Read one listing before changing anything
Run ls -l -- "$HOME" to inspect entries in your home. To inspect the home directory itself, use ls -ld -- "$HOME". The d option matters: without it, ls normally lists a directory's contents. Choose an item you recognise, rather than experimenting on a system folder or your entire home.
A mode such as -rw-r--r-- starts with a type indicator: the initial dash marks a regular file, while d marks a directory. The next nine characters form three triplets for the owner, the owning group and everyone else. A dash inside a triplet means that bit is absent. The owner and group names appear elsewhere in the long listing.
The same letters do different jobs on a directory
For a regular file, read allows reading its contents, write allows changing its contents, and execute permits execution attempts. Execute permission does not establish trust, install a dependency or make arbitrary text a working program. Review a script and its source before choosing to run it.
A directory is a collection of names that point to entries. Its permissions control operations on that collection. This explains why making one file read-only does not, by itself, guarantee that nobody can remove its directory entry. Parent-directory access and other rules also matter.
| Bit | Regular file | Directory |
|---|---|---|
| r — read | Read the contents. | List the names of entries. |
| w — write | Modify the contents. | Add or remove entries, usually together with search permission. |
| x — execute/search | Attempt to execute the file. | Traverse the directory and access named entries, subject to their permissions. |
Translate 644 and 755 without memorising a chart
Within each triplet, read contributes 4, write 2 and execute 1. Add the selected values. Read and write together are 6; read and execute together are 5; all three are 7. The three ordinary digits describe owner, group and other access in that order.
For an ordinary regular file with no special mode bits, 644 represents rw-r--r--. It is a common example for a document that its owner edits and others may read. It is unsuitable for a private document when other users can reach it. 755 represents rwxr-xr-x: everyone gets read and execute/search, while only the owner gets write. Neither number is a universal default for every purpose.
Choose between replacing bits and changing one part
A numeric mode specifies the ordinary permission pattern you want. A symbolic change names whose bits to alter: u is the owner, g the group, o others and a all three. The plus operator adds bits; minus removes them. These forms are useful when you want to make one limited change while retaining the rest.
For a script you own and have reviewed, chmod u+x -- ./your-reviewed-script.sh adds owner execute permission. Replace the example name with your actual file. It does not grant group or other execute permission. To remove write access for other users on one chosen file, chmod o-w -- ./your-file removes that bit. Inspect again afterward rather than assuming the command produced the whole policy you intended.
Practise on one newly created empty file
For an isolated exercise, run practice_file=$(mktemp -- "$HOME/digitalmaple-permissions.XXXXXX") in a normal Bash terminal. This creates an empty file with a unique name and remembers its path for this shell session. If the command reports an error, stop here; do not continue with an unset or empty path.
Next run ls -l -- "$practice_file". Run chmod 644 -- "$practice_file" and inspect it again, then chmod 600 -- "$practice_file" and inspect once more. Mode 600 removes the ordinary group and other bits. This exercise stores no private content. Find the displayed filename in Files when you want to discard it; it can remain harmlessly empty until then.
Check ownership and the path before blaming chmod
chmod changes mode bits, not the owner or owning group. An ordinary user generally changes modes on files they own. A permission error on someone else's file calls for understanding the intended sharing arrangement, not repeatedly applying broader numbers. Ask the owner or administrator when access should be shared.
A directory needs search permission to traverse it. Applying a document-style 644 to a directory can therefore prevent useful access even though its listing contains read bits. Access can also fail at a parent directory. Inspect the relevant path components before concluding that the final file's mode is the only issue.
Use the calculator for the nine ordinary bits
The chmod calculator helps translate checkboxes, symbolic triplets and ordinary three-digit modes. It does not change your computer or evaluate a complete access decision. Ownership, extended ACLs, special mode bits, mount options and security policy are outside that small calculation. A permission display on a non-Linux filesystem may also reflect mount settings rather than separately stored Linux modes.
Avoid chmod 777 as a troubleshooting habit: it gives every class all three ordinary permissions. Avoid recursive changes until you have a clear, reviewed rule for every affected file and directory. A folder tree contains different kinds of content; one blanket number can expose documents or break directory traversal. Make the smallest understood change and check the original task again.
Sources & further reading
Documentation reviewed .
GNU Coreutils — Structure of File Mode Bits ↗GNU Coreutils — Numeric Modes ↗GNU Coreutils — Setting Permissions ↗GNU Coreutils — chmod invocation ↗GNU Coreutils — Which files are listed ↗GNU Coreutils — mktemp invocation ↗This guide is based on the sources linked above, with original explanations and examples. Software interfaces and service features can change. A documentation-based guide is not a hands-on product review. Read our editorial policy or report a correction.