chmod: change file permissions

Updated November 2026

chmod changes who may read, write and execute a file. You can give the new permissions as letters (u+x) or as a three-digit number (755).

chmod [-R] mode file ...

Symbolic modes

Who: u user (owner), g group, o others, a all. What: + add, - remove, = set exactly. Which: r, w, x.

chmod u+x deploy.sh           # make a script executable for its owner
chmod +x deploy.sh            # executable for everyone (respecting umask)
chmod go-w shared.txt         # group and others may no longer write
chmod o= private.txt          # others get no access at all
chmod g=rx,o= /srv/app        # group read and enter, others nothing
chmod -R g+rw /srv/project    # recursively add group read/write

Numeric (octal) modes

Each digit is the sum of read (4), write (2) and execute (1), for owner, group and others in that order.

Mode	Shown as	Typical use
`644`	`rw-r--r--`	Normal files: owner writes, everyone reads
`600`	`rw-------`	Private files: SSH keys, passwords, `.env` files
`640`	`rw-r-----`	Config files a service group must read
`755`	`rwxr-xr-x`	Directories and programs everyone may use
`750`	`rwxr-x---`	Directories for owner and group only
`700`	`rwx------`	Private directories such as `~/.ssh`
`777`	`rwxrwxrwx`	Everyone may do anything: almost never the right answer

chmod 600 ~/.ssh/id_ed25519
chmod 700 ~/.ssh
chmod 644 index.html

Recursive changes: files and directories separately

chmod -R 755 makes every file executable, which is rarely what you want. Directories need x to be entered; ordinary files do not. Use find or a capital X:

find /var/www/site -type d -exec chmod 755 {} +
find /var/www/site -type f -exec chmod 644 {} +
chmod -R u=rwX,go=rX /var/www/site     # X = execute only for directories (and files already executable)

Special bits

Bit	Octal	Effect
SUID	`4000`	A program runs as its owner (e.g. `passwd` runs as root)
SGID	`2000`	On a directory: new files inherit the directory's group. On a program: runs with the file's group.
Sticky	`1000`	On a directory: users may delete only their own files (`/tmp`)

chmod 2775 /srv/shared        # team directory: new files belong to the directory's group
chmod +t /srv/dropbox         # sticky bit
chmod u-s /usr/bin/someprog   # remove SUID

SUID programs are a security risk; see file system security.

"Permission denied" checklist

Check the file: ls -l file. Do you own it, or are you in its group?
Check every directory on the path: you need x on all of them. namei -l /path/to/file shows them all at once.
New group membership needs a new login (or newgrp group).
ACLs (getfacl), SELinux (ls -Z, ausearch -m avc) or a noexec mount can also deny access.

To change the owner instead of the permissions, use chown.