Understanding Unix File Permissions

Understanding Unix File Permissions

File permissions are a fundamental Unix concept that every developer encounters when deploying code, writing scripts, or managing servers.

The Permission Model

Every file has three permission sets: owner (u), group (g), others (o). Each set has three bits: read (r=4), write (w=2), execute (x=1).

Reading Permissions

$ ls -la
-rwxr-xr-- 1 alice dev 4096 Jun 01 12:00 script.sh

Breaking down -rwxr-xr--:

- = regular file (d = directory, l = symlink)

rwx = owner can read, write, execute

r-x = group can read, execute

r-- = others can read only

Numeric (Octal) Notation

Each permission set is a sum of r=4, w=2, x=1:

rwx = 4+2+1 = 7

r-x = 4+0+1 = 5

r-- = 4+0+0 = 4

So rwxr-xr-- = 754.

Common Permission Sets

| Octal | Symbolic | Use Case |

|-------|----------|----------|

| 755 | rwxr-xr-x | Executables, directories |

| 644 | rw-r--r-- | Regular files |

| 600 | rw------- | Private files (.env) |

| 700 | rwx------ | Private directories |

| 777 | rwxrwxrwx | Never use this |

Changing Permissions

chmod with Octal

chmod 755 script.sh
chmod 600 .env

chmod with Symbolic

chmod u+x script.sh    # add execute for owner
chmod g-w file.txt     # remove write for group
chmod o= file.txt      # remove all permissions for others
chmod a+r file.txt     # add read for all

Special Permissions

SUID (4000) — runs as the file owner, not the calling user. Used by programs like passwd. SGID (2000) — runs as the file's group. On directories, new files inherit the directory's group. Sticky Bit (1000) — on directories, only the file owner can delete their files. Used on /tmp.

Common Mistakes

chmod 777 — never do this. It gives everyone full access. If your app needs this to work, fix the ownership instead. Forgetting execute on directories — you need execute permission on a directory to cd into it or access files inside it. Scripts without execute bit — chmod +x script.sh before trying to run ./script.sh.

Try It

Use our chmod Calculator tool to visually set permissions and see the octal, symbolic, and command output in real time.

Conclusion

File permissions are simple once you understand the model. Use 644 for files, 755 for directories and scripts, 600 for secrets. Never use 777.