LFCA 25 🐧 Changing Permissions — chmod
The previous chapter explained what file permissions are. This chapter is about changing them. The tool is chmod — “change mode” — and it is one of the most frequently used commands in Linux administration. It accepts two notations (numeric and symbolic), several flags, and a recursive mode that applies changes to an entire directory tree. The syntax is simple, but the consequences are not: a wrong chmod can make a web server unable to read its own files, lock a user out of their home directory, or open a private key to the world. This chapter covers the full chmod command: both notations with their operators and edge cases, the recursive flag and the capital X that makes it safe for trees, the reference flag that copies permissions from another file, the --preserve-root protection, and the patterns that keep permission changes predictable and reversible.
Key point: chmod changes the permission bits of a file or directory. Numeric notation (chmod 644 file) sets all nine bits at once. Symbolic notation (chmod u+x file) changes only the specified bits and leaves the rest alone. The -R flag applies the change recursively to a directory tree, and capital X in symbolic notation adds execute only to directories and already-executable files, which is what makes chmod -R a+rX safe. chmod --reference=ref file copies the mode from a reference file. Only the file’s owner or root can change its permissions.
Numeric notation
Numeric notation sets all nine permission bits in a single command. Each digit is the sum of the bits for one identity class: read is 4, write is 2, execute is 1. The digits are ordered owner, group, others. A fourth digit at the front sets the special bits (setuid=4, setgid=2, sticky=1).
chmod 755 script.sh # rwxr-xr-x
chmod 644 document.txt # rw-r--r--
chmod 600 private.key # rw-------
chmod 700 ~/private # rwx------
chmod 2775 shared/ # rwxrwsr-x (setgid)
chmod 1777 /tmp # rwxrwxrwt (sticky)Why numeric is absolute. The numeric form sets every bit. Whatever the file’s previous mode was, after chmod 644 it is exactly 644. There is no ambiguity, no dependence on current state. This is why numeric notation is preferred for scripts and configuration management: the result is deterministic.
Why the leading zero is sometimes written. chmod 0644 file is the same as chmod 644 file. The leading zero is a reminder that the mode is octal, and it is required when a special bit is involved because the four-digit form makes the special bit explicit. Some style guides always use four digits for consistency; others use three when no special bit is set. Both work.
Why the numbers must be octal. The mode is an octal number, not decimal. The digits 0 through 7 are valid; 8 and 9 are not. chmod 888 file is an error. This is occasionally a surprise to people who assume decimal, but the permission bits are arranged in groups of three, and three bits can represent eight values (0–7), which is exactly the octal digit range.
Why the special bits are a separate digit. Setuid, setgid, and sticky are not part of the nine regular bits. They occupy their own positions, and the four-digit form is how they are set alongside the regular bits. 4755 is setuid plus 755. 2775 is setgid plus 775. 1777 is sticky plus 777. Combining them, 6777 would be setuid, setgid, and sticky with full permissions.
Why the mode is displayed as four digits in some tools.
stat -c '%a' fileprints the mode in octal, and it includes the special bits as a leading digit when present.stat -c '%a' /tmpprints1777, whilestat -c '%a' file.txtprints644. The leading digit is present only when a special bit is set, which is why some files show three digits and some show four.
Symbolic notation
Symbolic notation changes only the bits you specify. The syntax is [who][operator][permissions], where who is u, g, o, or a (all), operator is +, -, or =, and permissions is any combination of r, w, x, and the special bits.
chmod u+x script.sh # add execute for owner
chmod go-w file.txt # remove write for group and others
chmod a+r document.txt # add read for everyone
chmod u=rw,g=r,o= file.txt # set exact permissions
chmod +x script.sh # add execute for all (who omitted)
chmod -R a+rX /var/www # recursive, safe executeWhy omitting who means “all.” chmod +x file is equivalent to chmod a+x file. The a is implied when no who is given. This is a convenience that works because the common case is granting a permission to everyone. It is also a source of surprise: chmod +w file grants write to owner, group, and others, which is usually not what is intended.
Why = is different from + and -. The + and - operators modify existing bits: they add or remove specific permissions while leaving the others untouched. The = operator sets the class to exactly the listed permissions, removing any that are not listed. chmod u=rw file sets the owner’s permissions to rw, removing execute if it was set. chmod u+rw file would add rw without removing execute. The distinction matters when the current mode is unknown or when you want to guarantee a specific state for one class.
Why multiple clauses can be comma-separated. chmod u=rw,g=r,o= file sets all three classes in one command. Each clause is independent, and the operations apply in the order written. This is the symbolic equivalent of a numeric mode, and it is useful when you want the precision of symbolic notation with the completeness of numeric.
Why symbolic notation is preferred for incremental changes. When you want to add execute permission without touching anything else, chmod +x file expresses exactly that. The numeric alternative would require knowing the current mode, computing the new one, and setting it. If the current mode was not what you assumed, the numeric command would silently change unrelated bits. Symbolic notation changes only what you specify, which makes it safer when the starting state is uncertain.
The capital X special case. chmod +X adds execute permission only if the target is a directory or already has execute permission for some class. This is the correct way to apply execute recursively to a tree that contains both files and directories. chmod -R a+x /var/www would make every file executable, including HTML and images, which is wrong. chmod -R a+rX /var/www adds read for everyone and execute only to directories and already-executable files, which is what is actually wanted.
The recursive flag
-R applies the change to every file and directory in the tree rooted at the given path.
chmod -R 755 /srv/app
chmod -R u+rwX,go+rX /srv/sharedWhy recursion is necessary for trees. A directory tree has thousands of files and directories, and applying the same change to each one manually is impractical. -R walks the tree and applies the mode to every entry. This is the standard way to set permissions after deploying an application or copying a directory.
Why -R with numeric modes is dangerous. chmod -R 644 /var/www sets every file and directory to 644. Directories need execute to be traversable, so 644 on a directory makes it inaccessible. The result is a website that cannot be served because the web server cannot enter the directories. The capital X in symbolic notation is the fix: chmod -R u=rwX,go=rX /var/www gives files rw and directories rwx, which is the intended result.
Why -R with symbolic modes is usually the right choice. Symbolic notation with X handles the file-versus-directory distinction correctly. chmod -R u+rwX,go+rX /srv/shared grants read to everyone, write to the owner, and execute where appropriate. This is the standard pattern for making a directory tree readable and traversable without making every file executable.
Why -R should be used with care on symlinks. By default, chmod -R does not follow symbolic links; it changes the link itself (which usually has no effect on Linux) rather than the target. The -H, -L, and -P flags control this behavior. -P (the default) does not follow any symlinks. -H follows symlinks given on the command line. -L follows all symlinks. For most cases, the default is correct: you do not want a recursive chmod to reach outside the tree through a symlink.
Why
chmod -R 777is the wrong fix for permission problems. When a web application cannot write to its upload directory, the quick fix people reach for ischmod -R 777. This makes everything world-writable, which solves the immediate problem and creates a security hole. The right fix is to identify which user the web server runs as (oftenwww-data) and grant that user or group the specific permissions needed:chown -R www-data:www-data uploads/andchmod -R 755 uploads/. Permission problems are almost always ownership problems, not mode problems.
The reference flag
--reference copies the mode from another file, which is useful when you want a new file to match an existing one without knowing its mode.
chmod --reference=template.conf new.confWhy copying a reference is useful. When a project has a canonical file with the correct permissions — a template, a known-good configuration — and a new file should match it, --reference expresses that directly. The alternative is to read the mode with stat, then apply it with chmod, which is two steps and can be automated into one. The reference form is the one-step version.
Why the reference must be readable. chmod --reference=ref file reads the mode of ref. If ref does not exist or is not readable, the command fails. The reference is not modified; it is only read.
Why stat and chmod are often used together anyway. For scripting, extracting the mode with stat -c '%a' and applying it with chmod gives more control — you can transform the mode before applying it. chmod --reference is the direct copy, which is what is wanted most of the time.
Who can change permissions
Only the file’s owner or root can change its permissions. This is enforced by the kernel: a chmod attempt by anyone else fails with “Operation not permitted.”
$ ls -l file.txt
-rw-r--r-- 1 alice alice 0 Mar 15 10:00 file.txt
$ chmod 600 file.txt
$ ls -l file.txt
-rw------- 1 alice alice 0 Mar 15 10:00 file.txt
# As bob:
$ chmod 644 file.txt
chmod: changing permissions of 'file.txt': Operation not permittedWhy ownership is the gate. Permissions are the owner’s declaration of who may access the file. If anyone could change them, the model would be meaningless. The owner sets the policy; the kernel enforces it.
Why root can change any file. Root is exempt from permission checks, including the check on chmod. Root can change the mode of any file on the system. This is necessary for administration — recovering from a mistake, fixing a misconfigured deployment — and it is another reason root access is dangerous.
Why the group and others cannot grant themselves more. A user in the file’s group cannot chmod the file to grant themselves write permission. The group’s permissions are set by the owner. Only the owner or root can change them.
Complete Example Session
# ============================================
# PART 1: NUMERIC MODES
# ============================================
touch file.txt
ls -l file.txt
# -rw-r--r-- 1 alice alice 0 Mar 15 10:00 file.txt
chmod 755 file.txt
ls -l file.txt
# -rwxr-xr-x 1 alice alice 0 Mar 15 10:00 file.txt
chmod 644 file.txt
ls -l file.txt
# -rw-r--r-- 1 alice alice 0 Mar 15 10:00 file.txt
chmod 600 file.txt
ls -l file.txt
# -rw------- 1 alice alice 0 Mar 15 10:00 file.txt
# ============================================
# PART 2: SYMBOLIC MODES
# ============================================
chmod u+x file.txt
ls -l file.txt
# -rwx------ 1 alice alice 0 Mar 15 10:00 file.txt
chmod go+r file.txt
ls -l file.txt
# -rwxr--r-- 1 alice alice 0 Mar 15 10:00 file.txt
chmod a-x file.txt
ls -l file.txt
# -rw-r--r-- 1 alice alice 0 Mar 15 10:00 file.txt
chmod u=rw,g=r,o= file.txt
ls -l file.txt
# -rw-r----- 1 alice alice 0 Mar 15 10:00 file.txt
# ============================================
# PART 3: THE = OPERATOR VS +/-
# ============================================
chmod 755 file.txt
chmod u+rw file.txt
ls -l file.txt
# -rwxr-xr-x 1 alice alice 0 Mar 15 10:00 file.txt
# (execute still set — + added to existing)
chmod u=rw file.txt
ls -l file.txt
# -rw-r-xr-x 1 alice alice 0 Mar 15 10:00 file.txt
# (execute removed — = set exactly)
# ============================================
# PART 4: RECURSIVE WITH CAPITAL X
# ============================================
mkdir -p /tmp/site/css /tmp/site/js
touch /tmp/site/index.html /tmp/site/css/style.css /tmp/site/js/app.js
chmod +x /tmp/site/js/app.js
chmod -R a+rX /tmp/site
ls -l /tmp/site
# drwxr-xr-x ... /tmp/site
# -rw-r--r-- ... index.html (no execute — not already executable)
# drwxr-xr-x ... css
# -rw-r--r-- ... style.css
# drwxr-xr-x ... js
# -rwxr-xr-x ... app.js (execute retained — was already executable)
# ============================================
# PART 5: RECURSIVE WITH NUMERIC (DANGEROUS)
# ============================================
# chmod -R 644 /tmp/site
# ls -ld /tmp/site
# drw-r--r-- ... /tmp/site
# Directories lose execute — cannot traverse.
# cd /tmp/site
# bash: cd: /tmp/site: Permission denied
# Fix:
chmod -R u+rwX,go+rX /tmp/site
# ============================================
# PART 6: REFERENCE MODE
# ============================================
touch template.conf new.conf
chmod 640 template.conf
chmod --reference=template.conf new.conf
ls -l template.conf new.conf
# -rw-r----- ... template.conf
# -rw-r----- ... new.conf
# ============================================
# PART 7: SPECIAL BITS
# ============================================
chmod 4755 /tmp/tool
ls -l /tmp/tool
# -rwsr-xr-x ... /tmp/tool
chmod 2775 /tmp/shared
ls -ld /tmp/shared
# drwxrwsr-x ... /tmp/shared
chmod 1777 /tmp/open
ls -ld /tmp/open
# drwxrwxrwt ... /tmp/open
# ============================================
# PART 8: PERMISSION DENIED
# ============================================
# As a user who is not the owner:
# chmod 644 /etc/passwd
# chmod: changing permissions of '/etc/passwd': Operation not permitted
# ============================================
# PART 9: VERIFY WITH STAT
# ============================================
stat -c '%a %n' file.txt
# 644 file.txt
stat -c '%a %n' /tmp/open
# 1777 /tmp/open
# ============================================
# PART 10: COMMON PATTERNS
# ============================================
# Web directory
chmod 755 /var/www/html
chmod 644 /var/www/html/*.html
# Private key
chmod 600 ~/.ssh/id_rsa
# Script
chmod 755 deploy.sh
# Shared group directory
chmod 2775 /srv/project
# ============================================
# PART 11: WHAT NOT TO DO
# ============================================
# chmod -R 777 /var/www
# World-writable web root — a security hole.
# chmod 777 /etc/passwd
# World-writable identity file — a disaster.
# chmod -R 644 /srv/app
# Directories lose execute — application breaks.Each part covers one aspect. Parts 1 through 3 show the notations. Parts 4 and 5 show recursion and the X fix. Parts 6 through 9 show reference mode, special bits, denial, and verification. Parts 10 and 11 show the patterns and the anti-patterns.
Quick Reference
Numeric Values
| Value | Permissions |
|---|---|
0 | --- |
1 | --x |
2 | -w- |
3 | -wx |
4 | r-- |
5 | r-x |
6 | rw- |
7 | rwx |
Common Modes
| Mode | Symbolic | Use |
|---|---|---|
644 | rw-r--r-- | Regular files |
600 | rw------- | Private files |
755 | rwxr-xr-x | Executables, directories |
700 | rwx------ | Private directories |
2775 | rwxrwsr-x | Shared group directory |
1777 | rwxrwxrwt | Sticky directory |
Symbolic Operators
| Operator | Effect |
|---|---|
+ | Add permission |
- | Remove permission |
= | Set exactly |
Symbolic Who
| Symbol | Class |
|---|---|
u | Owner |
g | Group |
o | Others |
a | All three |
chmod Flags
| Flag | Effect |
|---|---|
-R | Recursive |
-v | Verbose |
-c | Report changes only |
--reference=ref | Copy mode from ref |
--preserve-root | Refuse to operate on / |
-H | Follow command-line symlinks |
-L | Follow all symlinks |
-P | Follow no symlinks (default) |
Capital X vs Lowercase x
| Symbol | Effect |
|---|---|
x | Set execute unconditionally |
X | Set execute only if directory or already executable |
Best Practices
✅ Do This:
# Use symbolic notation for incremental changes
chmod +x script.sh # ✅
# Use capital X for recursive trees
chmod -R a+rX /var/www # ✅
# Use numeric notation for exact modes
chmod 600 ~/.ssh/id_rsa # ✅
# Use setgid for shared group directories
chmod 2775 /srv/project # ✅
# Use the sticky bit on world-writable directories
chmod 1777 /tmp # ✅
# Verify with ls -l or stat after changing
stat -c '%a %n' file.txt # ✅
# Use --reference to match an existing file
chmod --reference=template.conf new.conf # ✅❌ Don’t Do This:
# Don't use 777 as a fix
chmod 777 /var/www # security hole # ⚠️
# Don't use numeric recursion on mixed trees
chmod -R 644 /srv/app # directories lose execute # ⚠️
# Don't omit who in symbolic mode without meaning "all"
chmod +w file # grants write to owner, group, AND others # ⚠️
# Don't use lowercase x recursively
chmod -R a+x /var/www # makes every file executable # ⚠️
# Don't chmod files you don't own
chmod 644 /etc/passwd # operation not permitted # ⚠️
# Don't forget the special bit digit
chmod 755 /tmp/open # removes sticky if it was set # ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
chmod -R 644 on a tree | Directories lose execute | Use a+rX |
chmod +w without who | Grants write to all classes | Specify u+w |
= removes unlisted bits | Unexpected removal | Use +/- for incremental |
8 or 9 in numeric mode | Invalid octal | Only 0–7 |
| Forgetting the special bit digit | Sticky/setuid removed | Four-digit form |
chmod on a file you don’t own | Operation not permitted | Check ownership |
| Recursive through symlinks | Changes outside tree | Understand -H/-L/-P |
| Numeric mode on mixed tree | Wrong for one type | Symbolic with X |
Real-World Examples
1. Make a script executable
chmod +x deploy.sh2. Lock down a private key
chmod 600 ~/.ssh/id_rsa3. Web root
chmod 755 /var/www/html
chmod 644 /var/www/html/*.html4. Recursive safe permissions
chmod -R u+rwX,go+rX /srv/shared5. Shared group directory
chmod 2775 /srv/project6. Sticky directory
chmod 1777 /tmp7. Copy mode from a reference
chmod --reference=template.conf new.conf8. Remove group and others write
chmod go-w file.txt9. Set exact mode for one class
chmod u=rw,g=r,o= file.txt10. Verify with stat
stat -c '%a %n' file.txtVisual: Numeric Mode Construction
┌──────────────────────────────────────────────────────────┐
│ chmod 754 file.txt │
│ │
│ 7 5 4 │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ rwx r-x r-- │
│ │ │ │ │
│ │ │ └── 4 = r (read only) │
│ │ └────────── 5 = r-x (read + execute) │
│ └────────────────── 7 = rwx (read + write + execute) │
│ │
│ Result: -rwxr-xr-- │
│ │
└──────────────────────────────────────────────────────────┘Visual: Symbolic Clause
┌──────────────────────────────────────────────────────────┐
│ chmod u+x file.txt │
│ │ │ │ │
│ │ │ └── permission: x (execute) │
│ │ └──── operator: + (add) │
│ └────── who: u (owner) │
│ │
│ Result: adds execute for the owner only. │
│ │
├──────────────────────────────────────────────────────────┤
│ chmod go-w file.txt │
│ ││ │ │ │
│ ││ │ └── permission: w (write) │
│ ││ └──── operator: - (remove) │
│ │└────── who: g (group) │
│ └─────── who: o (others) │
│ │
│ Result: removes write for group and others. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Capital X Difference
┌──────────────────────────────────────────────────────────┐
│ chmod -R a+x /var/www │
│ │
│ Files: -rwxr-xr-x (every file executable) │
│ Directories: drwxr-xr-x │
│ │
│ ❌ HTML and images are now executable. │
│ │
├──────────────────────────────────────────────────────────┤
│ chmod -R a+rX /var/www │
│ │
│ Files: -rw-r--r-- (no execute added) │
│ Scripts: -rwxr-xr-x (execute retained) │
│ Directories: drwxr-xr-x (execute added) │
│ │
│ ✅ Correct: files stay non-executable, directories │
│ are traversable, existing executables keep execute. │
│ │
└──────────────────────────────────────────────────────────┘Visual: Recursive Numeric Trap
┌──────────────────────────────────────────────────────────┐
│ chmod -R 644 /srv/app │
│ │
│ Before: After: │
│ drwxr-xr-x app drw-r--r-- app │
│ -rw-r--r-- index.html -rw-r--r-- index.html │
│ drwxr-xr-x css drw-r--r-- css │
│ -rw-r--r-- style.css -rw-r--r-- style.css │
│ │
│ The directory "app" now has no execute bit. │
│ No one can cd into it or access files inside. │
│ │
│ Fix: chmod -R u+rwX,go+rX /srv/app │
│ │
└──────────────────────────────────────────────────────────┘Visual: The = Operator
┌──────────────────────────────────────────────────────────┐
│ Starting mode: 755 (rwxr-xr-x) │
│ │
│ chmod u+rw file │
│ → 755 (unchanged — rw already present, x retained) │
│ │
│ chmod u=rw file │
│ → 655 (rw-r-xr-x) │
│ → execute removed because = sets exactly │
│ │
│ + adds, - removes, = sets exactly. │
│ │
└──────────────────────────────────────────────────────────┘Visual: Who Can chmod
┌──────────────────────────────────────────────────────────┐
│ File owner: │
│ ✅ Can chmod │
│ │
│ Root: │
│ ✅ Can chmod any file │
│ │
│ Group member (not owner): │
│ ❌ Cannot chmod │
│ (group permissions apply to access, not to policy) │
│ │
│ Others: │
│ ❌ Cannot chmod │
│ │
│ Policy is set by the owner. │
│ │
└──────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
| Numeric bits | read=4, write=2, execute=1 |
| Special bits | setuid=4, setgid=2, sticky=1 (leading digit) |
| Symbolic who | u, g, o, a |
| Symbolic operators | +, -, = |
| Recursive flag | -R |
| Safe execute | capital X |
| Reference | --reference=ref |
| Who can chmod | Owner or root |
| Verify | ls -l, stat -c '%a' |
Key takeaways:
- Numeric notation sets all bits at once —
chmod 644 fileproduces exactlyrw-r--r--regardless of the previous mode - Symbolic notation changes only what you specify —
chmod u+x fileadds execute for the owner and leaves everything else alone - The
=operator sets a class exactly, while+and-modify incrementally - Omitting
whomeans “all” —chmod +x filegrants execute to owner, group, and others -Rapplies the change recursively, and capitalXadds execute only to directories and already-executable fileschmod -R 644on a tree is a common mistake — directories lose execute and become untraversablechmod -R a+rXis the safe recursive pattern for making a tree readable and traversable- Only the owner or root can change permissions — the kernel enforces this
--reference=refcopies the mode from another file without needing to know its value777is almost never the right answer — permission problems are usually ownership problems, and the fix ischown, notchmod
Remember: chmod is a small command with large consequences. Numeric notation is precise and absolute; symbolic notation is incremental and surgical. Recursion requires care, and the capital X is what makes it safe for trees that contain both files and directories. The habit that matters most is verifying after changing — ls -l or stat — because a misapplied chmod on a directory tree can break an application in ways that are not obvious until it is used.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!