Changing Permissions with chmod

Part I · Module 5 · Chapter 5.3 · Changing Permissions with chmod

1. One Command, Two Notations

chmod is short for change mode, mode being the nine permission bits from Chapter 5.2.

chmod  MODE  FILE...

The MODE can be written two ways, and they behave differently in a way that matters:

That distinction is the whole chapter. Everything else is syntax.

One rule before either: you can only change permissions on files you own (root excepted, per Chapter 5.1). Being able to write to a file is not enough — ownership is what grants the right to change its mode.

2. Symbolic: Adjust One Thing

Three pieces, in order: who, what operation, which permissions.

chmod  u  +  x  run.sh
       │  │  └── which permission: read, write, execute
       │  └───── operation: add, remove, or set exactly
       └──────── who: user (owner), group, other, all

The vocabulary:

Worked through on one file, watching the string change each time:

$ ls -l f.txt
-rw-r--r-- 1 engineer engineer 0 Mar 24 16:02 f.txt

$ chmod u+x f.txt
$ ls -l f.txt
-rwxr--r-- 1 engineer engineer 0 Mar 24 16:02 f.txt

$ chmod go-r f.txt
$ ls -l f.txt
-rwx------ 1 engineer engineer 0 Mar 24 16:02 f.txt

$ chmod a=r f.txt
$ ls -l f.txt
-r--r--r-- 1 engineer engineer 0 Mar 24 16:02 f.txt

Three operations, three different behaviours:

• u+x added execute for the owner. The other eight bits are exactly as they were.
• go-r removed read from the group and everyone else — two audiences in one command. The owner's rwx was untouched.
• a=r set all three to read only, which removed the owner's write and execute. = is the destructive one, because it specifies the complete answer rather than an adjustment.

More combinations, all of which read naturally once the vocabulary is fixed:

$ chmod u+w notes.txt          # let the owner write
$ chmod go-w shared.txt        # stop the group and others writing
$ chmod a+r public.txt         # let everybody read
$ chmod u+rw,go-rwx private.txt   # two changes in one command, comma-separated
$ chmod +x script.sh           # add execute — see the warning below

3. Numeric: Replace All Nine

Chapter 5.2's arithmetic, used as input:

$ chmod 640 config.txt
$ ls -l config.txt
-rw-r----- 1 engineer engineer 0 Mar 24 16:10 config.txt

$ chmod 755 run.sh
$ ls -l run.sh
-rwxr-xr-x 1 engineer engineer 0 Mar 24 16:10 run.sh

$ chmod 600 secret.txt
$ ls -l secret.txt
-rw------- 1 engineer engineer 0 Mar 24 16:10 secret.txt

Each digit is owner, group, everyone else, with r=4, w=2, x=1 added together.

Numeric is right when you know the complete answer you want:

• you are setting a file to a standard mode — 644 for a file, 755 for a directory or program;
• you want all nine bits defined, with no dependence on what they were;
• you are writing it down for somebody else, where "the mode is 640" is unambiguous and "add write for the owner" depends on the starting point.

The last reason is why instructions and documentation almost always use numbers.

4. Several Files, and Whole Trees

chmod takes any number of operands, so Chapter 3.5's patterns work:

$ chmod 644 *.txt
$ chmod +x scripts/*.sh

The usual care applies — echo first if the pattern is at all uncertain, per Chapter 3.5.

And -R applies the change through a whole directory tree:

$ chmod -R 755 project/

Which brings us to the most common mistake in this chapter.

-R with one mode is almost always wrong

$ chmod -R 755 tree/

$ ls -l tree/a.txt
-rwxr-xr-x 1 engineer engineer 0 Mar 24 16:20 tree/a.txt

a.txt is a plain text file and is now executable by everybody.

The cause is in Chapter 5.2. Directories need x to be traversable; plain files do not need it at all. A single mode applied to both cannot be right for both — 755 is correct for the directories and over-permissive for every file, while 644 would be correct for the files and would make every directory unusable.

What to do instead:

$ chmod -R u+rwX,go+rX,go-w project/

The capital X is the piece that makes this work: add execute only where it makes sense — to directories, and to files that already have execute somewhere. Plain files are left alone.

Note the case. x always adds execute; X adds it conditionally. It is one of the few places in this course where capitalisation changes behaviour this much.

The fully precise approach applies different modes to files and directories separately, which needs a tool that can tell them apart — find, in Module 14.

5. What Is Wrong With 777

$ chmod 777 project/

This appears in instructions all over the internet as a fix for a permission problem, and it works in the sense that the error stops. Here is what it actually does.

777 is rwxrwxrwx: every person on the machine may read, write and execute. On a shared engineering machine with forty accounts, that is forty people who can modify your work.

Three concrete consequences:

Anyone can change your files, including by accident. A mistyped command in a shared area now has a wider blast radius.

Anyone can delete them — Chapter 5.2's rule about directory write permission, now granted to everybody.

You have lost the information. The permissions no longer record anything about who is supposed to have access, so nobody — including you, later — can tell what the intent was.

And in most cases it does not even address the real problem. A Permission denied is usually one of:

• the file needs x and does not have it → chmod u+x;
• a directory in the path is not traversable → fix that directory, per Chapter 5.2's --x demonstration;
• the file belongs to someone else → a question of ownership, Chapter 5.4;
• you are genuinely not meant to have access → the answer is to ask, not to force.

777 is a way of not finding out which. The habit worth building instead: work out which of the three categories you need to change, change that one, and verify with ls -l.

6. Verifying, Always

chmod prints nothing on success — Chapter 1.2's convention again. So check:

$ chmod 640 config.txt
$ ls -l config.txt
-rw-r----- 1 engineer engineer 1024 Mar 24 16:30 config.txt

Or ask chmod to say what it did:

$ chmod -v 640 config.txt
mode of 'config.txt' changed from 0644 (rw-r--r--) to 0640 (rw-r-----)

-v is verbose and prints both the old and new modes, which is genuinely useful on a tree where you want to see what changed. (-c is a quieter relative that reports only files it actually changed.)

7. The Failures

Changing a file you do not own.

$ chmod 644 /etc/hosts
chmod: changing permissions of '/etc/hosts': Operation not permitted

Not Permission denied but Operation not permitted — a different message for a different reason. You are not being refused access; you are being told that changing a mode requires ownership, which you do not have.

Using = when you meant +. chmod u=x run.sh gives the owner execute and removes read and write. Almost always you wanted u+x.

Expecting chmod to make something runnable. It sets the bit. Whether the file is a sensible thing to run is Chapter 5.5.

chmod +x behaving differently than you expect.

$ ( umask 077; touch a.sh; chmod +x a.sh; ls -l a.sh )
-rwx------ 1 engineer engineer 0 Mar 24 16:40 a.sh

$ ( umask 022; touch b.sh; chmod +x b.sh; ls -l b.sh )
-rwxr-xr-x 1 engineer engineer 0 Mar 24 16:40 b.sh

The same chmod +x produced different results. A bare +x with no u, g or o in front of it is affected by a setting called the umask, which is Chapter 5.6's entire subject.

The practical consequence now: +x is slightly unpredictable; u+x and a+x are not. Say who you mean.

8. Why This Matters in Engineering Work

Three situations.

Making a script runnable. The single most common use, and it is chmod u+x — not 755, unless you have decided other people should run it too. Chapter 5.5 covers what else must be true.

Protecting something before you share a directory. Before a work area becomes group-accessible, the things that should stay private need saying so:

$ chmod 600 credentials.txt

Fixing output nobody else can read. A job writes results that a colleague cannot open. The fix is to add group read — chmod g+r results/* — and the lasting fix is Chapter 5.6, which stops them being created that way in the first place.

The habit underneath all three: decide which category needs what, change only that, verify with ls -l. Three steps, and it rules out the entire class of problem that 777 is used to paper over.

9. Practice

Question 1. What do u, g, o and a mean? What do +, - and = mean?

Question 2. A file is -rw-r--r--. Give the symbolic command that lets only the owner run it, and the resulting string.

Question 3. Same file. Give the numeric command that produces -rwxr-xr-x, and show the arithmetic.

Question 4. chmod a=r notes.txt on a -rw-rw-r-- file. What is the result, and what was lost?

Question 5. Explain the difference between symbolic and numeric in one sentence, and say when each is the right choice.

Question 6. chmod -R 755 project/ makes every text file executable. Explain why, using what Chapter 5.2 said about directories, and give a better command.

Question 7. A colleague suggests chmod 777 to fix an access problem. Give three specific things that is wrong with it, and the single command you would run instead to find the real cause.

Question 8. chmod 644 /etc/hosts reports Operation not permitted rather than Permission denied. What is the difference being reported?

Question 9. Why is u+x more predictable than a bare +x?

10. Remember

• chmod changes the mode, and only the owner of a file may do it. Write permission is not enough.
• Symbolic adjusts; numeric replaces. u+x changes one bit; 755 states all nine.
• Symbolic is who, operation, what: u/g/o/a, then +/-/=, then r/w/x.
• = removes anything you did not list — it is the destructive operator of the three.
• Numeric is right when you know the complete answer, and is what written instructions use because it does not depend on the starting point.
• -R with a single mode is almost always wrong, because files and directories need different things. Capital X adds execute only where it makes sense.
• 777 grants everybody everything, loses the information about intent, and usually does not address the real cause.
• Diagnose instead: ls -ld on each level of the path. The denial is at exactly one.
• Verify afterwards with ls -l, or use chmod -v to see the before and after.
• A bare +x is affected by the umask; u+x and a+x are not. Say who you mean.

The next chapter turns from what may be done to who a file belongs to — and sets up the arrangement that lets a team genuinely share a directory.