You need a Linux machine, or any terminal on macOS — nothing
is installed and nothing is bought. Every command on this page is
read-only or works inside a practice folder you create and can delete
afterwards, and none of them needs sudo. If
you have never opened a terminal at all, start with
Introduction to the
Linux Terminal, which shows you where it is and how to get your
bearings.
Reading the ls -l Output
Every file and directory in Linux has a set of permissions that control who can read,
write, and execute it. You can see these permissions by running ls -l:
$ ls -l
-rw-r--r-- 1 john staff 4096 Mar 1 10:30 report.txt
drwxr-xr-x 3 john staff 4096 Feb 28 14:00 projects
-rwxr-x--- 1 john staff 512 Feb 25 09:00 backup.shThat first column of characters is the permission string. Let's break it down piece by piece:
- rwx r-x ---
| | | |
| | | +-- Other (everyone else)
| | +------- Group (members of the file's group)
| +------------ Owner (the user who owns the file)
+---------------- File type (- = file, d = directory, l = symlink)After the file type character, the remaining 9 characters are always three groups
of three: owner permissions, group permissions, and other (everyone else) permissions.
Each group follows the same rwx pattern.
What r, w, and x Mean
Each permission letter controls a specific type of access. The meaning differs slightly between files and directories:
For Files
cat and less will fail.
For Directories
ls. Without this, you cannot see what is inside.
cd and access files inside it. Without this, the directory is completely inaccessible.
A dash (-) in any position means that permission is not granted. For example:
r-- = read only
rw- = read and write, but not execute
r-x = read and execute, but not write
--- = no access at allA directory with r-- permissions lets you list file names but not
open or read any of them. You need x to actually enter the directory
and access its contents. This is why directories almost always have x
set for at least the owner.
Owner, Group, and Other
Linux uses a three-tier access model. Every file has an owner (a single user) and a group (a single group). Everyone else falls into "other."
$ ls -l report.txt
-rw-r--r-- 1 john staff 4096 Mar 1 10:30 report.txtIn this example:
- john is the owner -- has
rw-(read and write) - staff is the group -- has
r--(read only) - Everyone else -- has
r--(read only)
When Linux checks permissions, it follows this order: if you are the owner, the owner permissions apply. If you are not the owner but belong to the file's group, the group permissions apply. Otherwise, the "other" permissions apply. Only one set applies -- they do not add together.
Run groups to see which groups your user belongs to. Run
id for a more detailed view including your user ID and all group
IDs. This helps you understand which permission tier applies to you for any file.
Changing Permissions with chmod
The chmod (change mode) command modifies file permissions. There are two
ways to use it: symbolic mode (letters) and numeric mode (numbers).
Symbolic Mode
Symbolic mode uses letters to specify who gets what permissions. The format is:
chmod [who][operator][permissions] file
u = owner, g = group, o = other, a = all three
+ adds a permission, - removes it, = sets it exactly
# Give the owner execute permission
chmod u+x script.sh
# Remove write permission from group and other
chmod go-w report.txt
# Give everyone read permission
chmod a+r public-file.txt
# Set exact permissions: owner=rwx, group=rx, other=nothing
chmod u=rwx,g=rx,o= project-dirNumeric (Octal) Mode
Numeric mode represents permissions as a three-digit number. Each digit is the sum of its permission values:
Add the values together for each position (owner, group, other):
7 = 4+2+1 = rwx (full access)
6 = 4+2 = rw- (read and write)
5 = 4+1 = r-x (read and execute)
4 = 4 = r-- (read only)
0 = 0 = --- (no access)# Set permissions to rwxr-xr-x (755)
chmod 755 script.sh
# Set permissions to rw-r--r-- (644)
chmod 644 document.txt
# Set permissions to rwx------ (700)
chmod 700 private-dir
# Set permissions to rw------- (600)
chmod 600 secret-key.pemCommon Permission Patterns
Certain permission numbers appear again and again in Linux. Memorize these and you will be able to handle most situations:
~/.ssh.
SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519)
must be set to 600. If the permissions are too open, SSH will refuse
to use the key and display a warning: "Permissions are too open." Always run
chmod 600 ~/.ssh/id_* after creating or copying keys.
Now Do It Yourself: Five Steps
Permissions are the part of Linux people avoid until something breaks. Ten
minutes of doing it removes that permanently. You will read a permission line,
change one, lock yourself out of a folder on purpose, and let yourself back in.
Nothing needs sudo — you own these files, and owning a file is
exactly what lets you change its permissions.
Go: open a terminal, run cd, then mkdir -p practice and cd practice.
Do: run these three commands.
printf 'top secret\n' > secret.txt
chmod 644 secret.txt
ls -l secret.txtYou should see: a line beginning -rw-r--r--. Read it in four pieces: the first character is the type (- a file, d a directory), then three groups of three — rw- for the owner, r-- for the group, r-- for everyone else. Owner can read and write; everyone else can only read.
If not: if you see something other than -rw-r--r--, the chmod 644 did not run — that step is there deliberately, because the mode a new file gets depends on a per-account setting called umask and therefore differs between machines. Setting it explicitly is what makes the rest of this page match on yours.
Go: same folder.
Do: run these two commands.
chmod 600 secret.txt
stat -c '%A %a' secret.txtYou should see: -rw------- 600. stat shows both spellings of the same thing side by side. The numbers are simply added up per group: read is 4, write is 2, execute is 1. So 6 is read plus write, 4 is read only, and 0 is nothing at all — which is why 600 means "only I can touch this".
If not: chmod: invalid mode: '60' means you typed two digits instead of three. All three positions are always required, in the order owner, group, other.
Go: same folder.
Do: run these two commands.
chmod u+x,go+r secret.txt
stat -c '%A %a' secret.txtYou should see: -rwxr--r-- 744. The letters are u owner, g group, o other, a all, with + to add and - to remove. This form changes only what you name and leaves the rest alone — the numeric form always sets all nine bits at once, which is why it can quietly undo something you wanted to keep.
If not: if group and other lost their read, you wrote go-r with a minus. Put it back with chmod 644 secret.txt before the next step.
Go: same folder.
Do: create a tiny script, try to run it, then allow it and try again.
printf '#!/bin/bash\necho "the script ran"\n' > run.sh
./run.sh
chmod +x run.sh
./run.shYou should see: bash: ./run.sh: Permission denied the first time, then after chmod +x, the script ran. Nothing about the file's contents changed — only permission to execute it.
If not: if it still says Permission denied after chmod +x, check the execute bit really is set with stat -c '%A' run.sh. If it shows x and it still refuses, the filesystem itself is mounted noexec — common for /tmp on hardened systems and for USB sticks. Move the file into your home folder and try there. That exact situation was hit while writing this page, and the permission bits were completely innocent.
Go: same folder.
Do: run these commands in order.
mkdir -p locked
touch locked/inside.txt
chmod 600 locked
ls locked
cd lockedYou should see: ls locked still prints inside.txt, but cd locked fails with bash: cd: locked: Permission denied. On a directory, execute does not mean "run" — it means "enter and reach the things inside". Read lets you list the names; execute lets you use them. Fix it with chmod 700 locked.
If not: if cd succeeds anyway, the chmod did not apply — you must own the directory. This is the single most common real-world permission bug: a folder set to 644 by copying a file's mode, after which everything inside becomes unreachable even though it is all still listed. Directories almost always want 755, or 700 to keep them private.
Without scrolling up: what is 750 in words, and who can do what?
Answer: owner read+write+execute (4+2+1), group read+execute (4+1), everyone else
nothing. On a directory that means the owner can use it fully, the group can enter and
list it, and nobody else can even see inside.
Now do it without the page: create a folder that only you can enter, containing a file that anyone could read if they could get to it. Then explain to yourself why nobody else can read it despite its permissions. That gap between a file's mode and the folder guarding it is where most real permission confusion lives.
Summary
In this tutorial, you learned the fundamentals of Linux file permissions:
- How to read the permission string in
ls -loutput - What
r,w, andxmean for files and directories - The three-tier model: owner, group, and other
- How to change permissions with
chmodusing symbolic and numeric modes - Common permission patterns: 755, 644, 700, 600
Understanding permissions is a cornerstone of Linux security. You now know how to read and set permissions to control exactly who can access your files. This knowledge will be essential as you work with system administration, scripting, and server management.