How do file permissions work in Linux, and what do chmod 755 and 644 mean?
Every file has read, write and execute permissions for three groups of people - the owner, the group and everyone else. chmod changes them; 755 means the owner can do everything while others can only read and execute, and 644 means the owner can read and write while others can only read.
Explain it simply
Think of a hostel room. The student who lives there (the owner) can open the cupboard, use things and rearrange them. Roommates (the group) may be allowed to look inside but not move anything. Visitors from other floors (others) may not be allowed in at all.
Linux works the same way. For every file, it stores three sets of permissions: one for the owner (user), one for the group, and one for others. Each set has three switches:
- r (read): see the contents of a file, or list the names in a directory.
- w (write): change a file, or create and delete files inside a directory.
- x (execute): run a file as a program, or enter a directory with
cd.
Example
ls -l deploy.sh notes.txt-rwxr-xr-x 1 ravi devs 1204 Oct 2 10:15 deploy.sh
-rw-r--r-- 1 ravi devs 310 Oct 2 10:16 notes.txtRead -rwxr-xr-x after the first character (which shows the file type, - for a regular file and d for a directory). It splits into three groups: rwx for owner ravi, r-x for group devs, r-x for others.
In numbers, r = 4, w = 2, x = 1. Add them for each group:
| Digits | Owner | Group | Others | Typical use |
|---|---|---|---|---|
| 755 | rwx (7) | r-x (5) | r-x (5) | scripts, programs, directories |
| 644 | rw- (6) | r-- (4) | r-- (4) | normal text and config files |
| 600 | rw- (6) | --- (0) | --- (0) | private files like SSH keys |
chmod 755 deploy.sh # numeric form
chmod u+x deploy.sh # symbolic: add execute for the owner
chmod go-w notes.txt # remove write from group and others
chmod a+r notes.txt # add read for all (u, g and o)How it works
Each file's inode stores an owner ID, a group ID and these permission bits. When a process opens a file, the kernel checks the process's user: if it is the owner, only the owner bits apply; else if the user is in the file's group, the group bits apply; otherwise the "others" bits apply. The root user bypasses most of these checks.
chown changes the owner and group (chown ravi:devs file), while chmod changes the bits. New files get default permissions from umask; a common umask of 022 gives files 644 and directories 755.
Real-world use
- Making a shell script runnable after you write it:
chmod +x script.sh. - SSH refuses to use a private key that others can read, so keys must be
600. - Web servers usually serve files that are 644 from directories that are 755.
Common mistakes
- Using
chmod 777to "fix" a permission error. It lets every user change the file and is a security hole. - Forgetting that a directory needs
xto be entered. A directory with onlyrlets you list names but not open the files inside. - Thinking
won a file lets you delete it. Deleting depends on write permission on the directory.
What to say in the interview
"Linux permissions have three classes, owner, group and others, and each has read, write and execute bits. In numeric form read is 4, write is 2 and execute is 1, so 755 means rwx for the owner and r-x for group and others, which suits scripts and directories. 644 means the owner can read and write and everyone else can only read, which suits normal files. I use chmod to change them, either numerically or symbolically like u+x, and chown to change ownership. I avoid 777 because it gives write access to everyone."
Follow-up questions
- What is umask and how does it decide default permissions?
- What do the setuid, setgid and sticky bits do?
- Why can you delete a file you do not have write permission on?
Go deeper
Read these once the basics above feel easy.
There are three special bits written as a fourth leading digit. setuid (4) makes a program run with the file owner's privileges; passwd uses it so normal users can update the password file. setgid (2) on a directory makes new files inherit the directory's group, handy for shared project folders. The sticky bit (1) on a directory like /tmp means only a file's owner can delete it, even though everyone can write to the directory. You will see it as a t in drwxrwxrwt.