Chmod permission values
What each permission value actually grants, and when it is the right one. Use the calculator to build a value from checkboxes.
| Octal | Symbolic | Owner | Group | Others |
|---|---|---|---|---|
| 000 | --------- | no access | no access | no access |
| 400 | r-------- | read | no access | no access |
| 440 | r--r----- | read | read | no access |
| 444 | r--r--r-- | read | read | read |
| 600 | rw------- | read, write | no access | no access |
| 640 | rw-r----- | read, write | read | no access |
| 644 | rw-r--r-- | read, write | read | read |
| 660 | rw-rw---- | read, write | read, write | no access |
| 664 | rw-rw-r-- | read, write | read, write | read |
| 666 | rw-rw-rw- | read, write | read, write | read, write |
| 700 | rwx------ | read, write, execute | no access | no access |
| 710 | rwx--x--- | read, write, execute | execute | no access |
| 744 | rwxr--r-- | read, write, execute | read | read |
| 750 | rwxr-x--- | read, write, execute | read, execute | no access |
| 751 | rwxr-x--x | read, write, execute | read, execute | execute |
| 754 | rwxr-xr-- | read, write, execute | read, execute | read |
| 755 | rwxr-xr-x | read, write, execute | read, execute | read, execute |
| 764 | rwxrw-r-- | read, write, execute | read, write | read |
| 770 | rwxrwx--- | read, write, execute | read, write, execute | no access |
| 774 | rwxrwxr-- | read, write, execute | read, write, execute | read |
| 775 | rwxrwxr-x | read, write, execute | read, write, execute | read, execute |
| 776 | rwxrwxrw- | read, write, execute | read, write, execute | read, write |
| 777 | rwxrwxrwx | read, write, execute | read, write, execute | read, write, execute |
| 1777 | rwxrwxrwt | read, write, execute | read, write, execute | read, write, execute |
| 2755 | rwxr-sr-x | read, write, execute | read, execute | read, execute |
| 2775 | rwxrwsr-x | read, write, execute | read, write, execute | read, execute |
| 4755 | rwsr-xr-x | read, write, execute | read, execute | read, execute |
| 4711 | rws--x--x | read, write, execute | execute | execute |
| 6755 | rwsr-sr-x | read, write, execute | read, execute | read, execute |
Reading a permission value
Each digit is the sum of the permissions granted to one class of user: 4 for read, 2 for write, 1 for execute. The three digits are the file's owner, its group, and everyone else, in that order. Because each digit covers exactly three bits, octal maps onto the permission bits one-to-one — which is why permissions are written in base 8 and not in decimal.
Files and directories are different
The same digit means different things depending on what it is applied to, and this is the single most common source of confusion:
| Bit | On a file | On a directory |
|---|---|---|
r | Read the contents | List the names inside |
w | Modify the contents | Create, rename and delete entries |
x | Run it as a program | Enter it and reach entries by name |
Two consequences follow. A directory with read but no execute lets you see the names of files you cannot open. And write permission on a directory is enough to delete a file inside it even if you have no permission on the file itself — deletion is a change to the directory, not to the file. That is precisely the hole the sticky bit exists to close.
The defaults worth memorising
| Value | Use |
|---|---|
644 | Ordinary files — the owner edits, everyone reads |
755 | Directories and executable scripts |
600 | Secrets: keys, tokens, .env files |
700 | Private directories such as ~/.ssh |
775 | A directory a group maintains and others read |
1777 | A shared scratch directory, sticky so nobody deletes another's files |
Why recursive chmod usually goes wrong
chmod -R 755 on a project tree is a common instruction and an unhelpful one: it marks every source file executable, because a numeric mode makes no distinction between a file and a directory. The fix is the capital X in symbolic mode, which adds execute only to directories and to files that already had it somewhere:
chmod -R u=rwX,go=rX .Read this as: give the owner read and write plus execute-where-appropriate, and give everyone else read plus execute-where-appropriate. Directories become 755 and ordinary files 644, in one pass.
umask decides what you get by default
New files are not created with the permissions you might expect, because the umask removes bits from a base value. The base is 666 for files and 777 for directories, and the umask is subtracted:
| umask | New file | New directory |
|---|---|---|
022 | 644 | 755 |
002 | 664 | 775 |
077 | 600 | 700 |
A umask of 022 is the common default, which is where 644 and 755 come from. Systems using per-user groups often default to 002, making new files group-writable — harmless when the group has one member, and a surprise when it does not.