# How to Use macOS Terminal for Advanced File Permissions (Chmod and Chown)
macOS is built on a UNIX foundation, which means it utilizes a robust and granular permission system to control who can read, write, or execute files and directories. While the macOS “Get Info” graphical interface allows for basic permission adjustments, it is often insufficient for troubleshooting complex access issues, modifying ownership, or applying permissions recursively.
To manage file permissions effectively, you must understand how to use the Terminal. The two primary commands used for this are `chmod` (change mode) and `chown` (change owner).
This guide will explain how the macOS permission structure works and provide practical workflows for using `chmod` and `chown` to resolve access problems.
## Understanding the macOS Permission Structure
Every file and directory in macOS is assigned permissions for three distinct categories of users:
1. **User (u):** The specific individual who owns the file.
2. **Group (g):** A defined group of users who share the same access level.
3. **Others (o):** Everyone else who has access to the system.
For each of these categories, there are three types of permissions:
– **Read (r):** Allows a user to view the contents of a file or list the contents of a directory.
– **Write (w):** Allows a user to modify a file or create/delete files within a directory.
– **Execute (x):** Allows a user to run a file as a program or script, or to enter and access files within a directory.
### Viewing Permissions
To view the current permissions of a file or directory, open the Terminal application and use the `ls -l` command.
“`bash
ls -l /path/to/your/file.txt
“`
The output will look similar to this:
`-rw-r–r–@ 1 username staff 1024 Oct 24 10:00 file.txt`
The first ten characters (`-rw-r–r–`) represent the permissions:
– The first character indicates the file type (`-` for a regular file, `d` for a directory).
– The next three characters (`rw-`) are the **User** permissions (read and write).
– The middle three characters (`r–`) are the **Group** permissions (read only).
– The final three characters (`r–`) are the **Others** permissions (read only).
## Using Chmod to Change Permissions
The `chmod` command modifies the read, write, and execute permissions. You can use either symbolic mode (using letters) or absolute mode (using numbers).
### Symbolic Mode
Symbolic mode uses letters to add (`+`), remove (`-`), or set (`=`) permissions.
– **Syntax:** `chmod [who][operator][permission] filename`
**Examples:**
1. **Add execute permission for the user (owner):**
“`bash
chmod u+x script.sh
“`
*This is commonly used when you download a script and need to make it runnable.*
2. **Remove write permission for the group:**
“`bash
chmod g-w document.txt
“`
3. **Set read and write permissions for everyone (User, Group, and Others):**
“`bash
chmod a=rw shared_file.txt
“`
*(Note: `a` stands for ‘all’)*
### Absolute (Numeric) Mode
Absolute mode uses a three-digit octal number to define permissions. Each permission has a numeric value:
– Read = 4
– Write = 2
– Execute = 1
You add these numbers together to create the desired permission set for the User, Group, and Others.
– 7 (4+2+1) = Read, Write, Execute
– 6 (4+2) = Read, Write
– 5 (4+1) = Read, Execute
– 4 = Read only
– 0 = No permissions
**Examples:**
1. **Set permissions to read and write for the user, and read-only for everyone else:**
“`bash
chmod 644 document.txt
“`
*(User: 6, Group: 4, Others: 4)*
2. **Give the user full control, and deny all access to everyone else:**
“`bash
chmod 700 private_folder
“`
3. **Give full read, write, and execute permissions to everyone (Use with caution):**
“`bash
chmod 777 public_share
“`
### Recursive Permission Changes
If you need to change permissions for a directory and all the files and subdirectories contained within it, use the `-R` (recursive) flag.
“`bash
chmod -R 755 /path/to/directory
“`
*This sets the directory and all its contents to read/execute for everyone, but write access only for the owner.*
## Using Chown to Change Ownership
Sometimes, fixing an access issue requires changing who owns the file, rather than just changing the permissions. This is where `chown` is used.
Changing ownership generally requires administrator privileges, so you will usually need to prepend `sudo` to the command.
– **Syntax:** `sudo chown [user]:[group] filename`
**Examples:**
1. **Change the user ownership of a file to ‘johndoe’:**
“`bash
sudo chown johndoe document.txt
“`
2. **Change both the user ownership and the group ownership simultaneously:**
“`bash
sudo chown johndoe:admin document.txt
“`
*This changes the owner to ‘johndoe’ and the group to ‘admin’.*
3. **Change only the group ownership:**
“`bash
sudo chown :staff document.txt
“`
*(Note the colon before the group name)*
### Recursive Ownership Changes
Like `chmod`, `chown` also supports the `-R` flag for recursive changes, which is extremely useful when taking ownership of an entire folder copied from another Mac or an external drive.
“`bash
sudo chown -R johndoe:staff /path/to/folder
“`
## Troubleshooting Common Permission Errors
### “Operation not permitted” (Even with Sudo)
If you use `sudo chmod` or `sudo chown` and receive an “Operation not permitted” error, the file is likely protected by macOS System Integrity Protection (SIP) or it has a file lock (flag) applied.
1. **Check for file flags:** Run `ls -lO filename`. If you see the word `uchg`, the file is locked.
2. **Remove the lock:** Run `chflags nouchg filename`. You should now be able to modify the permissions.
### “Permission denied” when executing a script
If you attempt to run a script (e.g., `./script.sh`) and receive a “Permission denied” error, the file lacks the execute bit.
**Solution:** Run `chmod u+x script.sh` to grant the owner execute permissions.
By mastering `chmod` and `chown`, you gain absolute control over the macOS file system, enabling you to resolve frustrating access errors, secure sensitive data, and properly configure scripts and applications.