How to change file permissions on Linux: chmod for permissions (read/write/execute for owner/group/other), chown for owner/group. Use numeric mode (chmod 755 file) or symbolic (chmod u+x file). umask sets the default for new files. The team that uses chmod 600 for sensitive files and chmod 644 for normal files has the right baseline.
Table of contents
- chmod numeric mode
- chmod symbolic mode
- chown (change owner)
- chgrp (change group only)
- chmod for directories
- umask (default for new files)
- Special bits
- Find files by permission
- FAQ
chmod numeric mode
chmod 755 script.sh # rwxr-xr-x
chmod 644 file.txt # rw-r--r--
chmod 600 secret.key # rw-------
chmod 777 file.txt # rwxrwxrwx (avoid)Numbers: 4=read, 2=write, 1=execute. Add them. Three digits: owner, group, other.
The team that uses numeric mode for scripts and configs has clear intent.
chmod symbolic mode
chmod u+x script.sh # add execute for user (owner)
chmod g-w file.txt # remove write for group
chmod o=r file.txt # set other to read-only
chmod a+r file.txt # add read for allThe team that uses symbolic for incremental changes has clarity.
chown (change owner)
chown user:group file.txt
chown -R user:group /directory/The team that uses chown -R recursively fixes ownership in a directory.
chgrp (change group only)
chgrp www-data /var/www/The team that uses chgrp when only the group needs to change (e.g., for shared dirs).
chmod for directories
Directories need execute permission to traverse:
chmod 755 /srv/app/ # drwxr-xr-x - traversable
chmod 700 /srv/app/ # drwx------ - only owner can cdThe team that uses 700 for sensitive directories has owner-only access.
umask (default for new files)
umask # show current
umask 022 # default: files 644, dirs 755
umask 077 # restrictive: files 600, dirs 700Set in /etc/profile for system default, ~/.bashrc for user.
The team that uses umask 077 has restrictive defaults for new files.
Special bits
- setuid (4): file runs as owner.
chmod u+s /usr/bin/sudo. - setgid (2): file runs as group.
- sticky (1): only owner can delete.
chmod +t /tmp.
The team that has /tmp with sticky bit (default on modern distros) has shared temp without user-deletes.
Find files by permission
# Find world-writable files (security risk)
find / -perm -o+w -type f 2>/dev/null
# Find files with SUID
find / -perm -u+s -type f 2>/dev/nullThe team that audits for SUID/world-writable has security visibility.
FAQ
What does 755 mean?
Owner: rwx (7). Group: r-x (5). Other: r-x (5). Standard for executables and directories.
What does 644 mean?
Owner: rw- (6). Group: r— (4). Other: r— (4). Standard for files.
How do I make a script executable?
chmod +x script.sh or chmod 755 script.sh. The team that uses chmod +x has the file ready to run.
Why does my web app get 403/404 on file access?
Wrong file permissions. Apache/nginx user (www-data) can’t read. chown www-data:www-data /var/www/app and chmod 755 /var/www/app.
Should I use 777 to fix permission errors?
Never. 777 = world-writable = anyone can read/write/execute. The team that uses 777 has a security incident.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: