, modify and run | List, enter, create, delete and rename entries |
| Others (o) | No access | No access |
Facts
| Octal | 770 (0770) |
|---|---|
| Symbolic | rwxrwx--- |
| ls -l, file | -rwxrwx--- |
| ls -l, directory | drwxrwx--- |
| Equivalent symbolic command | chmod ug=rwx,o= |
| Default umask that creates it | umask 007 for new directories |
| How Git records a file with it | 100755 (executable) |
| Special bits | None |
When to use it
- Application data shared by a service account and the people who operate it, when nobody else on the host should even list the names.
- Group-private project folders on multi-user servers (research clusters, shared build hosts). Pair it with setgid (2770) so new files keep the group.
- It is what mkdir produces under umask 007.
When not to use it
- Directories a web server must read when its account is not in the group. It falls into the others class, gets nothing, and answers 403 Forbidden or permission denied.
- Parent directories on the path to public content: every directory above a file needs execute for the reader, so a 770 parent blocks access to everything below it.
- Regular data files: use 660 so they are not executable.
Commands
sudo chmod 770 /srv/app/data
sudo chmod ug=rwx,o= /srv/app/data # same resultstat -c '%a %A %n' /srv/app/data # Linux (GNU stat): 770 drwxrwx---
stat -f '%Lp %Sp %N' /srv/app/data # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 770 and files to 660 separately:
sudo find /srv/app/data -type d -exec chmod 770 {} +
sudo find /srv/app/data -type f -exec chmod 660 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R ug=rwX,o= /srv/app/data.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100755; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 770 mean?
- Owner rwx (7), group rwx (7), others --- (0). Only the owner and members of the group can use the file or directory.
- Why do I get permission denied on a 770 directory even though I am in the group?
- Group membership is read at login. After usermod -aG, log out and back in (or run newgrp) so your processes carry the new group. Check with id.
- Should I use 770 or 750?
- Use 770 when group members need to create and delete files, 750 when they only need to read. Others get nothing either way.
Last reviewed by Arielton Oberek.