Every file and directory hosted on a server comes with a set of permissions that decides who can read it, who can change it and who can execute it. When these permissions are not set correctly, one of two things happens: either a legitimate operation (a web server process reading a file, for example) fails and you get a Permission denied error, or too much privilege is granted and the file becomes open to interference by other users on the server, by malicious scripts, or by attackers who gain access through a security hole. The second case is riskier than the first, because it usually goes unnoticed for a long time.
Opening up all permissions with chmod 777 when an application refuses to work is a common shortcut. That command makes the file readable, writable and executable for the owner, the group and everyone else; in other words anyone with any kind of access to the server can now modify that file. Understanding how chmod and the octal permission system work lets you calculate the right permission directly, without resorting to shortcuts like this.
rwx: Read, Write and Execute Permissions
In Linux every file and directory has three separate permission groups: owner, group and other. Three permissions are defined separately for each of these three groups: read (r), write (w) and execute (x). The ten-character string such as rwxr-xr-x that you see in ls -l output expresses exactly this: the first character shows the file type (d for a directory, - for a regular file), the next three characters are the owner's permissions, the following three are the group's, and the last three are those of others.
On files the meaning of these permissions is clear: read allows you to view the file contents, write to change the contents, and execute to run the file as a program. On directories the situation is slightly different: read means being able to list the directory contents (ls), write means being able to create and delete files inside the directory, and execute means being able to enter the directory (cd). If a directory does not have the execute bit, you cannot reach the files inside it even if you know their names; this is a mistake whose cause is frequently misunderstood.
How Is Octal Notation Calculated?
Each permission type has a fixed numeric value: read is 4, write is 2, execute is 1. The permissions wanted for a group are reduced to a single digit by adding these values together. For example, if read and write are on and execute is off, 4+2=6; if all three are on, 4+2+1=7; if only read is on, it is 4. When these three digits, calculated separately for owner, group and others, are written side by side, you get the three-digit octal permission code.
As an example, the permission rwxr-xr-x means rwx (7) for the owner, r-x (5) for the group and r-x (5) for others; that corresponds to the octal code 755. This code can be passed straight to the chmod command. Symbolic notation (such as u+x or g-w) can also be used, but octal notation is more commonly preferred in server administration because it expresses all permissions clearly on a single line.
Sets the permissions of a file or directory directly with a three- or four-digit octal code.
chmod 755 deploy.shsetuid, setgid and the Sticky Bit
Beyond the standard rwx permissions there are three more special bits, expressed as a fourth octal digit. setuid (4000), when applied to an executable file, makes the process run with the privileges of the file's owner no matter who executes it; the system-wide passwd command is a classic example. setgid (2000), when applied to a directory, makes new files created inside that directory automatically inherit the directory's group; this is used to keep group permissions consistent in project directories where several users work together. The sticky bit (1000) guarantees that in a shared, world-writable directory (/tmp is the classic example) users can only delete the files they created themselves; so even though everyone has write permission, deleting someone else's file is not possible.
When these special bits are in play, the octal code is written with four digits: the first digit carries the sum of the special bits and the remaining three carry the usual owner/group/other permissions. For example 2775 with setgid can be used on a shared project directory, or 1777 with the sticky bit on a world-writable temporary directory.
With a four-digit octal code, setuid, setgid or the sticky bit is set in a single command.
chmod 2775 shared-project/Common Octal Permission Combinations
The table below summarises the octal permission combinations most frequently encountered in server administration and their typical uses.
| Octal | Symbolic | Typical Use |
|---|---|---|
| 755 | rwxr-xr-x | Executable scripts and most directories; the owner has full rights, the group and others can only read and execute. |
| 644 | rw-r--r-- | Ordinary text and configuration files; the owner can read and write, everyone else can only read. |
| 700 | rwx------ | Private directories only the owner can access, for example SSH key directories. |
| 600 | rw------- | Sensitive files only the owner can read and write; private keys, credential files. |
| 775 | rwxrwxr-x | Shared working directories the owner and the group can both write to. |
| 664 | rw-rw-r-- | Files edited jointly by the owner and the group and only read by others. |
Common Mistakes
- Papering over the problem with chmod 777: Making a file readable, writable and executable for everyone removes the permission error, but it turns the file into a target that anyone on the server (or anyone who gains access through a hole) can modify.
- Applying a blanket recursive chmod with -R: A command like
chmod -R 755also applies the execute bit, which directories need, to ordinary files (.phpor.htmlfiles, for example); those files do not need to be executable and this is an unnecessary risk. - Forgetting the execute bit on directories: Giving a directory only read permission (r) and not execute permission (x) means that even though the directory listing works, the files inside it cannot be reached; this usually turns into the confusing 'the file is there but I cannot get to it' error.
- Confusing a permission problem with an ownership problem: chmod changes permissions, not the file's owner or group; an ownership problem is solved with
chown. Giving 777 to a file owned by the wrong user hides the problem, it does not solve it. - Leaving sensitive files readable by the group or others: Leaving files that contain database credentials, an API key or an SSL private key at 644 or looser lets other users on the server reach that information; such files should generally be restricted to 600.
Calculating the Right Permission Quickly
Working out the right octal code by hand is prone to errors when adding the digits up, especially when setuid, setgid or the sticky bit are in play. Rather than keeping track of which boxes are ticked separately for owner, group and others, it is safer to mark the permissions visually and see the matching octal code and the command to run straight away.