Linux file permissions explained: chmod, chown and umask

Every file on Linux has an owner, a group and file permissions that decide who can read, write or execute it. Wrong permissions cause "Permission denied" errors, 403 pages, or worse, files anyone on the server can change. This guide explains how to read and change them with chmod and chown.

Before you start

• SSH access to a Linux server.
• Root or sudo for changing ownership; normal users can chmod their own files.

Read a permission string

ls -l index.php
-rw-r--r-- 1 www-data www-data 4120 Mar 2 10:15 index.php

• First character: - file, d directory, l symlink.
• Then three groups of rwx: owner, group, others.
• Here the owner www-data can read and write; the group and everyone else can only read.

On a directory, r lists contents, w creates or deletes files inside, and x lets you enter it.

Numeric (octal) permissions

Each digit adds read (4), write (2) and execute (1): 7 = 4+2+1, 6 = 4+2, 5 = 4+1.

Change permissions with chmod

chmod 644 wp-config.php

chmod u+x deploy.sh

Symbolic mode uses u/g/o/a with +, - or =. Apply recursively but separately for files and folders, so files do not become executable:

find /var/www/site -type d -exec chmod 755 {} +

find /var/www/site -type f -exec chmod 644 {} +

Change ownership with chown

chown -R deploy:www-data /var/www/site

The format is user:group. chgrp changes only the group. A common web setup: your deploy user owns the files, the web server's group can read them, and only upload or cache folders are group-writable:

chmod -R g+w /var/www/site/storage

Special bits and umask

• setgid on a directory (chmod g+s dir): new files inherit the directory's group, handy for shared project folders.
• Sticky bit (chmod +t dir): users can only delete their own files, as in /tmp.
• umask sets default permissions for new files. umask 022 gives 644 files and 755 folders; umask 027 removes access for others.

Troubleshooting

• Permission denied running a script: add execute with chmod +x, or run it with bash script.sh.
• 403 Forbidden on a website: the web server cannot read the file or enter a parent directory. Every directory in the path needs x for the web server user.
• WordPress cannot upload: wp-content/uploads must be writable by the PHP user. On cPanel with suPHP/LSAPI, files belong to your account user and 644/755 is correct.
• SSH key ignored: ~/.ssh must be 700 and authorized_keys 600.

Linux permissions FAQ

Is chmod 777 ever OK?

Almost never on a server. It hides an ownership problem; fix the owner or group instead.

What permissions should a website use?

644 for files, 755 for folders, 600 or 640 for config files with passwords, on most setups including cPanel.

What does the + at the end of ls -l mean?

The file has extra ACL entries. View them with getfacl file.

Next steps

• Linux essential commands cheat sheet
• Fix HTTP 403, 404 and 500 errors
• Set up SSH key authentication