Linux and Unix chmod command

Quick links

About chmod
Syntax
Examples
How To Read File Listing Information
Related commands
Linux and Unix main page

About chmod

Changes the permissions of a file.

Syntax

chmod [OPTION]... MODE[,MODE]... FILE...
chmod [OPTION]... OCTAL-MODE FILE...
chmod [OPTION]... --reference=RFILE FILE...

Options

-c, --changes like verbose, but report only when a change is made.
-f, --silent, --quiet suppress most error messages.
-v, --verbose output a diagnostic for every file processed.
--no-preserve-root do not treat '/' (the root directory) in any special way. This is the default.
--preserve-root Do not operate recursively on '/'.
--reference=RFILE use RFILE's mode instead of MODE values.
-R, --recursive change files and directories recursively.
--help display a help message and exit.
--version output version information and exit.

Description

chmod changes the file mode bits of each given file according to mode, which can be either a symbolic representation of changes to make, or an octal number representing the bit pattern for the new mode bits.

The format of a symbolic mode is

[ugoa...][[+-=][perms...]...]

where perms is either zero or more letters from the set rwxXst, or a single letter from the set ugo. Multiple symbolic modes can be given, separated by commas.

A combination of the letters ugoa controls which users' access to the file will be changed: the user who owns it (u), other users in the file's group (g), other users not in the file's group (o), or all users (a). If none of these are given, the effect is as if a were given, but bits that are set in the umask are not affected.

The operator + causes the selected file mode bits to be added to the existing file mode bits of each file; - causes them to be removed; and = causes them to be added and causes unmentioned bits to be removed except that a directory's unmentioned set user and group ID bits are not affected.

The letters rwxXst select file mode bits for the affected users: read (r), write (w), execute (or search for directories) (x), execute/search only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), restricted deletion flag or sticky bit (t). Instead of one or more of these letters, you can specify exactly one of the letters ugo: the permissions granted to the user who owns the file (u), the permissions granted to other users who are members of the file's group (g), and the permissions granted to users that are in neither of the two preceding categories (o).

A numeric mode is from one to four octal digits (0-7), derived by adding up the bits with values 4, 2, and 1. Omitted digits are assumed to be leading zeros. The first digit selects the set user ID (4) and set group ID (2) and restricted deletion or sticky (1) attributes. The second digit selects permissions for the user who owns the file: read (4), write (2), and execute (1); the third selects permissions for other users in the file's group, with the same values; and the fourth for other users not in the file's group, with the same values.

chmod never changes the permissions of symbolic links; the chmod system call cannot change their permissions. This is not a problem since the permissions of symbolic links are never used. However, for each symbolic link listed on the command line, chmod changes the permissions of the pointed-to file. In contrast, chmod ignores symbolic links encountered during recursive directory traversals.

Setuid And Setgid Bits

chmod clears the set-group-ID bit of a regular file if the file's group ID does not match the user's effective group ID or one of the user's supplementary group IDs, unless the user has appropriate privileges. Additional restrictions may cause the set-user-ID and set-group-ID bits of MODE or RFILE to be ignored. This behavior depends on the policy and functionality of the underlying chmod system call. When in doubt, check the underlying system behavior.

chmod preserves a directory's set-user-ID and set-group-ID bits unless you explicitly specify otherwise. You can set or clear the bits with symbolic modes like u+s and g-s, and you can set (but not clear) the bits with a numeric mode.

Restricted Deletion Flag (or "Sticky Bit")

The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the directory; this is called the restricted deletion flag for the directory, and is commonly found on world-writable directories like /tmp. For regular files on some older systems, the bit saves the program's text image on the swap device so it will load more quickly when run; this is called the sticky bit.

How To Specify MODE

MODE is of the form:

[ugoa]*([-+=]([rwxXst]*|[ugo]))+|[-+=][0-7]+

For an in-depth explanation about how to specify the file MODE that chmod should apply to files, see What Are Permissions, And How Do They Work?

Examples

chmod 644 file.htm

Set the permission of file.htm to "read/write by owner" and "read only by the group and everyone else" (-rw-r--r--).

Note: Files such as scripts that need to be executed will need execute permissions.

chmod u=w example.jpg

Clear the user permission bit of example.jpg and set it to write-only.

chmod u+s comphope.txt

Set the User ID bit of comphope.txt, so that anyone who attempts to access that file does so as if they are the owner of the file.

chmod u-s comphope.txt

Same as above, but unset the bit.

chmod 755 file.cgi

Set the permission of file.cgi to "read, write, and execute by owner" and "read and execute by the group and everyone else" (-rwxr-xr-x). This would be the following 400+040+004+200+100+010+001 = 755 where you are giving all the rights except the capability for anyone to write to the file.cgi file.

chmod 666 file.txt

Set the permission of file.txt to "read and write by everyone" (-rw-rw-rw-).

Tip: The above commands are all done through the command line. However, if you upload a file using FTP these permissions can also be adjusted through many FTP clients by right-clicking the file and choosing permissions.

Example: Listing File Information

Here is an example of how a file may be listed with the ls -l command, and the output:

ls -l file.txt
-rwxrw-r-- 1   hope   hopestaff  123   Feb 03 15:36   file.txt

Here's what each part of this information means:

- The first character represents the file type: "-" for a regular file, "d" for a directory, "l" for a symbolic link.
rwx The next three characters represent the permissions for the file's owner: in this case, the owner may read from, write to, and/or execute the file.
rw- The next three characters represent the permissions for members of the group that the file belongs to. In this case, any member of the file's owning group may read from or write to the file. The final dash is a placeholder; group members do not have permission to execute this file.
r-- The permissions for "others" (everyone else). Others may only read this file.
1 The number of hard links to this file.
hope The file's owner.
hopestaff The group to whom the file belongs.
123 The size of the file in blocks.
Feb 03 15:36 The file's mtime (date and time when the file was last modified).
file.txt The name of the file.

Related commands

access
chown
getfacl
ls