Fix: Permission denied when running a script (chmod +x)

bash: ./deploy.sh: Permission denied
zsh: permission denied: ./deploy.sh
-bash: /opt/app/run.sh: Permission denied

The shell found the file but the kernel refused to run it. Running a file needs the execute permission bit on the file for your user, read permission for the interpreter to read it, and a file system that allows execution at all.

Cause 1: the execute bit is not set

This is by far the most common case. Files created by an editor, downloaded, extracted from a zip or copied from Windows have no execute bit.

ls -l deploy.sh
# -rw-r--r-- 1 alice alice 512 Oct 10 09:12 deploy.sh   <- no x anywhere

chmod +x deploy.sh        # or chmod u+x to allow only the owner
./deploy.sh

If you cannot or do not want to change the file, run it through the interpreter instead; that only requires read permission: bash deploy.sh or python3 tool.py.

Cause 2: the file system is mounted noexec

Many systems mount /tmp, /dev/shm, home directories on shared storage, USB sticks, and some network shares with the noexec option. chmod +x succeeds but execution is still refused.

findmnt -T deploy.sh
# TARGET SOURCE    FSTYPE OPTIONS
# /tmp   tmpfs     tmpfs  rw,nosuid,nodev,noexec,relatime

# Either run through the interpreter
bash /tmp/deploy.sh
# or move the script somewhere executable
mv /tmp/deploy.sh ~/bin/ && ~/bin/deploy.sh

Cause 3: you are not the owner and the mode excludes you

ls -l /opt/app/run.sh
# -rwx------ 1 root root 2048 Oct 10 09:12 run.sh   <- only root may read or run it

sudo /opt/app/run.sh                     # run as root if that is intended
sudo chown alice:alice /opt/app/run.sh   # or make yourself the owner
sudo chmod 755 /opt/app/run.sh           # or let everyone read and execute

Careful: chmod 777 and chmod -R on system directories are common mistakes that open files to every user and can break sudo or SSH, which refuse to work with overly open permissions. Change only the file you need, to the least permission that works.

Cause 4: a directory on the way is not searchable

To reach /opt/app/run.sh you need execute (search) permission on /opt and /opt/app. namei -l /opt/app/run.sh prints the permission of every component so you can see which one blocks you.

Check that it is fixed

ls -l deploy.sh          # shows x for your user, for example -rwxr-xr-x
./deploy.sh && echo "ran fine"

When it is not what you think

• bad interpreter: Permission denied names the interpreter in the shebang line, which may itself be non-executable or on a noexec mount, for example a Python inside a virtual environment under /tmp.
• Permission denied from a command inside the script (for example writing to /var/log) is about that command’s target, not about running the script. Read the full line: it names the file it could not open.
• A script that must bind a port below 1024, read /etc/shadow or write to /etc needs root: run it with sudo, or give the binary a capability such as cap_net_bind_service.
• Permission denied (publickey) is SSH refusing your key, nothing to do with file modes on the client.
• SELinux can deny execution of a file with the right mode. ausearch -m avc -ts recent shows a denial; restorecon -v file fixes a wrong label.

Official documentation

• GNU coreutils: chmod
• mount(8): noexec and other mount options