Fundamentals
File Permissions
chmod demystified — who can read, write, and execute files, how permission numbers work, reading ls -l output, SSH key requirements, and advanced SUID/SGID/Sticky bits.
7 sections
permissions mastery
~25 min
estimated reading
Beginner
no prerequisites
What is chmod?
chmod stands for Change Mode. It controls who can do what with a file or folder on Linux. Every file has permissions that determine whether the owner, the group, or everyone else can read it, write to it, or execute it.
The Three Types of People
Every file in Linux has permissions for three categories of people:
Owner
The person who created the file. Has the most control over it. Usually you.
Group
A collection of users who share access. Files can belong to a group like 'developers' or 'admins'.
Others
Everyone else on the system — people who are neither the owner nor in the group.
Think of a document at work. The Owner is the person who wrote it — they can edit, share, or delete it. The Group is the team (like “Marketing”) who can read it but not edit it. Others are everyone else in the company — maybe they can't see it at all.
Key Takeaway
chmod controls file permissions for three categories: Owner (the creator), Group (a shared team), and Others (everyone else). Each gets their own set of permissions independently. A file can be wide open for the owner but locked for everyone else.
The Three Permissions
For each of the three types of people (owner, group, others), there are exactly three possible permissions: read, write, and execute. Each can be independently turned on or off.
rvalue = 4
Read
For a File
Open and view the file contents
For a Directory
List what's inside the directory (ls)
wvalue = 2
Write
For a File
Modify, edit, or delete the file
For a Directory
Create, delete, or rename files inside
xvalue = 1
Execute
For a File
Run it as a program or script
For a Directory
Enter the directory (cd)
The Number System
Each permission has a numeric value. You add them together to get the permission number for each person:
| Permission | Value | Means |
|---|---|---|
| r | 4 | Can read the file |
| w | 2 | Can write/modify the file |
| x | 1 | Can execute the file |
| rw | 4+2 = 6 | Read and write |
| rx | 4+1 = 5 | Read and execute |
| rwx | 4+2+1 = 7 | Full access (read, write, execute) |
| - | 0 | No access at all |
Key Takeaway
r=4, w=2, x=1. Add them to get permission numbers. 7 = full access (4+2+1). 6 = read+write. 5 = read+execute. 4 = read only. 0 = no access. These three digits (one per person type) make up every chmod command.
Reading chmod Numbers
Now that you know the permission values, reading any chmod command becomes straightforward. Every chmod command has 3 digits — one for owner, one for group, one for others.
chmod 754 — A Full Example
Common chmod Numbers Decoded
chmod 777Owner
Group
Others
Everyone has full access. Rarely needed. Usually a security risk.
chmod 755Owner
Group
Others
Owner has full access. Others can read and execute. Common for public scripts.
chmod 700Owner
Group
Others
Owner only. Nobody else can even see the contents. Used for private folders like ~/.ssh/
chmod 644Owner
Group
Others
Owner can read+write. Everyone else can only read. Common for config files.
chmod 600Owner
Group
Others
Owner can read+write. Nobody else has any access. Required for SSH private keys.
chmod 700 = Locked in YOUR personal drawer. Only you can see it.
chmod 755 = Pinned on the notice board. Everyone can READ it, but only you can EDIT it.
chmod 777 = Anybody can read it, edit it, and do whatever they want. (Not safe!)
chmod 600 = In your personal folder. Only you can read and edit. Nobody else even knows it exists.
Click the Play button above to start!
Watch the commands execute step by step
Key Takeaway
chmod 3-digit format: digit 1 = owner, digit 2 = group, digit 3 = others. Each digit is the sum of r(4) + w(2) + x(1). 7 = full, 5 = read+execute, 4 = read only, 0 = no access. Most files are 644 (owner rw, others r). Most scripts are 755 (owner rwx, others rx). Private keys are 600.
Reading Permission Strings
When you run ls -l, you see permission strings like -rwxr-xr--. At first they look cryptic, but they follow a simple pattern you can decode in seconds once you know the structure.
The Permission String Structure
-rwxr-xr-- 1 charith charith 1024 Feb 18 10:30 notes.txt-Type
'-' = regular file 'd' = directory
rwxOwner
r=read, w=write, x=execute 7 = full access
r-xGroup
r=read, -=no write, x=execute 5 = read+execute
r--Others
r=read, -=no write, -=no execute 4 = read only
The First Character — File or Directory?
First character meaning
| First Character | Meaning |
|---|---|
| d | Directory (folder) — drwxr-xr-x |
| - | Regular file — -rwxr-xr-- |
Real Examples from ls -la
Click the Play button above to start!
Watch the commands execute step by step
Did You Know?
The very first character tells you immediately whether something is a file or folder. d means directory, - means regular file. Just look at the very first character — d for directory, - for file. Simple!
Key Takeaway
Permission strings have 10 characters: 1 type character + 3 owner + 3 group + 3 others. d = directory, - = regular file. Each group of 3 shows r (read), w (write), x (execute), or - (no permission). Read them left to right: type, owner, group, others.
Common Examples & Real-World Use
Let's connect everything to real situations you'll encounter. These are the most common permission patterns and exactly when and why you'd use each one.
Your personal SSH private key
chmod 600-rw-------ONLY you can read and write. No group, no others. If anyone else can read your private key, SSH refuses to use it — it's compromised.
A shell script you want to run
chmod 755-rwxr-xr-xYou have full control (edit + run). Others can run it but not modify it. Standard for publicly available programs.
A website config file
chmod 644-rw-r--r--You can edit it. Web server process (different user) can read it. Nobody else can write to it. Standard for non-executable files.
Your ~/.ssh/ directory
chmod 700drwx------Only you can see what's inside. No group, no others. SSH requires this — it won't work if others can list your .ssh folder.
A shared team folder
chmod 775drwxrwxr-xYou and your group can do everything (create, delete, edit). Others can only read. Good for collaborative team directories.
Key Takeaway
The most important chmod values to memorize: 600 for private files (SSH keys), 700 for private directories (.ssh/), 644 for config files, 755 for scripts and programs. These cover 90% of real-world situations.
SSH & Permissions
SSH has the strictest permission requirements of any common tool. It will flat-out refuse to work if your key files have incorrect permissions — this is intentional, and it makes you safer.
Warning
If you get “Permissions are too open” or “WARNING: UNPROTECTED PRIVATE KEY FILE!” — SSH is rejecting your key because the file permissions are wrong. Fix them with the commands below. This is the most common SSH error beginners hit.
Required SSH Permissions
SSH file permission requirements
| File/Folder | Required Permission | Why |
|---|---|---|
| ~/.ssh/ directory | 700 (drwx------) | Only you can list what's inside — prevents others seeing your keys |
| ~/.ssh/id_rsa (private key) | 600 (-rw-------) | Only you can read — if others can read it, it's compromised |
| ~/.ssh/id_rsa.pub (public key) | 644 (-rw-r--r--) | Public key is meant to be shared — others can read it |
| ~/.ssh/authorized_keys | 600 (-rw-------) | SSH server rejects it if group or others can write to it |
| ~/.ssh/config | 600 (-rw-------) | Config file with connection settings — keep it private |
Click the Play button above to start!
Watch the commands execute step by step
Key Takeaway
SSH requires: ~/.ssh/ = 700, private key = 600, public key = 644, authorized_keys = 600. If you get SSH permission errors, these are the first thing to check and fix. SSH refuses loose permissions as a security feature — it's protecting your access.
Special Permission Bits
Beyond the standard 3 digits, chmod can take a 4th digit at the front for three special permission bits: SUID, SGID, and the Sticky Bit. These are advanced but important — you'll see them on real systems.
chmod 4755SUID — Set User ID
What it does: When you run this file, it runs as the file's OWNER — not as you.
Real example: The passwd command lets regular users change their own password. But passwords are stored in /etc/shadow, which only root can edit. passwd has SUID set — so when you run it, it temporarily runs as root to edit the shadow file.
Analogy: You're an employee, but you have a special key card that temporarily gives you manager-level access for one specific task only.
chmod 2775SGID — Set Group ID
What it does: New files created inside this folder automatically inherit the folder's group instead of the creator's group.
Real example: A shared team project folder with SGID set: when any developer creates a file inside it, it gets tagged with the 'developers' group automatically — even if that developer normally belongs to a different group.
Analogy: A shared team folder — anything you put inside automatically gets tagged with the team name, not your personal name.
chmod 1777Sticky Bit
What it does: In a shared folder, you can only delete YOUR OWN files — not other people's.
Real example: /tmp is a folder where ALL users can create temporary files. Without sticky bit, anyone could delete anyone else's files. With chmod 1777 (sticky), you can only delete files you own.
Analogy: A community fridge at work. Everyone can put their lunch in it, but you can only throw away your own food — not someone else's.
Quick Summary
4th Digit Special Bits
| 4th Digit | Name | What It Does |
|---|---|---|
| 4 | SUID | File runs as the owner (not you) — chmod 4755 |
| 2 | SGID | New files in folder inherit the folder's group — chmod 2775 |
| 1 | Sticky Bit | You can only delete your own files in shared folder — chmod 1777 |
Key Takeaway
Special bits (4th digit): SUID(4) makes files run as their owner — used for commands like passwd that need temporary root access. SGID(2) auto-tags new files with the folder's group — great for team projects. Sticky Bit(1) protects shared folders so users can only delete their own files — used on /tmp.
File Permissions Quiz
What does chmod stand for?
Permissions Flashcards
Click any card to flip and reveal the definition.