chmod

Overview

chmod ("change mode") is the command that sets file permissions. It supports two notations — symbolic and numeric (octal) — and mastering it is essential for correctly securing files. This lesson explains how to change permissions.

Learning objectives

• Use chmod in symbolic and numeric forms.
• Convert between rwx and octal digits.
• Apply permission changes safely.

Core concept

chmod changes a file's permission bits. Two notations:

• Symbolic — specify class (u owner, g group, o other, a all), an operator (+ add, - remove, = set exactly), and permissions (r, w, x). Example: chmod g+w file adds write for the group.
• Numeric (octal) — each class gets a digit that sums its permissions: r=4, w=2, x=1. So rwx=7, rw-=6, r-x=5, r--=4. Three digits give owner/group/other. Example: chmod 640 file = owner rw-, group r--, other ---.

How it works

Symbolic mode adjusts specific bits relative to current settings (great for small changes like "add execute for the owner": chmod u+x). Numeric mode sets all bits at once from the octal value (great for setting a known exact state: chmod 600 = owner read/write only). Compute each octal digit by adding 4 (r) + 2 (w) + 1 (x) for the permissions you want in that class. Only the owner (or root) can change a file's permissions.

Practical example

$ chmod 600 ~/.ssh/id_ed25519      # owner rw-, group ---, other --- (private key locked down)
$ chmod u+x script.sh              # add execute for the owner so it can be run
$ chmod 644 index.html             # owner rw-, group r--, other r-- (typical readable file)

600 restricts a private key to its owner (a requirement for SSH keys), u+x makes a script runnable by its owner, and 644 sets an ordinary file readable by all but writable only by the owner.

Cybersecurity relevance

Correct chmod usage is central to hardening. Private keys and secrets must be restricted (e.g. 600), or tools like SSH will refuse to use them and, worse, they could be read by others. A frequent, dangerous mistake is making files world-writable (e.g. chmod 777), which lets anyone modify them — a common finding that enables tampering and escalation. Setting the minimum necessary permissions (least privilege) is the safe default.

Common mistakes

• Using chmod 777 ("make it work") — this grants everyone full access and is a serious risk.
• Miscomputing octal digits — remember r=4, w=2, x=1 per class.
• Forgetting private keys need tight permissions (e.g. 600), or SSH will reject them.

Key takeaways

• chmod sets permissions symbolically (u/g/o/a with +/-/= and r/w/x) or numerically (octal, r=4 w=2 x=1 per class).
• Symbolic mode tweaks specific bits; numeric mode sets the full state at once (e.g. 600, 644, 755).
• Apply least privilege — restrict secrets tightly and avoid world-writable 777, a common dangerous misconfiguration.

Check your understanding

• What octal value gives the owner read/write, the group read-only, and others no access?
• Why is chmod 777 on a file usually a security problem?