chmod and chown Cheat Sheet

chmod +x deploy.sh                       # make a script executable
chmod 644 notes.txt                      # rw-r--r--
chmod 600 ~/.ssh/id_ed25519              # private key: owner only
sudo chown alice:alice file              # change owner and group
sudo chown -R www-data:www-data /var/www/site
chmod -R u=rwX,go=rX project/            # sane recursive mode for files and dirs

Each file has an owner, a group and three permission sets: owner (u), group (g) and others (o), each with read (4), write (2) and execute (1). chmod changes those bits, chown and chgrp change who they apply to. Only root can give a file to another user; a normal user can only change the group to one they belong to. To convert between numbers and rwx letters, use the chmod calculator; for the concepts behind it, read the file permissions guide.

Reading permissions

chmod: octal modes

chmod: symbolic modes

chown and chgrp

Users and groups themselves are created and changed with useradd, usermod -aG and groupadd; see the user management guide.

umask: default permissions for new files

Files start from 666 and directories from 777; the umask bits are removed. Try other values in the umask calculator. A umask command only affects the current shell and its children; put it in ~/.bashrc or ~/.profile to keep it.

ACLs: setfacl and getfacl

The acl package provides these commands; it is installed by default on Ubuntu, Fedora and openSUSE (sudo apt install acl or sudo pacman -S acl otherwise). ext4, XFS and Btrfs support ACLs out of the box.

Common recipes

Reset a web root: directories 755, files 644, owned by the web server user:

sudo chown -R www-data:www-data /var/www/site     # nginx/apache user on Debian/Ubuntu; "apache" or "nginx" on Fedora
sudo find /var/www/site -type d -exec chmod 755 {} +
sudo find /var/www/site -type f -exec chmod 644 {} +

Fix SSH key permissions that cause Permission denied (publickey):

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_* ~/.ssh/authorized_keys ~/.ssh/config
chmod 644 ~/.ssh/*.pub

Shared team directory where everyone in devs can edit everything:

sudo groupadd devs
sudo usermod -aG devs alice
sudo chgrp -R devs /srv/shared
sudo chmod -R g+rwX /srv/shared
sudo find /srv/shared -type d -exec chmod g+s {} +
sudo setfacl -R -d -m g:devs:rwX /srv/shared

Find world-writable files and setuid binaries (security audit):

sudo find / -xdev -type f -perm -0002 -ls 2>/dev/null
sudo find / -xdev -type f -perm -4000 -ls 2>/dev/null

Give your user back the files that sudo created in your home directory:

sudo find ~ -not -user "$USER" -exec chown "$USER": {} +

Gotchas

• Never "fix" access with chmod 777. It lets every user and service modify the file. Fix the owner or group, or add an ACL entry.
• chmod -R 755 or 644 on a tree breaks either files (all executable) or directories (none enterable). Use X or separate find -type d / -type f runs.
• Directory permissions control access to the files inside. A 600 file in a directory without x for you is unreachable, and anyone with write on the directory can delete your file. Check the path with namei -l.
• New group membership needs a new login. After usermod -aG, log out and in, or run newgrp devs.
• The ACL mask limits named entries. A later chmod g-w on a file with ACLs changes the mask and silently removes write from every named user and group. Check getfacl for #effective:.
• Some filesystems ignore all of this. FAT, exFAT and NTFS mounts get permissions from mount options (uid=, umask=), and chmod fails with Operation not permitted. Immutable files (chattr +i) refuse changes even from root.
• setuid on scripts does nothing. Linux ignores setuid and setgid on interpreted scripts; use sudo rules instead.

References: chmod(1), chown(1), setfacl(1) and umask(2).

Frequently asked questions