Understanding Linux File Permissions & the chmod Command
On Unix and Linux-based operating systems, access to files and directories is regulated by a strict discretionary access control model. The chmod (change mode) system utility modifies the read, write, and execute permissions assigned to three distinct categories of users: the file's Owner (User), the assigned Group, and all Others (Public/World).
Permissions are mathematically represented in two interchangeable notations: Octal (Numeric) and Symbolic (Characters).
The Binary Math of Octal Permissions (Why 4, 2, and 1?)
Each permission triplet is derived from a 3-bit binary representation:
| Permission | Symbol | Octal Value | Binary Representation | Capability Description |
|---|---|---|---|---|
| Read | r | 4 | 100 | View file contents or list items inside a directory (ls). |
| Write | w | 2 | 010 | Edit, modify, truncate, or delete files, or create new files in a directory. |
| Execute | x | 1 | 001 | Execute a binary or shell script, or traverse/enter a directory (cd). |
By summing the values of granted permissions, each user tier obtains a digit from 0 (no access) to 7 (4 + 2 + 1 = full read, write, and execute access).
Standard Linux chmod Permissions Cheat Sheet
| Numeric | Symbolic | Recommended Target & Application |
|---|---|---|
| 755 | rwxr-xr-x | Standard for web root directories (/var/www/html), CGI scripts, and executable binaries. |
| 644 | rw-r--r-- | Standard for static web files (HTML, CSS, images, JS) where execution is not needed. |
| 700 | rwx------ | Strictly private directories like ~/.ssh where only the owning user should have access. |
| 600 | rw------- | SSH private keys (id_rsa, id_ed25519) and .env database secret files. SSH rejects keys with looser permissions. |
| 777 | rwxrwxrwx | CRITICAL SECURITY RISK: Grants unrestricted write and execute permissions to all users. Avoid in production. |
Special Permissions: SUID, SGID, and the Sticky Bit
- SUID (Set User ID = 4000): Displayed as
sin place ofxin the owner field (e.g.-rwsr-xr-x). When executed, the binary runs with the privileges of the file owner rather than the calling user (e.g./usr/bin/passwd). - SGID (Set Group ID = 2000): Displayed as
sin the group field. When set on a shared directory, all newly created files automatically inherit the parent directory's group ownership rather than the primary group of the creating user. - Sticky Bit (1000): Displayed as
tat the end of the permissions string (e.g.drwxrwxrwt). Standard on public temporary directories like/tmp. Only the file owner or root can delete or rename files in that directory, preventing users from deleting each other's files.
Frequently Asked Questions (FAQ)
Why does OpenSSH reject my private key if permissions are 644?
OpenSSH strictly enforces key security. If your private key (~/.ssh/id_rsa) has read permissions for group or others (644), SSH fails with WARNING: UNPROTECTED PRIVATE KEY FILE!. Run chmod 600 ~/.ssh/id_rsa to secure it.
How can I set different permissions for files vs directories recursively?
Running chmod -R 644 . will break directory navigation because directories require the Execute bit (1) to be entered. To safely set 755 for directories and 644 for files, run:
find . -type d -exec chmod 755 {} + && find . -type f -exec chmod 644 {} +