How Linux permissions work
Every file has three sets of permissions: for its owner, its group, and others (everyone else). Each set can allow read (r = 4), write (w = 2) and execute (x = 1). Add the numbers for each set and you get the familiar three-digit mode: rwx = 7, r-x = 5, so rwxr-xr-x is 755.
For a folder the meanings shift slightly: read lets you list its contents, write lets you create and delete files in it, and execute lets you enter it (cd) and reach the files inside.
Which permissions should I use?
| Mode | Symbolic | Typical use |
|---|---|---|
| 644 | rw-r--r-- | Normal files: web pages, config files, source code |
| 755 | rwxr-xr-x | Folders, scripts and programs everyone may run |
| 600 | rw------- | SSH private keys, .env files, anything secret. SSH refuses keys that others can read. |
| 700 | rwx------ | Your ~/.ssh folder and other private folders |
| 664 / 775 | rw-rw-r-- | Files and folders a team shares through a common group |
| 777 | rwxrwxrwx | Almost never. Anyone on the machine can change or replace the file. |
Special bits
- Setuid (4000): a program runs with its owner's rights.
passwduses it to update the password file. Shown assin the owner's execute slot. - Setgid (2000): on a folder, new files inherit the folder's group, which keeps shared project folders tidy. Shown as
sin the group slot. - Sticky bit (1000): in a shared folder, users can delete only their own files.
/tmpis1777. Shown ast.
A capital S or T means the special bit is set but execute is not, which is usually a mistake.
What umask does
The umask removes permissions from new files and folders. New files start from 666 and folders from 777, then the umask bits are taken away. With the common umask 022, new files get 644 and new folders 755. A stricter 077 gives 600 and 700.
Frequently asked questions
What does chmod 755 mean?
The owner can read, write and execute (7); the group and everyone else can read and execute (5). It is the usual setting for folders and for scripts or programs that everyone may run.
What is the difference between 644 and 755?
755 adds execute permission for everyone. Use 644 for ordinary files and 755 for folders and executable scripts.
Why is chmod 777 dangerous?
Every user and every process on the machine can modify or replace the file. On a web server that can let an attacker who gains limited access change your code. Fix ownership with chown, or use group permissions, instead.
How do I apply permissions recursively?
chmod -R 755 folder changes everything, but it also makes plain files executable. The find commands above set folders and files separately, which is usually what you want.
Does this work on macOS?
Yes. macOS uses the same Unix permission model and chmod syntax.