Linux · users & permissions

chmod

who may do what

chmod sets the mode of a file: read, write and execute, once each for the owner, the group and everyone else. It takes the mode as three octal digits, or as letters that change only the bits you name and leave the rest alone.

Each digit is a sum — read 4, write 2, execute 1 — so 640 is "owner reads and writes, group reads, others nothing".

Changes

The mode bits

rwx for user, group, other

Octal form

644, 755, 600

sets all nine bits at once

Symbolic form

u+x, go-w

adjusts only what is named

Allowed for

The owner

and root

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ chmod 640 secrets.env

$ ls -l secrets.env

1-rw-r----- 1 user www-data 412 Sep 30 10:12 secrets.env

2$ chmod u+x,go-rwx deploy.sh

$ ls -l deploy.sh

3-rwx------ 1 user user 1830 Sep 29 17:03 deploy.sh

4$ chmod -R g+w shared/

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

640, digit by digit

6 is 4+2, read and write, for the owner. 4 is read for the group www-data. 0 is nothing for everyone else.

The symbolic form names who, then what

u is the owner, g the group, o others. u+x adds execute for the owner; go-rwx removes everything from group and others.

Only the named bits changed

The owner kept read and write and gained execute. Group and others lost every permission they had.

-R applies it to a whole tree

Every file and directory under shared/ gains group write. Powerful, and rarely what you want for both files and directories alike.

Switches

A switch changes how the command behaves. These are the ones used day to day; man chmod lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-R: Recursive: apply the change to a directory and everything beneath it.
-v: Verbose: print a line for every file processed.
-c: Changes: print a line only for the files that were actually changed.
-f: Quiet: suppress most error messages.
--reference=FILE: Copy the mode from another file instead of naming one.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

chmod +x script.sh

Makes a script executable for everyone who can read it.

chmod 600 ~/.ssh/id_ed25519

The mode SSH requires on a private key — it refuses to use one that others can read.

chmod -R u=rwX,go=rX public/

Capital X adds execute only to directories and to files that already had it — the right way to open up a tree.

stat -c "%a %n" file

Prints the current mode in octal, for when the letters are hard to read.

In cybersecurity

Permission bits are the first and most-used access control on the system, and the common mistakes are all in the direction of too much.

Never 777

It lets every user and every compromised service modify the file. It "fixes" a permission error by removing the protection.

Set-uid and set-gid

A leading 4 or 2 makes a program run as its owner or group. On a root-owned binary that is a direct path to root; grant it almost never.

Recursive changes

"chmod -R 755" marks every file executable; "chmod -R 644" makes every directory unenterable. Use X, or find with -type.

Filed under

Users & permissions

Read alongside

chownChanges which user and which group own a file or directory.lsLists the contents of a directory — names, and with -l the type, permissions, owner, size and date of each entry.