File permissions: chmod, chown and what 755 means

Linux and macOS decide who may read, change or run a file using a simple permission system. Once you can read it, messages like Permission denied become easy to fix.

Reading ls -l

$ ls -l
-rwxr-xr-x  1 ana  staff  1204 Oct  3 09:12 deploy.sh
-rw-r--r--  1 ana  staff   310 Oct  3 09:10 notes.txt
drwxr-x---  4 ana  staff   128 Oct  3 09:00 private

The first character is the type: - for a regular file, d for a directory, l for a symbolic link. The next nine characters are three groups of three:

1. user (the owner, here ana)
2. group (members of the group, here staff)
3. others (everyone else)

Each group shows r (read), w (write) and x (execute), or - if that permission is missing. So rwxr-xr-x means the owner can do everything, and the group and others can read and run but not change the file.

What r, w and x mean for folders

On a directory, r lets you list its contents, w lets you create, rename and delete files inside it, and x lets you enter it with cd and reach the files inside. A folder with r but no x is surprisingly useless, so directories almost always have both.

The numbers: 755, 644, 600

Each permission has a value: read = 4, write = 2, execute = 1. Add them up for each of the three groups and you get a three-digit number.

• 7 = 4+2+1 = rwx
• 6 = 4+2 = rw-
• 5 = 4+1 = r-x
• 4 = r--
• 0 = ---

So 755 is rwxr-xr-x: typical for scripts, programs and directories. 644 is rw-r--r--: typical for ordinary files. 600 is rw-------: private files such as SSH keys. 700 is a private directory, such as ~/.ssh.

Changing permissions with chmod

chmod 755 deploy.sh        # numeric form
chmod +x deploy.sh          # add execute for everyone
chmod u+x,go-w deploy.sh    # owner gets x, group/others lose w
chmod u=rw,go=r notes.txt   # set exactly: same as 644
chmod -R go-rwx private/    # recursively remove group/other access

The letters are u (user), g (group), o (others) and a (all). The symbolic form is handy when you want to change one bit without touching the rest.

Changing the owner with chown

chown sets the owner and optionally the group. Changing a file to a different owner normally requires administrator rights, so you will usually see it with sudo.

sudo chown ana deploy.sh
sudo chown ana:www-data site/        # owner and group
sudo chown -R ana:ana ~/projects     # whole tree

Common pitfalls

• chmod 777 is not a fix. It lets every user on the machine change the file. Find out which user actually needs access and grant only that.
• A script needs x to run as ./script.sh. Without it you get Permission denied. Either chmod +x it or run bash script.sh.
• Recursive chmod hits files and folders alike. chmod -R 644 removes x from directories and locks you out of them. Use find to treat them separately: find dir -type d -exec chmod 755 {} + and find dir -type f -exec chmod 644 {} +.
• Sticking with sudo to work around permission errors in your own project usually means some files were created as root by mistake. Fix ownership once with chown instead.