linux · difficulty ◆◆
chmod — change file permissions
Decide who can read, write, and run each file.
$ chmodWhat it does
chmod (change mode) modifies the permission bits on a file or directory. Every file carries three permission trios — owner, group, and other — each with read (r), write (w), and execute (x) bits. chmod lets you set those bits either with symbolic syntax (u+x, g-w) or the compact octal numbers (644, 755).
Why it matters
Permissions are the whole Unix security model: they are how you stop other users reading your files and how you make a script or binary executable. Get chmod wrong and scripts mysteriously say "Permission denied"; get it right and your home directory stays private. The classic mistake — leaving everything world-readable or world-writable — is behind countless security issues.
Example
$ chmod u+x run.sh$ ls -l run.sh
-rw-r--r-- 1 kmail kmail 42 Aug 13 09:00 run.sh
$ chmod u+x run.sh
$ ls -l run.sh
-rwxr--r-- 1 kmail kmail 42 Aug 13 09:00 run.sh
$ ./run.sh
hello from run.shu+x adds execute permission for the owner, which is what makes ./script.sh runnable.
$ chmod 600 secret.txt$ ls -l secret.txt
-rw------- 1 kmail kmail 128 Aug 13 09:02 secret.txtOctal 600 = rw for owner only. This is the right permission for keys and dotfiles with secrets.
Common flags
- u+x / g+w / o-r
- symbolic: who (u/g/o/a) plus operator (+,-,=) plus permission (r/w/x)
- -R
- recursive — apply changes to a directory and everything inside it
- 644 / 755
- octal shorthand: 4=read, 2=write, 1=execute; 644 = rw-r--r--, 755 = rwxr-xr-x
- -v
- verbose — report each file whose mode was changed
- -c
- like -v but only report files that actually changed
- --reference=FILE
- copy the permission bits from another file instead of specifying them
History
Origin
Permissions go back to the very first Unix (1971), where they were stored as three octal digits inside each file's inode. The r/w/x model and the owner/group/other split were part of the original Bell Labs design and have survived essentially unchanged for over fifty years.
Fun fact
The execute bit on a directory means something different than on a file: it is the 'search' bit, controlling whether you may traverse into the directory. That is why a directory is usually 755 (drwxr-xr-x) — so others can enter and read, but not rename or delete your files.