chmod, short for change mode, is the Linux and Unix command that sets the permission bits of files and directories. It decides who may read, write or execute an object by adjusting three permission sets: one for the owner (user), one for the group and one for all other users, plus three special bits with distinct meanings.
Among Linux permissions tools, chmod has a precise scope: it changes what each class of user may do, while chown changes who owns the object and umask sets the default permissions of newly created files. The command wraps the chmod() and fchmodat() system calls, so the same rules apply whether permissions are changed from a shell, a script or a program.
How Linux permission bits work
Every inode stores a 12-bit mode: nine basic permission bits and three special bits. When a process opens a file, the kernel checks the classes in a fixed order: if the process owns the file, only the owner bits apply; otherwise, if it belongs to the file’s group, only the group bits apply; otherwise the other bits apply. The first matching class decides, so an owner with fewer rights than the group is still restricted.
Read, write and execute mean different things for files and directories. The distinction for directories is the source of many permission errors, as the table shows.
| Permission | On a regular file | On a directory |
|---|---|---|
| Read (r) | Read the file contents | List the names of entries |
| Write (w) | Modify or truncate the contents | Create, delete or rename entries (needs x as well) |
| Execute (x) | Run the file as a program | Enter the directory and access entries by name |
A consequence worth remembering: deleting a file depends on the directory’s write permission, not on the file’s own permissions. Only the file owner or root (more precisely, a process with the CAP_FOWNER capability) may run chmod on a file.
Octal and symbolic notation
chmod accepts two notations. Octal notation sets all bits at once with digits in which read is 4, write is 2 and execute is 1; each digit is the sum for one class. Symbolic notation adds, removes or sets specific bits relative to the current mode with expressions such as u+x, go-w or a=r.
| Octal mode | Symbolic form | Typical use |
|---|---|---|
| 644 | rw-r–r– | Ordinary files readable by everyone |
| 600 | rw——- | Private files such as SSH private keys |
| 640 | rw-r—– | Configuration readable by a service group |
| 755 | rwxr-xr-x | Programs, scripts and public directories |
| 750 | rwxr-x— | Directories shared with one group only |
| 700 | rwx—— | Private directories such as ~/.ssh |
| 777 | rwxrwxrwx | Almost never correct; anyone may modify |
Symbolic notation is safer for targeted changes because it leaves other bits untouched: chmod g+w report.txt grants group write without resetting anything else. Octal notation is clearer for setting a known final state, for example in deployment scripts. The capital `X` in symbolic mode adds execute only to directories and to files that are already executable by someone, which makes chmod -R u=rwX,go=rX dir a safe way to fix a whole tree.
Special bits: setuid, setgid and sticky
The three special bits form a fourth, leading octal digit and change how programs run or how directories behave. They appear in ls -l output as s or t in place of the execute position, or as a capital S or T when the underlying execute bit is missing.
| Bit | Octal value | Effect on files | Effect on directories |
|---|---|---|---|
| Setuid | 4000 | Program runs with the owner’s user ID | Ignored on Linux |
| Setgid | 2000 | Program runs with the file’s group ID | New entries inherit the directory’s group |
| Sticky | 1000 | Ignored on modern Linux | Only the owner of an entry may delete or rename it |
/usr/bin/passwd is setuid root so that ordinary users can update the protected password database, and /tmp uses mode 1777 so that everyone can create files but nobody can delete files belonging to others. Setuid programs are a classic privilege-escalation target; Linux ignores setuid on interpreted scripts, and the kernel clears setuid and setgid when a file is modified by a non-privileged user.
Practical usage and options
The basic form is chmod MODE FILE.... Three options cover most administrative work: `-R` for recursive changes, `-v` or `-c` for reporting and --reference=FILE for copying another file’s mode. The decision table summarizes typical situations.
| Situation | Command | Reason |
|---|---|---|
| Make a script executable | chmod u+x deploy.sh | Adds execute for the owner only |
| Protect an SSH private key | chmod 600 ~/.ssh/id_ed25519 | OpenSSH rejects keys readable by others |
| Share a project directory | chmod 2770 /srv/project | Setgid keeps the group on new files |
| Fix a web tree | chmod -R u=rwX,go=rX /var/www/site | Directories get 755, non-executable files get 644 |
| Remove access for others | chmod -R o-rwx /home/alice | Strips other permissions, keeps the rest |
chmod follows symbolic links given on the command line and changes the target; the permissions of a symlink itself are not used on Linux. When POSIX ACLs are present, the group bits shown by chmod act as the ACL mask, so changing them can silently limit rights granted to named users.
Common mistakes and security risks
Permission problems are usually solved by understanding which class applies, not by widening access. These are the errors seen most often in practice.
- Using chmod 777 to fix an error hides the real cause and lets any local user or compromised service modify the files.
- Running chmod -R 755 on a whole tree makes every regular file executable; use capital X instead.
- Confusing chmod with chown: when the wrong user owns a file, ownership must be corrected rather than permissions widened.
- Forgetting the parent directories: a file with mode 644 is unreachable when a parent directory lacks execute permission.
- Expecting chmod to override mount options: a filesystem mounted with noexec still blocks execution regardless of the x bit.
The short version
Every file on a Linux system has a small set of on-off switches that say who may look at it, who may change it and who may run it. These switches exist separately for the owner, for a team and for everyone else.
chmod is the command that flips those switches. It does not change who owns the file. It only changes what each group of people may do with it, which makes it the everyday tool for keeping private files private and shared files usable.
Where it makes a difference
A developer copies an SSH private key from a backup drive to a new laptop. The copy arrives with mode 644, and the SSH client refuses to use it with a warning that the key permissions are too open. Running chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh restricts both to the owner, and the login works immediately.
On the team’s web server, an uploaded configuration file containing database credentials had been set to 777 during troubleshooting. A review finds it and applies chmod 640 with the web server’s group, so the application can still read it while other local accounts lose all access. The fix takes seconds, but it closes a path by which any compromised account could have read or replaced the credentials.