rwx and chmod
Every Linux file carries nine permission bits — read, write, execute for user, group, and other. chmod sets them numerically (e.g. 640 = rw-r-----) or symbolically (u+x, go-w). Get these right and you control who can do what.
You create a script, run it, and get Permission denied. Or you copy a config file and suddenly anyone on the system can read your database password. Both problems come from the same place: Linux file permissions. Every file and directory has exactly nine permission bits. Once you can read them and set them deliberately, you stop cargo-culting chmod 777 and start setting permissions that actually match your intent.
After this lesson you can read the nine rwx permission bits from ls -l output, decode any octal permission like 640 or 755 into human-readable form, and set permissions with both numeric (chmod 640) and symbolic (chmod u+x, chmod go-w) syntax.
ls -l shows permissions as ten characters. Run ls -l in any directory and you will see lines like:
ls -l /etc/passwd-rw-r--r-- 1 root root 2048 Jun 10 12:00 /etc/passwdThe first column is ten characters. The very first character is the file type (- = regular file, d = directory, l = symlink). The remaining nine are the permission bits — three groups of three:
- Characters 2–4: permissions for the user (owner of the file)
- Characters 5–7: permissions for the group (the file’s owning group)
- Characters 8–10: permissions for other (everyone else)
Each group has three slots: r (read), w (write), x (execute). A dash - means that permission is absent.
Each permission bit has a fixed octal value: r=4, w=2, x=1. To convert a permission triplet to a number, add the values of the bits that are set:
| Bits | Calculation | Octal digit |
|---|---|---|
rwx | 4+2+1 | 7 |
rw- | 4+2+0 | 6 |
r-x | 4+0+1 | 5 |
r-- | 4+0+0 | 4 |
-wx | 0+2+1 | 3 |
-w- | 0+2+0 | 2 |
--x | 0+0+1 | 1 |
--- | 0+0+0 | 0 |
A three-digit octal like 640 means: user=6 (rw-), group=4 (r--), other=0 (---). Put it together: rw-r-----.
chmod sets permissions numerically. Give it the three-digit octal and the file:
chmod 640 secrets.conf
ls -l secrets.conf-rw-r----- 1 alice devs 512 Jun 10 13:00 secrets.confOwner can read and write. Group members can read. Everyone else is locked out. This is the right mode for a config file that teammates need to read but strangers should not touch.
Common numeric modes you will use constantly:
755— scripts and directories: owner has full control, others can read and execute644— ordinary files: owner reads/writes, others read only640— sensitive config: owner reads/writes, group reads, others excluded600— private keys and secrets: only the owner can read or write700— private directories: only the owner can list or enter
chmod also accepts symbolic syntax. Symbolic syntax names who you are changing (u=user/owner, g=group, o=other, a=all three), the operator (+ add, - remove, = set exactly), and which bits (r, w, x):
chmod u+x deploy.sh # add execute for owner
chmod go-w shared.txt # remove write from group and other
chmod a=r public.html # set everyone to read-onlySymbolic is useful when you want to tweak one bit without knowing or changing the others. Numeric is better when you want to set the full mode precisely.
Setting up a deployment script.
You have a script deploy.sh that should be executable by its owner and readable by the deploy group, but invisible to everyone else.
ls -l deploy.sh-rw-rw-rw- 1 alice deploy 300 Jun 10 14:00 deploy.shCurrently world-readable and world-writable — a security problem. Fix it:
chmod 750 deploy.sh
ls -l deploy.sh-rwxr-x--- 1 alice deploy 300 Jun 10 14:00 deploy.shDecode 750: user=7 (rwx), group=5 (r-x), other=0 (---). Alice can read, write, and execute. Members of the deploy group can read and execute. No one else can even see the file’s contents.
The same result with symbolic syntax:
chmod u=rwx,g=rx,o= deploy.sh▸Why this works
On macOS the chmod command works identically — same numeric and symbolic syntax, same rwx model. The only visible difference is that ls -l on macOS may show an @ suffix on the permissions string if the file has extended attributes. The octal values and chmod syntax are unchanged.
▸Common mistake
chmod 777 grants read, write, and execute to everyone on the system (user=7, group=7, other=7). It is almost never the right answer. The usual reason people reach for it is “I got Permission denied and I want it to stop.” The correct fix is to figure out why the permission is denied — wrong owner, wrong group, or a missing execute bit — and set the narrowest permission that actually works. chmod 777 on a web-served file lets any process on the server overwrite it. On a config file it exposes credentials to all local users.
A file shows -rw-r----- in ls -l output. What is its numeric (octal) mode?
Every Linux file has nine permission bits grouped into three triplets — user, group, other — each containing r (read=4), w (write=2), x (execute=1). Add the values in each triplet to get the octal digit: rw- = 6, r-- = 4, --- = 0, so rw-r----- = 640. chmod accepts a three-digit octal to set all nine bits at once, or symbolic expressions like u+x and go-w to adjust individual bits. Use the narrowest permission that works — never reach for 777 as a quick fix.
Practice
Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.