chmod

What it does

How to write it

chmod [OPTION]... MODE[,MODE]... FILE...
chmod [OPTION]... OCTAL-MODE FILE...
chmod [OPTION]... --reference=RFILE FILE...

Main parts

u g o a

Who: user (owner), group, others, all.

+ - =

Add, remove, set exactly.

r w x

Read, write, execute.

X

x only for directories and files that already have an x.

s

SUID (with u) or SGID (with g).

t

Sticky bit.

NNN / NNNN

Numbers: owner, group, others (and the special bits in front).

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Make a script executable

   $chmod +x backup.sh
   $./backup.sh

   +x = a+x (filtered by the umask).

2. 2Normal file and private file

   $chmod 644 index.html
   $chmod 600 ~/.ssh/id_ed25519

   SSH refuses private keys that others can read.

3. 3Team folder without access for others

   #chmod 770 /srv/sales

   Owner and group full, others nothing.

4. 4Shared folder with SGID and sticky

   #chmod 3770 /srv/sales
   $ls -ld /srv/sales
   drwxrws--T. 2 root sales 6 Oct 25 10:40 /srv/sales

   New files get the group; users delete only their own files.

5. 5Add and remove in one command

   $chmod g+w,o-rwx shared.txt

   Letters change only what you name.

6. 6Give folders x but not files

   #chmod -R u=rwX,g=rX,o= /srv/project

   Capital X: folders get x, normal files do not.

7. 7Copy the mode of another file

   $chmod --reference=index.html about.html

   Same permissions.

8. 8Remove a dangerous SUID bit

   #chmod u-s /usr/local/bin/oldtool

   SUID programs run as their owner — a big risk if the owner is root.

9. 9Find world-writable files (security)

   #find / -xdev -type f -perm -0002 -ls 2>/dev/null

   Anybody can change these files.

10. 10Find SUID and SGID programs (security)

    #find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null

    Compare the list with a known good list.

11. 11Protect a config with secrets

    #chmod 640 /etc/myapp/db.conf; chgrp myapp /etc/myapp/db.conf

    The service group reads it; others cannot.

12. 12See the mode as a number

    $stat -c '%a %A %n' /etc/shadow /tmp
    0 ---------- /etc/shadow
    1777 drwxrwxrwt /tmp

    %a = number, %A = letters.

Nothing matches this filter.

Exit codes