Understanding and Using the chmod Command in Linux and UNIX

Description

The chmod (Change Mode) command is used in Linux and UNIX operating systems to modify file and directory permissions.

These permissions determine which users can read, modify, or execute files and directories. Properly configuring permissions is essential for maintaining system security, protecting sensitive information, and ensuring applications function correctly.

This guide explains how to use chmod, understand numeric and symbolic permissions, modify directory permissions, and troubleshoot common permission problems.

Procedure

1. Understanding the chmod Command

The basic syntax of the chmod command is:

chmod [options] permissions filename

Where:

• chmod: The command used to change permissions.
• options: Optional flags that modify how the command operates.
• permissions: The permissions to assign or modify.
• filename: The file or directory being modified.

For example:

chmod 755 script.sh

This command assigns the following permissions:

• Owner: Read, write, and execute.
• Group: Read and execute.
• Others: Read and execute.

The resulting permission string is:

-rwxr-xr-x

2. Understanding Permission Types

Linux and UNIX use three primary permission types.

Permissions are assigned to three categories:

Each category has its own permission settings.

3. Viewing Current Permissions

Before changing permissions, determine the current configuration.

Run:

ls -l filename

Example:

-rw-r--r-- 1 admin staff 2048 Nov 5 10:30 document.txt

The first ten characters represent the file type and permissions:

-rw-r--r--

Breakdown:

-   rw-   r--   r--
|    |     |     |
|    |     |     +-- Others
|    |     +-------- Group
|    +-------------- Owner
+------------------- File Type

The example indicates:

• The owner can read and modify the file.
• The group can read the file.
• Others can read the file.
• No user has execute permission.

To view permissions on a directory itself, use:

ls -ld /path/to/directory

4. Using Numeric (Octal) Permissions

Numeric permissions are one of the most common ways to use chmod.

Each permission is assigned a value:

Read    = 4
Write   = 2
Execute = 1

Add the values to determine the permission level.

Example: chmod 755

chmod 755 script.sh

Calculation:

Owner:   7 = 4 + 2 + 1 = rwx
Group:   5 = 4 + 0 + 1 = r-x
Others:  5 = 4 + 0 + 1 = r-x

Result:

-rwxr-xr-x

This configuration is commonly used for executable scripts and programs.

Example: chmod 644

chmod 644 document.txt

Calculation:

Owner:   6 = 4 + 2 + 0 = rw-
Group:   4 = 4 + 0 + 0 = r--
Others:  4 = 4 + 0 + 0 = r--

Result:

-rw-r--r--

This configuration is commonly used for ordinary files that do not require execution.

Example: chmod 600

chmod 600 private.key

Result:

-rw-------

Only the owner can read and modify the file.

This is commonly used for private keys and sensitive configuration files.

5. Common chmod Permission Settings

Security Warning: Avoid using chmod 777 as a troubleshooting shortcut. It grants all users permission to read, modify, and execute a file, or modify the contents of a directory.

6. Using Symbolic Permissions

The chmod command also supports symbolic notation.

Symbolic permissions allow you to add, remove, or assign specific permissions without calculating numeric values.

Add execute permission to the owner

chmod u+x script.sh

Remove write permission from the group

chmod g-w document.txt

Remove all permissions from others

chmod o= confidential.txt

Add read permission for everyone

chmod a+r document.txt

Set exact permissions for the owner

chmod u=rwx script.sh

Assign multiple permissions simultaneously

chmod u=rwx,g=rx,o=r script.sh

This produces:

-rwxr-xr--

Symbolic operators:

Symbolic changes are particularly useful when modifying one permission without changing the others.

7. Changing Directory Permissions

Directory permissions behave differently from regular file permissions.

Example: Allow directory access

chmod 755 /srv/shared

The owner receives full access, while group members and others can list and traverse the directory.

Example: Private directory

chmod 700 /home/admin/private

Only the owner receives directory permissions.

Example: Shared group directory

chmod 770 /srv/team

The owner and assigned group receive full access. Others receive no access.

Important: A user may need execute permission on every parent directory to access a file, even when the file itself is readable.

8. Changing Permissions Recursively

The -R option applies permission changes recursively to a directory and its contents.

Example:

chmod -R 755 /srv/website

This changes permissions on all files and directories under /srv/website.

However, this can create security problems because regular files will also receive execute permission.

Recommended: Set directory and file permissions separately

Set directories to 755:

find /srv/website -type d -exec chmod 755 {} +

Set regular files to 644:

find /srv/website -type f -exec chmod 644 {} +

This approach avoids assigning execute permission to ordinary files.

Warning: These commands still change permissions throughout the target tree. Review existing permissions and application requirements before running them. Some files, including executable scripts and sensitive configuration files, may require different settings.

9. Using chmod with sudo

Some files and directories are owned by root or another account.

Attempting to modify them without sufficient privileges may produce:

chmod: changing permissions of 'filename': Operation not permitted

If authorized, use sudo:

sudo chmod 644 /etc/example.conf

For a directory:

sudo chmod 750 /srv/application

Security Note: Using sudo provides elevated privileges. Incorrect permission changes to system files can prevent services from starting or create security vulnerabilities.

Always confirm the target path and intended permissions before executing privileged commands.

10. Understanding Special chmod Permissions

Linux and UNIX support three special permission bits.

These are represented by an additional leading numeric digit.

SetUID Example

chmod 4755 program

This enables SetUID on the executable.

It may display as:

-rwsr-xr-x

SetUID should only be used when specifically required and after a security review.

SetGID Example

chmod 2775 /srv/shared

When applied to a directory, newly created files and subdirectories generally inherit its group ownership.

It may display as:

drwxrwsr-x

Sticky Bit Example

chmod 1777 /tmp/example

The sticky bit helps prevent users from deleting or renaming entries belonging to other users in a shared directory.

It may display as:

drwxrwxrwt

Special permission bits can be combined. For example, 6755 includes both SetUID and SetGID.

11. Troubleshooting chmod Permission Errors

Issue: Permission Denied When Running a Script

Cause: The script may not have execute permission, or the user may lack access to the file or its parent directories.

Solution:

Check permissions:

ls -l script.sh

Add execute permission for the owner:

chmod u+x script.sh

Run the script:

./script.sh

If execution still fails, verify the script interpreter, directory permissions, and filesystem mount options.

Issue: chmod Returns Operation Not Permitted

Cause: The current user may not own the file or have sufficient privileges to change its permissions.

Solution:

Check ownership:

ls -l filename

If authorized, run:

sudo chmod 644 filename

If the command still fails, investigate filesystem restrictions, immutable attributes, or read-only mounts.

Issue: Cannot Access a Directory

Cause: The user may lack execute permission on the directory or one of its parent directories.

Solution:

Inspect the directory:

ls -ld /path/to/directory

Inspect the full path:

namei -l /path/to/directory

If appropriate, grant the owner execute permission:

chmod u+x /path/to/directory

Issue: Application Stops Working After chmod -R

Cause: Recursive permission changes may have removed required permissions or added inappropriate ones.

Solution:

Review the affected files and directories:

ls -la /srv/application

Restore permissions according to the application's documented requirements.

For a typical directory containing non-executable files, an administrator might use:

find /srv/application -type d -exec chmod 755 {} +
find /srv/application -type f -exec chmod 644 {} +

These commands are not appropriate for every application. Executables, private files, and special permission bits may require separate restoration.

12. Verifying Permission Changes

After running chmod, verify that the requested permissions were applied.

Use:

ls -l filename

Or display detailed permission information:

stat filename

Example output:

Access: (0755/-rwxr-xr-x)
Uid: (1000/admin)
Gid: (1000/admin)

The numeric and symbolic permissions should match the intended configuration.

For files using Access Control Lists (ACLs), inspect the ACL entries:

getfacl filename

ACLs can affect effective access beyond the standard owner, group, and others permission bits.

13. chmod Best Practices

• Follow the principle of least privilege by granting only necessary permissions.
• Use 644 for ordinary, non-sensitive files when read access for others is appropriate.
• Use 755 for directories that must be accessible to other users.
• Use 600 for private keys and other sensitive files.
• Avoid 777 and other unnecessarily permissive configurations.
• Use symbolic notation when changing only one permission.
• Avoid recursive permission changes without reviewing their impact.
• Verify permissions after making changes.
• Use groups and ACLs for shared access rather than granting permissions to everyone.
• Document nonstandard permissions required by applications.
• Be especially cautious when changing permissions under /etc, /usr, /var, and other system directories.

14. chmod Quick Reference

Addtional Information

The chmod command is an essential Linux and UNIX administration tool for controlling access to files and directories.

Understanding numeric permissions, symbolic notation, recursive changes, and special permission bits allows administrators to configure secure access and troubleshoot permission-related issues.

The most frequently used configurations are:

• 644: Standard files that can be read by other users.
• 755: Directories and executable files that require general access.
• 600: Sensitive files restricted to their owner.
• 700: Private directories restricted to their owner.
• 775: Directories requiring group write access.

Always verify the current permissions, determine the required access level, and apply the least permissive configuration that meets the operational requirement.

Proper use of chmod helps prevent unauthorized access, protect sensitive information, and maintain reliable Linux and UNIX systems.