chmod 755 vs u+x: Which Permission One Better?

chmod wetin e change

chmod dey change permission bits for file or directory, and e accept those bits with one of two notations. Numeric form na octal number wey replace every permission bit at once. Symbolic form name user class and operator, then e edit only the bits wey you specify. Both forms end for the same system call. Difference na wetin happen to bits wey you no mention.

Reading a mode and changing a mode na two different work. If letters for long listing never clear to you, first read wetin drwxr-xr-x mean field by field. This guide only dey change dem.

Run everything here as your ordinary login user. root account dey bypass these checks, so permission demonstration wey you run as root no prove anything. If you still dey work as root for new server, create normal user with least privilege and come back.

Set up sandbox wey you fit throw away

cd "$(mktemp -d)"
touch notes.txt

mktemp -d go create empty directory under /tmp and print the path wey e make, while command substitution go pass that path straight to cd. Nothing for the steps below go touch any file wey you care about.

One command go report the result of every change:

stat -c '%a %A %n' notes.txt

%a go print the mode as octal number, %A go print the same mode with the letters wey long listing dey use, and %n go print the name. For the blocks wey follow, line wey start with $ na wetin you go type, and the line under am na wetin command print. Run dem yourself. Output for your machine suppose match line by line, because numeric mode no depend on anything for your environment.

Numeric form: octal digit one for each class

The first digit belong to the file owner. The second one belong to the file group. The third one belong to everybody else. Each digit na sum of values, one value for each bit. Set one bit at a time and read wetin stat report.

$ chmod 400 notes.txt
$ stat -c '%a %A %n' notes.txt
400 -r-------- notes.txt
$ chmod 200 notes.txt
$ stat -c '%a %A %n' notes.txt
200 --w------- notes.txt
$ chmod 100 notes.txt
$ stat -c '%a %A %n' notes.txt
100 ---x------ notes.txt

The letters match the digits. After the first character wey show file type, the first group of three letters na the owner's own, the next three na the group's own, and the last three belong to everybody else. Add the values to combine bits inside one class.

$ chmod 600 notes.txt
$ stat -c '%a %A %n' notes.txt
600 -rw------- notes.txt
$ chmod 700 notes.txt
$ stat -c '%a %A %n' notes.txt
700 -rwx------ notes.txt
$ chmod 750 notes.txt
$ stat -c '%a %A %n' notes.txt
750 -rwxr-x--- notes.txt

Numeric mode dey absolute. E write all nine bits every time, so e go still write a class wey you no plan to change.

$ chmod 755 notes.txt
$ stat -c '%a %A %n' notes.txt
755 -rwxr-xr-x notes.txt
$ chmod 600 notes.txt
$ stat -c '%a %A %n' notes.txt
600 -rw------- notes.txt

The second command no talk anything about the group or everybody else, but their bits change anyway. Na this be the behaviour of numeric form, and na why numeric form no good for small edit. (chmod still handle setuid, setgid, and sticky bits, wey dey inside a fourth digit before these ones. Na separate topic be that, and this guide dey focus on the three.)

The symbolic form: class, operator, then bits

Write the class first. u na owner, g na group, o na everybody else, and a na all of dem together. Then the operator: + dey add bits, - dey remove bits, and = dey set that class to exactly the bits wey you list and clear the rest of the bits for that class. Then write the bits themselves as r, w or x.

$ chmod 640 notes.txt
$ stat -c '%a %A %n' notes.txt
640 -rw-r----- notes.txt
$ chmod u+x notes.txt
$ stat -c '%a %A %n' notes.txt
740 -rwxr----- notes.txt
$ chmod g-r notes.txt
$ stat -c '%a %A %n' notes.txt
700 -rwx------ notes.txt
$ chmod o=r notes.txt
$ stat -c '%a %A %n' notes.txt
704 -rwx---r-- notes.txt

Each command touch one class and leave the others as dem be. Join clauses with commas and no spaces, and chmod apply dem from left to right.

$ chmod u=rw,go=r notes.txt
$ stat -c '%a %A %n' notes.txt
644 -rw-r--r-- notes.txt
$ chmod go= notes.txt
$ stat -c '%a %A %n' notes.txt
600 -rw------- notes.txt

go= with nothing after the equals sign dey remove every bit from group and everybody else. Na this pattern you want for a file wey only the owner fit read, like the private half of an SSH key pair.

chmod fit also report wetin e do. This matter inside script where nobody dey watch the screen.

chmod -v u+x notes.txt
chmod -v u+x notes.txt

-v dey print one line for every file wey you give am. Run both commands and compare the two lines for your screen: the first one name the file and report the mode wey e change from and the mode wey e change to, while the second report the mode as retained because the bit wey you ask am to add don already set. -c dey print one line only when file actually change, so na the better one to keep for log.

chmod 755 vs u+x: which notation to use

Start from the same file twice and compare wetin each notation leave behind.

$ chmod 640 notes.txt
$ chmod 755 notes.txt
$ stat -c '%a %A %n' notes.txt
755 -rwxr-xr-x notes.txt
$ chmod 640 notes.txt
$ chmod u+x notes.txt
$ stat -c '%a %A %n' notes.txt
740 -rwxr----- notes.txt

Both commands make the file executable for the owner. Na only one leave the other two classes as dem be. Use numeric mode when you know the exact final state wey you want and you want to enforce am. This na the correct case for deployment script wey must produce the same result for machine wey you never see before. Use symbolic mode when the sentence for your head get add or remove, because numeric form no get way to talk say leave that part alone.

The mode wey a new file start with no come from chmod at all. E come from the umask of the process wey create the file. Run umask and umask -S for your own shell to see the value wey dey active there. Expect say e go differ between distributions, between your login shell and a systemd service, and between one account and another. umask dey set the mode of every new file, so e decide wetin you start with before chmod run.

Directory get execute bit do wetin

Na this misunderstanding dey waste pass time. For normal file, execute bit mean say kernel fit run the file. Directory no hold instructions, so nothing dey inside am wey kernel fit run. For directory, execute bit mean traversal: permission to resolve name inside am. To reach dir/file, you need execute permission for dir. Read bit na separate permission, and e allow you list the names wey directory hold. You fit get one without the other. E dey easier to understand after you don see am happen.

$ mkdir vault
$ printf 'hello\n' > vault/secret.txt
$ chmod 600 vault/secret.txt
$ chmod 100 vault
$ echo vault/*
vault/*
$ cat vault/secret.txt
hello

Shell print the pattern back unchanged because expanding vault/* mean say e need read the directory, and glob wey no match anything dey pass through as literal text instead of raising error. cat still work because you supply the name yourself and traversal dey allowed. Now swap the two bits.

$ chmod 400 vault
$ echo vault/*
vault/secret.txt
$ cat vault/secret.txt
cat: vault/secret.txt: Permission denied

You fit see the names, but you no fit see the contents. Read permission give you the list. Execute permission give you way to enter. Almost every directory wey you use need both.

$ chmod 500 vault
$ cat vault/secret.txt
hello

Why chmod -R with a numeric mode dey damage a tree

-R dey waka through the whole tree and apply the mode wey you give am to everything wey e meet. Directory and data file need different bits, so one absolute number no fit correct for both. Build small tree and watch how e go spoil.

$ mkdir -p site/css
$ touch site/index.html site/css/main.css
$ printf '#!/bin/bash\necho hi\n' > site/deploy.sh
$ chmod 755 site site/css site/deploy.sh
$ chmod 644 site/index.html site/css/main.css
$ stat -c '%a %A %n' site site/css site/index.html site/css/main.css site/deploy.sh
755 drwxr-xr-x site
755 drwxr-xr-x site/css
644 -rw-r--r-- site/index.html
644 -rw-r--r-- site/css/main.css
755 -rwxr-xr-x site/deploy.sh

Na this layout directory of static files dey need. Here be the first recursive mistake.

$ chmod -R 755 site
$ stat -c '%a %A %n' site/index.html site/css/main.css
755 -rwxr-xr-x site/index.html
755 -rwxr-xr-x site/css/main.css

Nothing spoil, and na that be the problem. This mistake dey happen quietly, so e fit remain inside copied instructions for years. Two data files don dey claim say dem na programs. Git dey store execute bit, so your next commit go carry this change go everybody wey clone the repository, and rsync plus tar go carry am go every machine wey you copy the tree to.

The second recursive mistake loud. If you apply mode wey no get execute bit to directory, the directory go close.

$ chmod 644 site
$ stat -c '%a %A %n' site
644 drw-r--r-- site
$ echo site/*
site/css site/deploy.sh site/index.html
$ cd site
bash: cd: site: Permission denied
$ cat site/index.html
cat: site/index.html: Permission denied

The names still dey list because read bit remain, and every path wey pass through the directory don close because execute bit no remain. chmod -R 644 site go do this to every directory for the tree with one command. Wetin you find afterwards no always uniform, because chmod must waka through the same directories whose traversal permission e dey remove, so use find site -type d -exec stat -c '%a %n' {} + check wetin actually apply instead of assuming. Restore this one before you continue.

$ chmod 755 site
$ chmod 644 site/index.html site/css/main.css
$ stat -c '%a %A %n' site site/index.html
755 drwxr-xr-x site
644 -rw-r--r-- site/index.html

Recursive chmod no get undo. chmod no dey record wetin e replace, so na you go repair am by rebuilding modes from wetin you believe say dem use be before. Na the same slow and uncertain work like reconstructing files after accidental rm -rf, and the lesson still be the same: check the target of recursive command before you press enter.

The capital X: execute na directories, no be every file

Symbolic modes accept X as well as x. X go set execute bit only where e make sense: for directory, or for regular file wey already get execute bit for some class. Na exactly the rule wey you want -R to follow.

$ chmod -R u=rwX,go=rX site
$ stat -c '%a %A %n' site site/css site/index.html site/css/main.css site/deploy.sh
755 drwxr-xr-x site
755 drwxr-xr-x site/css
644 -rw-r--r-- site/index.html
644 -rw-r--r-- site/css/main.css
755 -rwxr-xr-x site/deploy.sh

One command, and the directories remain traversable while the data files stay untouched. The script keep its execute bit because e already get one, wey be the second part of the X rule. X dey read the mode wey file get now, so if file don lose every execute bit, e no fit bring am back.

$ chmod 644 site/deploy.sh
$ chmod -R u=rwX,go=rX site
$ stat -c '%a %A %n' site/deploy.sh
644 -rw-r--r-- site/deploy.sh
$ site/deploy.sh
bash: site/deploy.sh: Permission denied
$ chmod u+x site/deploy.sh
$ stat -c '%a %A %n' site/deploy.sh
744 -rwxr--r-- site/deploy.sh
$ site/deploy.sh
hi

The same rule work the other way. X fit extend execute bit wey file already get to another class:

$ chmod go+X site/deploy.sh
$ stat -c '%a %A %n' site/deploy.sh
755 -rwxr-xr-x site/deploy.sh

So lowercase x na for one named file wey you want make runnable, while X na for sweep across a tree. When you want exact mode for each kind of item instead of rule based on the current mode, split the walk with find instead.

find site -type d -exec chmod 755 {} +
find site -type f -exec chmod 644 {} +
chmod u+x site/deploy.sh

-type d dey select directories and -type f dey select regular files, so each kind go get the mode wey e suppose get. -exec ... + dey batch many paths into one chmod call instead of starting one process for every file, and this matter for tree wey get thousands of entries. The script get its bit back for separate line, deliberately.

Check result before you comot

Two commands dey find the mistakes wey matter after any recursive change. The first one dey list directories wey you no fit enter again.

find . -type d ! -perm -u+x

The second one dey list files wey any account for the machine fit edit.

find . -type f -perm -o+w

For -perm -o+w, the leading - mean at least these bits, so e go match file wey e o class get the write bit, no matter wetin else dey set. The result wey you want be make neither command print anything. Run both from the top of any tree wey you just change with -R, then run stat -c '%a %A %n' for the few paths wey you mean to change, so the mode wey you think say you set na the mode wey kernel really dey hold.

FAQ

Difference between chmod 755 and chmod u+x na wetin?

Numeric mode dey absolute. E dey write every permission bit for the file, so e go rewrite the classes wey you no think about too. Symbolic mode na edit. u+x dey add one bit for the owner and leave every other bit as dem be. Use numeric form when you know the exact end state wey you want for file. Use symbolic form when you wan add or remove one thing. Run stat -c '%a %A %n' <file> before and after either command, and the difference go show for the output.

Why chmod -R 755 for directory of web files no good?

Because -R dey send the same absolute mode go directories and regular files, but the two need different bits. Directory need execute bit so you fit traverse am. Data files like HTML and CSS no need am, and marking dem executable na change wey git go record for your next commit and rsync go copy go the next machine. Use chmod -R u=rwX,go=rX <dir> so execute bit go land for directories only, or drive am from find with -type d and -type f so each type go get im own mode.

Wetin execute bit dey do for directory?

E dey allow traversal, no be execution. Nothing dey inside directory wey you fit run. Execute bit na permission to resolve name inside am, so you need am for every directory along a path before you fit open the file for the end of that path. Read bit separate, and e dey allow listing the names. You fit get one without the other: with execute alone, you fit open file wey you already know the name, while shell no fit expand glob for that directory. With read alone, you fit see the names, but every attempt to open one go fail.

When I suppose use capital X instead of lowercase x?

Use X anytime command dey recursive. X dey set execute bit for directories, and for regular files only when one execute bit don already set. So one pass fit make tree traversable without turning data files into programs. Use lowercase x when you dey point to one file and na that file you mean. One limit you suppose remember be say X no fit restore execute bit wey don already clear everywhere for file, because nothing remain for am to match. Put that bit back with chmod u+x <file>.

chmod dey change who own file?

No. chmod only dey change permission bits. Ownership belong to chown for the user and chgrp for the group, and to hand file over to another user you need root. This matter because system dey read the bits against the owner and group recorded for the file, no be against whoever write am last. Run stat -c '%U %G %a %n' <file> to see the owner, group, and mode together before you decide which of the three commands you really need.