chmod Commando Spiekbriefje

chmod (change mode) sets who may read, write, and execute a file or directory on Unix-like systems. The mode can be written symbolically (u+x) or numerically (755) — both reach the same result.

chmod [options] <mode> <file>...

💡 Inspect before and after with ls -l <file>, or get the octal value directly with stat -c '%a %n' <file>.

🗂 Reading ls -l Output

-  rwx  r-x  r--   →  754
│  │    │    │
│  │    │    └── others : r-- = 4
│  │    └─────── group  : r-x = 5
│  └──────────── user   : rwx = 7
└─────────────── type   : - file · d directory · l symlink · c/b device

🧑 User Classes (who)

🔐 Permission Bits (what)

📝 Symbolic Mode

# add execute for the owner
chmod u+x <file>

# remove write from the group
chmod g-w <file>

# cut off group and others entirely
chmod go-rwx <file>

# everyone gets read only, nothing else
chmod a=r <file>

# several clauses, comma separated
chmod u=rwx,go=rx <file>

# 'a' is implied, then filtered by the umask
chmod +x <file>

# regular and special bits in one call
chmod u+x,g+s <file>

# copy the mode of another file
chmod --reference=<ref> <file>

💡 Use X (capital) instead of x to add execute only to directories and to files that already have an execute bit — the safe way to fix a tree: chmod -R u=rwX,go=rX <dir>.

🔢 Numeric (Octal) Mode

Each digit is the sum of r (4), w (2) and x (1):

Three digits map to user, group, others. An optional fourth leading digit sets the special bits (chmod 4755, see below).

Common modes

chmod 755 script.sh

chmod 644 notes.txt

chmod 600 ~/.ssh/id_ed25519

🧪 Special Permission Bits

These go beyond read/write/execute and control the execution context and deletion rules.

# setuid → -rwsr-xr-x
chmod 4755 /usr/bin/somebinary

# setgid → drwxrwsr-x: one group for the whole tree
chmod 2775 /srv/shared

# sticky → drwxrwxrwt: a shared drop box, like /tmp
chmod 1777 /srv/tmp

# strip every special bit again
chmod u-s,g-s,o-t <file>

⚠️ setuid is a privilege-escalation vector — never set it on scripts or on binaries a user can replace. Linux ignores it on interpreted scripts anyway.

ℹ️ A capital S or T in ls -l (-rwSr--r--) means the special bit is set while the matching x bit is not — usually a mistake.

📂 Directory Access Matrix

x on a directory means traverse, not execute — without it nothing below the directory can be reached, no matter how permissive the files themselves are.

🔁 Recursive & Selective Changes

# blunt: also marks every file executable
chmod -R 755 <dir>

# preferred: X only touches dirs + real executables
chmod -R u=rwX,go=rX <dir>

# directories only
find <dir> -type d -exec chmod 755 {} +

# files only
find <dir> -type f -exec chmod 644 {} +

# make every shell script executable
find <dir> -type f -name '*.sh' -exec chmod +x {} +

⚙️ Useful Options

🎭 umask — Default Permissions for New Files

New files start from 666 and new directories from 777; the umask bits are removed from that base.

# show the current mask, e.g. 0022
umask

# show it symbolically, e.g. u=rwx,g=rx,o=rx
umask -S

# stricter default for this shell session
umask 027

💡 Put umask 027 in ~/.bashrc (or a systemd unit’s UMask=) to make the default stick.

🚑 Common Recipes

🧰 Related Commands

⚠️ Gotchas

• chmod 777 is not a fix. It grants every local user write access; the real problem is almost always ownership (chown) or a missing x on a parent directory.
• “Permission denied” on a file with rw-? Every directory in the path needs x. Debug the whole chain with namei -l /path/to/file.
• Interpreted scripts need r too — the kernel hands the file to the interpreter, which has to read it.
• Group changes need a new login (or newgrp <group>) before the shell picks them up.
• FAT/NTFS/exFAT mounts ignore chmod — set permissions with the umask=, fmask= and dmask= mount options instead.
• Removing x from a directory hides everything below it, even world-readable files.

📚 Resources

• GNU coreutils — chmod invocation
• GNU coreutils — file permissions
• Man pages: man 1 chmod · man 1 umask · man 1 chown · man 5 acl