chmod: Numeric and Symbolic Permission Modes
What you'll be able to do
- Compute `644` and `755` yourself by adding `r=4`, `w=2`, and `x=1`
- Build symbolic mode from `u` `g` `o` `a` and `+` `-` `=`
- Choose numeric for a final state and symbolic for adding or removing a bit
Prerequisites (read these first)
What are chmod's "two ways to write it"?
chmod. Some articles write chmod 644. Others write chmod u+x. Which one is correct?chmod has two notations.u+x. They express the same thing in different words.chmod changes the permissions of files and directories. There are two ways to specify them: numeric mode (digits like 644) and symbolic mode (letters like u+x). Both set the exact same permissions.
Words used in this article
- PermissionThe read / write / execute access rules set on a file or directory.: the setting that decides who may do what with a file. "Access right" and "mode" are other names for the same thing.
- Numeric mode: the three-digit notation such as
644. It is also called "octal mode" or "absolute mode". - Symbolic mode: the letter notation such as
u+x. It is also called "relative mode".
In one line
- Numeric mode → when you want to set the whole permission in one shot (
chmod 644 file) - Symbolic mode → when you want to add or remove just a bit from the current state (
chmod u+x file)
Decide on a safe way to practise first
chmod rewrites a setting on a file. If you get the specification wrong, two things can happen.
- You removed too much: even you can no longer read the file. You see
Permission denied - You granted too much: other people can now change the file
Both are undone by running chmod again. The contents of the file are never lost. Even so, practise like this.
- Create a practice directoryA container that organizes files. Same idea as a "folder" on Windows or macOS. and work only inside it (for example,
mkdir -p ~/chmod-practice && cd ~/chmod-practice) - Test on a throwaway file such as
touch demo.txt - Run
ls -lbefore and after each change, and read what actually changed
You can try chmod in the virtual terminalAn interactive program that reads the commands you type and runs them. on this site. No setting on your own machine changes, so try things freely.
Note that the virtual terminal accepts symbolic mode one specification at a time. Comma-joined forms such as chmod u+x,go-w file are for a real Linux machine.
What You'll Learn
- That numeric mode (
644,755) and symbolic mode (u+x,go-w) describe the same permissions - How to compute numeric mode yourself with
r=4,w=2,x=1 - How to build symbolic mode with
u/g/o/aand+/-/= - How to choose between "set the whole thing" and "add/remove a bit"
- A safe pattern that avoids accidents like
chmod 777
1. The shared foundation: rwx and three audiences
Conclusion: Permissions grant read (r), write (w), execute (x) to owner (u), group (g), and other (o). Both numeric and symbolic just describe this.
ls -l shows something like rwxr-xr-x, it looks like a spell to me.- means a file and d means a directory.rwx is the owner, the next r-x is the group, and the last r-x is everyone else.r means read, w means write, and x means execute.What the three audiences mean
- Owner (
u): the person who created the file. Also called the "owner" or "user". - Group (
g): the people registered as the same team. - Other (
o): everyone who is not one of the two above.
$ ls -l script.sh
-rwxr-xr-x 1 user user 128 Jun 5 10:00 script.sh
| Position | Audience | Letter | This example | Meaning |
|---|---|---|---|---|
| char 1 | type | - | - |
- is a file, d is a directory |
| chars 2-4 | owner | u (user) |
rwx |
read, write, execute |
| chars 5-7 | group | g (group) |
r-x |
read and execute |
| chars 8-10 | other | o (other) |
r-x |
read and execute |
a (all) is a shortcut that means "u, g, and o together". We'll use it later.
2. Symbolic mode: think in add and remove
Conclusion: Symbolic mode is "who (u/g/o/a) + how (+/-/=) + what (r/w/x)." It changes from the current state, so the intent is clear.
Symbolic mode combines three parts:
| Part | Letters | Meaning |
|---|---|---|
| who | u / g / o / a |
owner / group / other / all |
| how | + / - / = |
add / remove / set (overwrite) |
| what | r / w / x |
read / write / execute |
2-1. Add execute for the owner
$ chmod u+x script.sh
This gives x (execute) to u (the owner) with + (add). Run it on an rw-r--r-- (644) file and you get rwxr--r--, so only the owner can run it.
2-2. Take write away from group and other
$ chmod go-w secret.txt
This removes w (write) from g and o (group and other) with - (remove). You can target several audiences at once.
2-3. Make it read-only for everyone (the power of =)
$ chmod a=r notes.txt
This gives a (all) only r with = (set). = clears the current permissions first, then sets them. So even if write or execute were present, the result is read only.
+ different from =?+r means "add read to whatever exists now". =r means "make it read only", so the rest is removed.= is handy.You can combine specifications with commas. For example, chmod u+x,go-w file adds execute for the owner and removes write from group and other in one command.
That form works on a real Linux machine. In the virtual terminal on this site, run it as two commands: chmod u+x file and chmod go-w file.
3. Numeric mode: the r=4 w=2 x=1 math
Conclusion: Numeric mode adds r=4, w=2, x=1 into one digit, then lines up three digits for owner, group, other.
644is owner rw, others r.
6 in 644 come from?r is 4, w is 2, and x is 1.rw- is 4+2, which is 6. r-- is 4.644.Memorize the score for each permission. There are only three.
| Permission | Score |
|---|---|
r (read) |
4 |
w (write) |
2 |
x (execute) |
1 |
3-0. Build 644 in three steps
You do not have to memorize the digits. You can build them in three steps.
Step 1: write down, in plain words, what each audience should be allowed to do.
- Owner: wants to read. Wants to write
- Group: wants to read
- Other: wants to read
Step 2: add the scores for each audience.
- Owner:
r(4) +w(2) = 6 - Group:
r(4) = 4 - Other:
r(4) = 4
Step 3: line the digits up as owner, group, other.
- 6, 4, and 4 line up as
644
Each digit stands for one audience. That is why three digits cover three audiences.
It works backwards too. The 7 in 755 is 4+2+1, which is rwx. The 5 is 4+1, which is r-x.
When you see a 4, think r. A 2 is w, and a 1 is x. Any combination comes from the addition.
| Digit | Sum | Letters | Meaning |
|---|---|---|---|
| 7 | 4+2+1 | rwx |
everything |
| 6 | 4+2 | rw- |
read and write |
| 5 | 4+1 | r-x |
read and execute |
| 4 | 4 | r-- |
read only |
| 0 | 0 | --- |
no permission |
3-1. Common numeric combinations
$ chmod 644 notes.txt # rw-r--r-- a normal file $ chmod 755 script.sh # rwxr-xr-x runnable script or directory $ chmod 600 id_rsa # rw------- private key, owner only
| Numeric | Letters | Common use |
|---|---|---|
644 |
rw-r--r-- |
normal file (only owner edits) |
755 |
rwxr-xr-x |
scripts and directories |
600 |
rw------- |
private keys, password files |
700 |
rwx------ |
owner-only directory |
Tip for reading back: read 755 one digit at a time. The 7 is rwx, the first 5 is r-x, and the last 5 is r-x as well.
Once r=4 w=2 x=1 is memorized, you can move freely between letters and digits.
4. Which one? A pattern for choosing
Conclusion: Use numeric to "set the whole permission," symbolic to "add or remove a bit from the current state." Pick the one whose intent reads clearly.
| What you want | Recommended | Example |
|---|---|---|
| Set the full permission at once | numeric | chmod 644 file |
| Add or remove from current | symbolic | chmod u+x file |
| Change without disturbing others | symbolic | chmod g+w file |
| Lock a private key to owner | numeric | chmod 600 id_rsa |
| Remove execute from everyone | symbolic | chmod a-x file |
Rule of thumb in practice
- Just adding execute to a script →
chmod +x script.sh(omitting the audience targets everyone, butumaskstill applies; on a default setup the result matchesa+x) - Resetting a config file to standard permissions →
chmod 644 config.yaml
5. Common accidents and the safe pattern
Conclusion:
chmod 777grants "everyone everything" and is dangerous. The safe pattern is to give only the minimum permission needed.
A frequent accident: chmod 777
$ chmod 777 file # rwxrwxrwx = anyone can read, write, and execute
Setting 777 because it makes Permission denied go away is the worst pattern. It grants write and execute even to other. That opens a security hole.
5-1. Lina Gets Stuck: chmod 444 locked her out
chmod 444 notes.txt. Now I cannot save my own edits either.$ chmod 444 notes.txt $ ls -l notes.txt
-r--r--r-- 1 user user 42 Jun 5 10:20 notes.txt
444 is 4+0+0, so all three audiences get r only. The owner's w is gone too.4, I removed my own write permission.600. The 6 is 4+2, which is rw-.$ chmod 600 notes.txt $ ls -l notes.txt
-rw------- 1 user user 42 Jun 5 10:21 notes.txt
Removing too much permission never deletes the contents. Running chmod again brings the access back.
777. It started working, so I thought it was fine.ls -l. Then add only what is missing.chmod u+x is enough. 777 almost never has a real use.Watch out for x on directories
For a directory, x is the permission to enter it. Think of it as whether cd works. With only r, you can list the directory but not enter it.
That is why directories commonly use 755 (rwxr-xr-x).
The safe pattern is these three steps:
- Check the current permission with
ls -l - Decide "who is missing or has extra what"
- Add only the minimum needed, like
chmod u+x
6. Mini Exercises: Try It Yourself
Conclusion: Three exercises - compute the digits, add with symbolic mode, and confirm both notations match.
$ mkdir -p ~/chmod-practice && cd ~/chmod-practice $ touch demo.txt $ ls -l demo.txt
-rw-r--r-- 1 user user 0 Jun 5 10:10 demo.txt
Exercise 1: Make demo.txt readable and writable by the owner only. Use numeric mode.
Show Hint 1 (Direction)
Add up the scores for each audience. The owner needs two things: read and write. Group and other get nothing.
The score for "nothing" is 0.
Show Hint 2 (Command name)
Use chmod. r is 4 and w is 2, so the owner digit is 4+2. The other two digits are 0.
Check the result with ls -l.
Show Answer
$ chmod 600 demo.txt $ ls -l demo.txt
-rw------- 1 user user 0 Jun 5 10:11 demo.txt
6 is 4+2, which is rw-. 0 means no permission, which prints as ---.
Exercise 2: Add execute for the owner of demo.txt. Keep the permissions that are already there.
Show Hint 1 (Direction)
This is an "add a little to the current state" situation. You do not need to specify the whole final state.
Only the owner is affected.
Show Hint 2 (Command name)
Use chmod. The audience is u, the action is +, and the permission is x. Write those three together.
Show Answer
$ chmod u+x demo.txt $ ls -l demo.txt
-rwx------ 1 user user 0 Jun 5 10:12 demo.txt
Read and write stayed. Only execute was added. In numeric mode this state is 700.
Exercise 3: Produce the same rw------- using symbolic mode only. It must land there whatever the current permission is.
Show Hint 1 (Direction)
This is neither adding nor removing. Use the symbol that clears the current permissions and then sets them.
Think in two stages: empty everyone first, then grant the owner.
Show Hint 2 (Command name)
Use chmod. The symbol that clears and sets is =. Everyone is a and the owner is u.
Two specifications can be listed with a comma between them.
Show Answer
$ chmod a=r demo.txt $ chmod u=rw demo.txt $ ls -l demo.txt
-rw-r--r-- 1 user user 0 Jun 5 10:13 demo.txt
The first line makes everyone read-only. The second gives write back to the owner alone.
= clears the current permissions before setting them, so splitting it into two steps never drags the intermediate state along.
On a real Linux machine you can join it into one line with a comma. That form lands on rw-------, exactly like 600.
$ chmod a=,u=rw demo.txt
The virtual terminal on this site accepts one specification at a time.
If you have time, try chmod 755 demo.txt, then chmod u=rwx followed by chmod go=rx. On a real machine the comma form chmod u=rwx,go=rx demo.txt gives the same result.
7. Review
r is 4, w is 2, and x is 1. Add them per audience and line up three digits.444 locked me out because it removed the owner's w.ls -l before you change anything. That one habit prevents most of these mistakes.Cleanup uses rm, and rm is different from everything else here
A file removed with rm does not go to a trash folder the way it does in a GUI. It is gone immediately and cannot be recovered.
-r: removes a directory together with its contents-i: asks about each item before removing it
With -i, a confirmation appears for every target. Type y and press Enter to remove it, or type n to keep it.
Before deleting, always check the pathA string that describes the location of a file or directory. and contents with ls.
$ cd ~ $ ls ~/chmod-practice $ rm -ri ~/chmod-practice
The virtual terminal on this site is for learning. Running this here deletes no file on your own computer, so try it freely.
Today's 3-Line Summary
- Adding
r=4,w=2, andx=1gives numeric mode. The order is owner, group, other - Symbolic mode is a set of three: who (
u/g/o/a), how (+/-/=), and what (r/w/x) - Pick numeric when the final state is decided, and symbolic when you add or remove from now
Summary Table
| What you want | Numeric mode | Symbolic mode |
|---|---|---|
| Normal file | chmod 644 file |
chmod u=rw,go=r file |
| Runnable script | chmod 755 file |
chmod u=rwx,go=rx file |
| Add execute | (needs full spec) | chmod u+x file |
| Remove write | (needs full spec) | chmod go-w file |
| Private key | chmod 600 file |
chmod a=,u=rw file |
The comma-joined symbolic forms are for a real Linux machine. In the virtual terminal on this site, run one specification at a time.
Three things to remember
- r=4 w=2 x=1: addition lets you read and write numeric mode
- u/g/o/a and +/-/=: symbolic mode is "who, how, what"
- Numeric for the final state, symbolic to add/remove: choose by goal