How to Use the chmod Command to Change File Permissions in Linux

Security and access control in Linux are primarily managed through file permissions. Every file and directory on a Linux system defines exactly who is allowed to read it, modify it, or execute it as a program. When you need to modify these access rights, you use the chmod (change mode) command. Understanding how to use chmod is arguably the most critical skill for any Linux user or system administrator.

Understanding the Linux Permission Structure

Before you can change permissions, you must understand how Linux reads them. If you run the ls -l command, you will see a string of ten characters at the beginning of each line, looking something like this: -rwxr-xr--.

The first character denotes the file type (a hyphen for a file, a “d” for a directory). The remaining nine characters are split into three distinct blocks of three:

1. User (Owner): The permissions granted to the specific user who owns the file (rwx).
2. Group: The permissions granted to users who are members of the file’s assigned group (r-x).
3. Others: The permissions granted to everyone else on the system (r--).

Within each block of three, the letters represent specific actions:

• r (Read): Permission to view the contents of the file.
• w (Write): Permission to modify or delete the file.
• x (Execute): Permission to run the file as a program or script.

Using Symbolic Mode to Change Permissions

The most intuitive way to use chmod is through symbolic mode, which uses letters to represent who is being modified and what permission is being added or removed.

• Who: u (user/owner), g (group), o (others), a (all).
• Operator: + (add permission), - (remove permission), = (set exact permission).
• What: r, w, x.

For example, if you wrote a bash script named script.sh and you need to make it executable for yourself (the owner), you would run:

chmod u+x script.sh

If you want to prevent “others” from reading a sensitive configuration file:

chmod o-r config.txt

Using Absolute (Numeric) Mode to Change Permissions

While symbolic mode is easy to read, numeric mode is much faster and is the standard method used by professionals. It assigns a numerical value to each permission type:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1

To determine the final permission number for a block, you simply add the values together. For example, Read + Write = 6. Read + Write + Execute = 7.

You then provide three numbers to the chmod command, representing the Owner, Group, and Others in that exact order.

Example 1: chmod 755

chmod 755 script.sh

This is the standard permission for executable scripts and web directories. The owner gets 7 (4+2+1, Read/Write/Execute). The group gets 5 (4+1, Read/Execute). Others get 5 (Read/Execute).

Example 2: chmod 644

chmod 644 document.txt

This is the standard permission for normal files. The owner gets 6 (Read/Write). The group gets 4 (Read only). Others get 4 (Read only).

Using the Recursive Flag

If you need to apply a permission change to a directory and every single file contained within it, you use the -R (recursive) flag.

chmod -R 755 /var/www/html/

Be very careful when using recursive chmod, as applying execute permissions to every text file in a massive directory tree is generally a bad security practice. It is best used for standardizing permissions on web server directories or shared folders.