Summary (TLDR)
- Files: Use 644.
- Folders: Use 755.
- Secrets (Keys/Passwords): Use 600.
- Never: Use 777.
1. The Three Pillars of Permission
Every file and directory in Linux has three specific types of access controls. Think of them as switches that can be turned on or off.
Permission
Value
Description
Read (r) 4 Allows you to view the contents of a file or list the files inside a directory. Write (w) 2 Allows you to modify or delete a file, or create/delete files inside a directory. Execute (x) 1 Allows you to run a file as a program/script or enter (cd into) a directory.2. The Three Categories of Users
Permissions are not applied to "everyone" equally. They are split into three distinct groups for every single file:
- Owner (User): The person who created the file. Usually, you want full control here.
- Group: A specific set of users who need to collaborate on the file (e.g., a "developers" group).
- Others (World): Everyone else on the system or network. This is the most critical category for security.
When you run ls -l, you see a string like -rwxr-xr--. This is divided exactly into these three sections:
rwx(Owner)r-x(Group)r--(Others)
3. The Math: How Octal Numbers Work (644, 755)
Linux uses an octal (base-8) numbering system to represent these permissions compactly. You calculate the permission number by adding the values of Read (4), Write (2), and Execute (1).
Permission Combination
Math
Octal Digit
Symbol
Meaning
Full Access 4 + 2 + 1 7 rwx Read, Write, Execute Read + Write 4 + 2 6 rw- Read, Write (No Execute) Read + Execute 4 + 1 5 r-x Read, Execute (No Write) Read Only 4 4 r-- Read Only Write + Execute 2 + 1 3 -wx Write, Execute (No Read)* Write Only 2 2 -w- Write Only Execute Only 1 1 --x Execute Only No Access 0 0 --- NothingNote: Permission 3 is rare and dangerous because you cannot read the file to know what you are executing.
Constructing the Full Code
A full permission code is three digits long: [Owner][Group][Others].
644 (Standard File):
- Owner: 6 (Read+Write)
- Group: 4 (Read)
- Others: 4 (Read)
- Result: You can edit; everyone else can only view.
755 (Standard Directory/Script):
- Owner: 7 (Read+Write+Execute)
- Group: 5 (Read+Execute)
- Others: 5 (Read+Execute)
- Result: You have full control; everyone else can view and enter/run, but not change.
4. Common Permission Scenarios (Cheat Sheet)
Here are the standard configurations you should use for 99% of tasks.
Octal
Symbolic
Best Used For
Why?
644 rw-r--r-- Standard Files (HTML, CSS, Images, Configs) Safe default. You edit, the web server/public reads. 755 rwxr-xr-x Directories & Scripts Directories need x to be entered. Scripts need x to run. 600 rw------- Private Files (SSH Keys, .env, Database passwords) Maximum security. Only you can read or write. No one else can even see it. 700 rwx------ Private Directories (e.g., ~/.ssh) Only you can enter, list, or modify. 777 rwxrwxrwx NEVER (Except temporary debugging) Security Risk. Everyone can delete, modify, or run your files. Avoid this.5. Essential Commands
How to View Permissions
Use ls -l to see the symbolic format (-rwxr-xr-x) or stat for the numeric format.
How to Change Permissions (chmod)
The chmod (change mode) command sets the permissions.
# Set a file to standard safe permissions (Owner: RW, Others: R)
chmod 644 filename.html
# Set a directory to allow entry (Owner: Full, Others: Read/Enter) chmod 755 myfolder
# Make a script executable chmod +x script.sh
How to Change Ownership (chown)
Sometimes the issue isn't permissions, but ownership. If a file is owned by root but you are a standard user, you can't edit it even with 777 permissions (unless you use sudo).
# Change owner to your user sudo chown $USER:$USER filename.html
6. Why Directories Need "Execute" (x)
This is a common point of confusion. On a file, x means "run this program." On a directory, x means "enter this folder."
- If a directory has
644(Read but no Execute), you can list the files inside (ls), but you cannotcdinto it or access the files within it. - Therefore, almost all directories should be 755, not 644.