Unix File Permissions: Every chmod Mode Explained
One page per octal mode people actually look up, plus the concepts that the mode pages depend on: the special bits, the umask, symbolic notation and the difference between the execute bit on a file and on a directory. Each mode page gives the symbolic form, the ls -l rendering, exactly who can do what, and what it is genuinely used for.
Every page here embeds the Chmod Calculator. Tick the nine permission boxes, or type an octal or symbolic value, and get the three digit and four digit octal, the ls -l rendering and the exact chmod command back.
33 pages in this section.
Category Common modes
chmod 777: Everyone Gets Everything
777 gives read, write and execute to the owner, the group and everyone else. What it actually allows, why it is never the real fix, and what to use instead.
chmod 775: Owner and Group Write, Everyone Else Reads
775 gives the owner and group full access and leaves others with read and execute. The correct mode for shared directories, and why it needs setgid.
chmod 755: The Standard Mode for Directories and Programs
755 gives the owner full control and everyone else read and execute. Why it is right for directories and executables and wrong for ordinary data files.
chmod 750: Owner Writes, Group Reads, Others Shut Out
750 gives the owner everything, the group read and traverse, and everyone else nothing. The right mode for application directories that must stay private.
chmod 711: Directories You Can Enter but Cannot List
711 gives others execute without read, so they can enter a directory by exact name but cannot list it. Where this is used and what it does not protect.
chmod 733: Blind Drop Directories and What They Miss
733 lets others write and traverse a directory without listing it. The upload drop box pattern, and why it needs the sticky bit to be safe.
chmod 766: A Mode That Is Almost Always an Accident
766 gives the owner execute and leaves the file writable by the group and by everyone else. Why it combines two errors and what was probably intended.
chmod 700: Private Directories Such as ~/.ssh
700 gives the owner read, write and execute and everyone else nothing. Why SSH insists on it for ~/.ssh and what breaks when a parent is more open.
chmod 666: World Writable Files and the Few Legitimate Ones
666 lets every account read and write the file with no execute bit anywhere. Why it is wrong for regular files and right for a handful of device nodes.
chmod 664: Group Writable Files for Shared Work
664 lets the owner and the group edit a file while everyone else can only read it. The default on systems using a 002 umask and per-user groups.
chmod 644: The Default File Mode and When to Change It
644 gives the owner read and write and everyone else read only. Why it is the default for files under a 022 umask, and the cases where it is wrong.
chmod 640: Configuration Files a Service Group Can Read
640 gives the owner read and write, the group read only, and everyone else nothing. The correct mode for configuration holding credentials.
chmod 622: Write Without Read, and the Old Terminal Mode
622 lets the owner read and write while the group and others can only write. Where this came from, what write without read really allows, and why it is rare.
chmod 600: Owner Only Read and Write for Keys and Secrets
600 gives the owner read and write and nobody else anything. The mode SSH, PostgreSQL and other tools insist on for files holding credentials.
chmod 555: Read and Execute With No Write for Anyone
555 removes the write bit from the owner as well as everyone else. What that protects against, what it does not, and how real immutability is done.
chmod 550: Programs a Service Can Run but Cannot Change
550 gives the owner and group read and execute and everyone else nothing. The mode for a privileged script that a service must run but must not modify.
chmod 500: Owner Only Read and Execute, Nothing Else
500 lets the owner read and execute but not write, and gives group and others nothing. A guard against accidental edits and a way to freeze a directory.
chmod 444: Read Only for Everyone, With Real Limits
444 gives read to all three classes and write to none, not even the owner. Why a 444 file can still be deleted and what actually makes a file immutable.
chmod 440: Read Only for Owner and Group, the sudoers Mode
440 gives the owner and group read only and everyone else nothing. Why sudo refuses to run unless its configuration files carry exactly this mode.
chmod 400: Read Only Keys and Downloaded PEM Files
400 gives the owner read and nothing to anyone else, not even write. The usual mode for a downloaded cloud key pair and how it differs from 600.
chmod 070: Group Only Access and the First Match Rule
070 grants the group everything and the owner nothing. The owner really is denied, because the kernel checks one class only, and this mode proves it.
chmod 007: Everyone Else Gets Everything, the Owner Gets Nothing
007 gives every other account full access while locking out the owner and the group. Almost always a typo for 700, and a lesson in how chmod is authorised.
chmod 000: No Permissions for Anyone, and What Still Works
000 removes every permission from every class. What still works afterwards: root reads it, the owner can chmod it back, and it can still be deleted.
Category Special bits and concepts
chmod 4755: The setuid Bit and What It Actually Does
4755 sets the setuid bit on top of 755, so the program runs as its owner instead of as the caller. Where it is required and why it is dangerous.
chmod 2775: The setgid Bit on Directories and on Files
2775 adds the setgid bit to 775 so new files inherit the directory's group. The fix for shared directories where the team cannot edit each other's files.
chmod 1777: The Sticky Bit and Why /tmp Needs It
1777 adds the sticky bit to a world writable directory so only a file's owner can delete it. The mode of /tmp and the fix for any shared drop directory.
The Execute Bit on a Directory Means Traverse, Not Run
On a directory, execute grants the right to resolve names through it and read grants the right to list them. Why a directory at 644 cannot be entered.
umask: How the Default Mode of a New File Is Decided
umask removes permission bits from newly created files and directories. Why 022 gives 644 and 755, and why a new file is never executable.
Symbolic chmod Notation: u, g, o, a With Plus, Minus and Equals
Symbolic mode changes one class at a time instead of setting all nine bits. How plus, minus and equals differ, and what the capital X form is for.
Four Digit Octal Modes Against Three Digit Ones
The leading digit of a four digit mode carries setuid, setgid and the sticky bit. When 0755 and 755 differ, and what GNU chmod does to directories.
Recursive chmod and Why 755 Across a Source Tree Is Wrong
chmod -R applies one mode to files and directories alike, which is almost never what you want. The find and capital X patterns that do the job properly.
chmod +x: Making a File Executable and the umask Catch
chmod +x adds the execute bit, but without a class it is masked by the umask. Why scripts also need read, and how to record the bit in version control.
How to Read an ls -l Permission String Such as rwxr-xr-x
The ten characters at the start of an ls -l line decode to a file type and three permission classes. What s, S, t, T and a trailing plus mean.