Unix file permissions

Three classes, three permissions

Every file and directory records an owner, a group, and nine permission bits: read (r), write (w) and execute (x) for each of three classes. The owner is called u (user) by chmod, the group g, and everyone else o (others). When you access a file, the system uses only the first class that applies to you, so an owner is held to the owner bits even if “others” are allowed more.

On a directory the letters mean something different. Read lets you list the names inside, write lets you create, delete and rename entries, and execute lets you enter the directory and reach anything in it by name. Deleting a file is a change to its directory, which is why a read-only file can still be removed from a directory you can write to.

Octal and symbolic notation

Each class’s permissions add up to one octal digit: read is 4, write 2, execute 1. The mode 750 is therefore owner 7 (read, write, execute), group 5 (read, execute) and others 0 (nothing). ls -l shows the same thing as a string, with a file-type character first:

-rwxr-x---   file, mode 750
drwxr-xr-x   directory, mode 755

A fourth, leading digit holds the special bits: setuid (4), setgid (2) and sticky (1). They appear in the execute slots as s or t, for example /tmp is drwxrwxrwt, mode 1777.

chmod 640 file sets a mode outright. Symbolic arguments change it relative to what’s there: chmod g+w file adds group write, chmod o-rwx file removes everything from others, and chmod u=rw,go=r file sets each class exactly.

Common pitfalls

• Recursive changes hit directories too. chmod -R 644 removes execute from every directory, making them impossible to enter. The capital X in chmod -R u=rwX,go=rX adds execute to directories only.
• 777 is not a fix. It lets every account on the machine change the file. Give access to the specific user or group that needs it.
• SSH is strict. OpenSSH ignores private keys readable by others; keys should be 600 and ~/.ssh should be 700.
• Parent directories matter. Opening a file needs execute on every directory along its path.
• New files start from the umask. A umask of 022 means new files get 644 and new directories 755.