VMware ESXi and vSphere Cluster Management

How to Modify File Permissions with chmod in Linux

Learn how to view and change Linux file permissions with chmod using numeric octal and symbolic modes for files and directories.

Linux file permissions control who may read, modify, or execute a file. The chmod command changes a file or directory's permission mode.

Permissions are separate from ownership. A file has an owner and an associated group, while its permission mode defines what the owner, group, and other users may do. Ownership changes use commands such as chown or chgrp, not chmod.

Permission classes: owner, group, and others

• Owner, represented symbolically by u, is the user account associated with the file.
• Group, represented by g, is the file's associated group.
• Others, represented by o, includes users who are neither the owner nor members matched through the file's group.
• All, represented by a, selects the owner, group, and others together.

The file's owner and the root user can generally change its permission mode. A normal user usually cannot change permissions on a file owned by another user. Filesystem restrictions, read-only mounts, and security policies can also prevent changes.

Read permissions with ls -l

Use ls -l to inspect a file's type, permissions, ownership, size, and other metadata:

ls -l bobs_file.txt

A result might begin with:

-rw-r--r-- 1 bob developers 1250 Aug 19 10:30 bobs_file.txt

The permission information is the first 10-character field. The first character identifies the file type, and the remaining nine characters contain three permission triplets:

- rw- r-- r--
  |   |   |
  |   |   +-- others
  |   +------ group
  +---------- owner

• The first character, - here, indicates a regular file. A directory normally begins with d.
• The first triplet, rw-, applies to the owner.
• The second triplet, r--, applies to the group.
• The third triplet, r--, applies to others.

Within each triplet, the positions are read (r), write (w), and execute (x). A hyphen means that permission is absent. In -rw-r--r--, the owner can read and write, while the group and others can only read.

Basic chmod syntax

The basic command form is:

chmod MODE FILE

MODE can be a numeric (octal) mode or a symbolic mode. You can provide multiple filenames when the same change should apply to each one:

chmod 640 report.txt notes.txt

Quote or escape filenames containing spaces or shell-special characters:

chmod 600 'tax records.txt'
chmod 600 draft\[1\].txt

Numeric permission modes

In an octal mode, each permission has a numeric value:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1

Add the values for the permissions wanted by each class. The three digits are ordered owner, group, and others.

Calculating a numeric mode

For example, 7 means 4 + 2 + 1, so it represents read, write, and execute. 6 means 4 + 2, so it represents read and write. 4 means read only.

This command gives the owner full access, the group read/write access, and others read-only access:

chmod 764 bobs_file.txt

The digits mean:

• Owner digit 7: rwx
• Group digit 6: rw-
• Others digit 4: r--

The expected mode for a regular file is -rwxrw-r--.

This command sets owner read/write, group read-only, and others read/execute access:

chmod 645 bobs_file.txt

Its expected regular-file mode is -rw-r--r-x. The first digit always applies to the owner, the second to the group, and the third to others.

A numeric mode replaces the ordinary rwx bits represented by its three digits. Therefore, use it when you know the complete permission sets you want, not merely one permission you want to add.

Symbolic permission modes

Symbolic mode notation uses class selectors, an operator, and permission letters:

Adding permissions with +

The + operator adds the selected permission and preserves unrelated existing permissions. To add write access only for others:

chmod o+w bobs_file.txt

The o selector targets others, and +w adds write permission without changing the owner or group modes.

You can select multiple classes together. This adds execute permission for the owner and others while leaving the group mode unchanged:

chmod uo+x bobs_file.txt

Removing permissions with -

The - operator removes only the selected permission. To remove execute permission from everyone:

chmod a-x bobs_file.txt

Because this targets only execute bits, existing read and write permissions are preserved.

Setting exact permissions with =

The = operator assigns an exact permission selection for the specified classes. For example:

chmod u=rw,g=r,o= report.txt

This gives the owner read/write access, gives the group read access, and removes all ordinary permissions from others. Unlike +, which adds to the current state, = replaces the selected class's ordinary rwx permissions.

You can separate independent symbolic changes with commas:

chmod u+rw,g-w,o-rwx report.txt

This adds read and write for the owner, removes write from the group, and removes read, write, and execute from others. Symbolic modes are useful when you want to alter one class without unintentionally replacing permissions in another.

Permission behavior for files and directories

On a regular file, read permits viewing content, write permits changing content, and execute permits running an executable file or script. A script may also require a valid interpreter declaration, such as a suitable shebang line, and execution can be affected by mount options or security policy.

Directory permissions have different effects. Directory read allows listing names, directory write allows changes to entries, and directory execute allows traversal and access to entries when other requirements are satisfied. Execute on a directory does not mean running the directory. Do not apply directory execute permissions broadly without understanding which users should be able to enter or search it.

Examples for common file needs

To make a private file readable and writable only by its owner:

chmod 600 private.txt

The resulting regular-file mode is -rw-------.

To let the script owner execute a script while making it readable by everyone:

chmod 744 script.sh

The expected mode is -rwxr--r--. The script still needs a valid interpreter declaration and may be blocked by a noexec mount option or a security policy.

Verify and make safe permission changes

Always inspect the result after changing permissions:

chmod 600 private.txt
ls -l private.txt

Use least-privilege permissions: grant only the access that users and processes need. Avoid unnecessary write or execute access for others, especially on sensitive files and directories.

Be cautious with recursive changes such as chmod -R. A directory tree often contains both regular files and directories, which commonly need different modes. Do not use recursive chmod unless you understand the entire tree and the desired file-versus-directory behavior.

Troubleshooting chmod and access problems

chmod reports “operation not permitted”

• Inspect ownership and the current mode with ls -l.
• Confirm the active user identity and whether that user owns the file.
• The filesystem may be mounted read-only or may apply other restrictions.
• Use appropriate administrative access only when authorized. Root can generally change permissions, but filesystem and security restrictions may still apply.

The command succeeds, but a program still cannot run

• Review the mode with ls -l and confirm that the relevant user class has execute permission.
• For scripts, confirm the file has a suitable interpreter declaration and is invoked correctly.
• Check whether the filesystem uses the noexec mount option.
• A security policy or application-specific requirement may block execution even when the mode looks correct.

A user cannot access a file inside a directory

File read permission alone is not enough. The user also needs execute, or search, permission on the containing directory and every ancestor directory in the path. Inspect the permissions of the file and each parent directory, then grant directory execute permission only to the intended class.

A numeric command changed more permissions than intended

Numeric modes replace the ordinary permission sets represented by their digits. Use ls -l to inspect the current state, then use symbolic changes such as u+w or o-rwx when you need a targeted addition or removal.

Quick reference

• ls -l FILE: inspect permissions and ownership.
• chmod MODE FILE: change a permission mode.
• chmod 600 private.txt: owner read/write only.
• chmod 744 script.sh: owner read/write/execute; group and others read.
• chmod o+w FILE: add write for others.
• chmod uo+x FILE: add execute for owner and others.
• chmod a-x FILE: remove execute from all classes.
• Numeric order is owner, group, others; values are read 4, write 2, and execute 1.

For a focused reference, see Modify File Permissions.