drwxr-xr-x mean wetin? Linux permission 755 explained

Wetin drwxr-xr-x mean

drwxr-xr-x dey describe directory wey im owner fit change, while every other user fit read am and pass through am without changing anything. For octal, that mode na 755. Linux dey print these ten characters for the beginning of every line of ls -l output, and dem always mean the same thing for the same order. So, if you learn one string, you don learn all of dem.

One rule come before the others because e decide whether your own testing go show you anything. The root user dey ignore permission bits. The kernel dey give root the CAP_DAC_OVERRIDE capability (discretionary access control override), so root fit open files even when their mode no allow am. Every example for this page go succeed for root, no matter wetin the bits talk. Log in as normal user when you want watch the rules take effect.

The ten characters, one at a time

Make one directory and one file wey you fit inspect. Nothing for here go touch anything outside the new directory.

mkdir -p ~/permdemo/inner
printf 'hello\n' > ~/permdemo/inner/notes.txt
ls -ld ~/permdemo ~/permdemo/inner ~/permdemo/inner/notes.txt

With the common default umask of 022, the two directory lines start with drwxr-xr-x and the file line starts with -rw-r--r--.

Character 1 na file type, e no be permission. d na directory. - na regular file. l na symbolic link. c and b na character and block device nodes. s na socket, and p na named pipe. E dey outside the octal value, na why drwxr-xr-x become 755 instead of something wey start with d.

The nine characters after am na three groups of three, and dem no dey change order.

• Characters 2 to 4 na the owner triad, the bits wey apply to the user wey own the file.
• Characters 5 to 7 na the group triad, the bits wey apply to the file group.
• Characters 8 to 10 na the other triad, the bits wey apply to everybody else.

Inside one triad, the slots always dey be r, then w, then x, and dash mean say that bit dey off. The letters no dey change position. r-x mean read without write. -w- mean write without read, and e dey legal but e rare.

So drwxr-xr-x split like this: d for directory, then rwx for owner, then r-x for group, then r-x for other.

Some systems dey print an eleventh character. Trailing dot, drwxr-xr-x., mean say the file carry SELinux (security enhanced Linux) context, wey SELinux distributions like Fedora and Rocky dey print by default. Trailing plus, drwxr-xr-x+, mean say the file carry POSIX ACL (access control list), an extra set of rules beyond these nine bits. Use getfacl <path> read those extra rules.

r, w and x dey do different work for directory

Na here beginners dey make first mistake. The letters dey the same for file and directory. But the permissions wey dem give no be the same.

• r for file dey read the contents. r for directory dey list the names inside am, and na wetin plain ls need.
• w for file dey change the contents. w for directory dey add and remove entries inside am. To delete file na change to the directory, so na write permission for the directory dey decide am. The file mode no get say for this matter.
• x for file dey run am as program. x for directory dey traverse am. This mean say kernel fit resolve one name inside am during path lookup.

Traverse na the part wey dey surprise people. x for directory no dey execute anything. To open /srv/site/index.html, you need x for /, then x for /srv, then x for /srv/site, and finally r for the file. If any directory for that chain no get x for you, lookup go stop there. Caller go receive Permission denied for the whole path, even when the file for the end get world-readable permission. namei -l /srv/site/index.html go print every step for the chain with its mode and owner, so you fit see which link stop am.

Directory wey get r but no get x na strange half state wey you need recognise. Normal user fit list the names, because na r dey grant listing. But user no fit stat any entry, so ls -l go fill the size and mode columns with question marks and print ls: cannot access ...: Permission denied for each one.

Wetin make the letters turn 755

Each triad na three-bit number. r na 4, w na 2, and x na 1. Add the bits wey dey on.

• rwx na 4 + 2 + 1 = 7
• rw- na 4 + 2 = 6
• r-x na 4 + 1 = 5
• r-- na 4
• --- na 0

So, drwxr-xr-x na 7 for the owner, 5 for the group, and 5 for other users: 755. -rw-r--r-- na 6, 4, 4: 644. drwxrwxr-x na 7, 7, 5: 775, wey be 755 plus write permission for the group. You no need count the characters by hand, because stat dey print both forms together.

stat -c '%A %a %U %G %n' ~/permdemo ~/permdemo/inner/notes.txt

%A na the letter form, %a na the octal form, while %U and %G show the owning user and owning group.

Permission strings wey people dey search for

Na these modes you go meet for real server, together with dia octal value and where each one dey show.

• -rw-r--r-- na 644. Na ordinary files wey service only dey read, like config file or HTML page.
• -rw------- na 600. Na secrets: SSH private key, or application's .env file.
• -rw-rw-r-- na 664. Na file for directory wey group dey share, where teammates need write access.
• -rwxr-xr-x na 755. Na scripts and binaries, like /usr/local/bin/backup.sh and most of /usr/bin.
• -rwx------ na 700. Na private script wey only the owner fit run.
• drwxr-xr-x na 755. Almost every system directory, and website document root.
• drwx------ na 700. ~/.ssh, and home directories for a locked down box.
• drwxrwxr-x na 775. Na directory wey owner's group fit write into.
• drwxrwsr-x na 2775. Na the same thing, plus setgid bit, so new files inside inherit the directory group.
• drwxrwxrwt na 1777. /tmp. The last t na sticky bit, so user fit delete only dia own files.
• -rwsr-xr-x na 4755. Na setuid binary wey dey run as the owner, like /usr/bin/passwd and /usr/bin/sudo.
• -rw-rw-rw- na 666, and drwxrwxrwx na 777. World writable, and for server this almost always na mistake.
• lrwxrwxrwx na wetin every symbolic link dey show. Linux dey ignore mode bits for link and check the target instead, so this string no get any meaning at all.

Which triad apply to you

Na be this second rule beginners dey often get wrong. Kernel dey pick exactly one triad, then e stop there.

If your user ID match the file owner, you get owner triad, and kernel no go check group and other bits. If e no match, but the file group dey among your groups, you get group triad. If none of these happen, you get other triad.

Two things follow from this. Owner triad still apply even when na the most restrictive one. File wey get mode 0466, and print as -r--rw-rw-, give the owner read-only permission while everybody else fit write, because owner check match first and kernel no read anything after am. This one legal, but e dey confuse everybody when dem first meet am.

Kernel choose group triad based on the file group, not the list of groups wey you belong to. ls -l print two names for each line: owner first, then group. Na only that second group get any say for the file. Belonging to twenty groups help only when file carry one of dem.

id
stat -c '%U %G %A %n' ~/permdemo/inner/notes.txt

id print your user and every group wey you dey inside. stat print the file owner and group. Compare both, and you go know which triad kernel go use for you.

Na why shared directory normally get a group and setgid bit. sudo chmod 2775 /srv/shared print as drwxrwsr-x, and files wey dem create inside go inherit the directory group instead of the creator personal group, so the next person still fit write dem. Giving each service its own account na the other half of this matter, and one Linux user per service for VPS cover am.

umask dey decide mode for every new file

New file no dey take mode from you. E dey take am from the program wey create am, minus the bits wey your umask clear. umask na mask of bits wey e go remove, so bigger umask dey produce files wey more private.

Most distributions dey ship with 022. Program wey dey create regular file dey request 0666. Program wey dey create directory dey request 0777. umask dey clear 022 from both requests, so you get 644 for files and 755 for directories. Na exactly this pair you dey see for fresh VPS.

umask
umask -S
touch ~/permdemo/new.txt && mkdir -p ~/permdemo/newdir
ls -ld ~/permdemo/new.txt ~/permdemo/newdir

umask -S dey print the same value as letters, and e dey easier to read than 0022. Set umask 027 for ~/.profile for stricter default: 640 for files and 750 for directories, so your group fit read your work and nobody else fit.

Two limits dey important. umask fit only clear bits; e no fit add dem. Na why newly created file no dey executable, no matter wetin you set. And systemd service no dey read your shell profile, so set the value for the unit file instead.

[Service]
UMask=0027

Why web files dey 644 and web directories dey 755

Web server dey run with im own account, www-data for Debian and Ubuntu, nginx for Rocky and Alma. That process need read permission for the files wey e dey serve and traverse permission for the directories above dem. E no get reason to write to dem, and static site no suppose allow am.

644 for file give owner write permission and give everybody read permission, so deploy user fit publish and web user fit serve. 755 for directory give owner write permission and give everybody traverse permission, so web user fit follow the path but e no fit add or delete anything. If bug dey inside application, e no go fit rewrite the pages wey e dey serve.

The traverse rule dey cause problem for this place. If site dey inside /home/deploy/site and /home/deploy be 750, web user no fit enter the home directory at all, and request go end with HTTP 403 plus line like this for /var/log/nginx/error.log:

open() "/home/deploy/site/index.html" failed (13: Permission denied), client: 203.0.113.5

That 13 na EACCES, the kernel permission refusal. Network no get problem: port dey listen and request don arrive. Na this dey make the issue confusing while you still dey learn how listening ports dey work for Linux. Run namei -l /home/deploy/site/index.html and read down the chain to find the first directory wey no get x for other users.

Directory wey application dey write into, like upload path, na exception. Give am permission through ownership instead of wider mode: sudo chown -R www-data:www-data /srv/site/uploads and leave mode at 755. Keep write access for only the directory wey need am.

chmod, without flattening the whole tree

chmod get two forms. Octal go set all nine bits at once: chmod 644 notes.txt. Symbolic go change only wetin you name and leave the rest as e be: chmod u+x deploy.sh add execute for the owner, while chmod go-w notes.txt remove write from group and other.

Recursion na where tree fit spoil. chmod -R 755 . dey mark every image and every config file as executable, because chmod no fit know difference between script and JPEG. Use capital X instead.

chmod -R u=rwX,go=rX ~/permdemo
stat -c '%a %n' ~/permdemo ~/permdemo/inner/notes.txt

Capital X dey apply execute to directories, and to files wey already get execute bit somewhere. Directories go come out as 755, ordinary files go come out as 644, and scripts wey already executable go remain so. When one file already get mode wey you trust, chmod --reference=good.sh other.sh go copy am across.

Messages wey you go see when something no dey correct

bash: ./deploy.sh: Permission denied mean say the script no get x bit for the triad wey apply to you, or one directory for its path no get x. chmod u+x deploy.sh go fix the first case.

bash: ./deploy.sh: cannot execute: required file not found na another fault with name wey fit confuse person. The x bit dey correct, but the interpreter wey dem name for the first line no dey. Windows line endings na the usual cause, so the kernel dey look for interpreter wey dem call /bin/bash\r. Use sed -i 's/\r$//' deploy.sh repair am.

Permissions 0644 for '/home/deploy/.ssh/id_ed25519' are too open. dey come from the SSH client, wey no gree use private key wey other accounts fit read. The key suppose get 600, and ~/.ssh suppose get 700. Full information about key handling dey for how to manage SSH keys and their file permissions.

Authentication refused: bad ownership or modes for directory /home/deploy/.ssh dey show for the server journal when home directory or its .ssh fit allow group write. The sshd StrictModes setting reject the key. For the client side, e go look like unexpected password prompt without explanation.

sudo: /etc/sudoers is world writable, followed by sudo: no valid sudoers sources found, quitting, mean say sudo check the mode of its own config and refuse to run. That file must get 0440. Na this one usually happen after broad recursive chmod. E fit happen together with the sshd message above, leaving provider console as the only way to enter the server again.

Why 777 no be fix

777 dey give every account for the machine write access, including every process wey dey run under any of those accounts. Server dey run services with their own users, so “everybody” cover plenty more for VPS than e cover for laptop. If service get breached, e fit write anywhere wey 777 allow.

For web root, the damage direct. If directory writable by everybody and server dey serve that directory too, upload flaw fit become way to plant script, then request the script back.

777 almost always be wrong answer for ownership problem. The symptom na “the app no fit write to this directory”. The cause na say wrong user own the directory. sudo chown -R appuser:appuser /srv/app/storage with mode 755 solve am and keep every other account out. Create those accounts before you deploy anything; this dey belong for the first ten minutes for new VPS.

World write legitimate for one familiar place, /tmp, and dem dey spell am drwxrwxrwt. The trailing t na sticky bit: everybody fit write to the directory, but user fit delete only files wey dem own. Without that bit, any account fit delete another account temporary files.

Read mode before you change am

These commands na only dey read state, so e safe to run dem anywhere.

id
umask
stat -c '%A %a %U %G %n' ~/permdemo ~/permdemo/inner/notes.txt
namei -l ~/permdemo/inner/notes.txt
find ~/permdemo -perm -0002

find <path> -perm -0002 dey list everything under a path wey get world write bit set. Na the fastest way to audit a box after person don use chmod 777 repair things.

To check whether one particular service account fit enter a directory, ask as that account. sudo -u www-data test -x /srv/site && echo yes || echo no dey print yes when that user get traverse permission for the directory, and no when e no get am. Asking as root no prove anything, because root dey skip the check and the answer always na yes.

FAQ

Wetin drwxr-xr-x mean for Linux?

Na directory, and the first d show this. E get mode 755. The owner triad na rwx, so the owner get every permission for am. The group triad na r-x and the other triad na r-x. This mean everybody else fit list the names inside and pass through the directory, but na only the owner fit add or remove anything. Confirm any path with stat -c '%A %a %U %G %n' <path>. E go print the letter form and octal form side by side.

Why web files dey 644 and web directories dey 755?

Web server dey run under another account, www-data for Ubuntu. E need read permission for the files wey e serve and traverse permission for every directory above dem. E no get reason to write to any of dem. Mode 644 give the owner write and give everybody else read. Mode 755 give the owner write and give everybody else traverse. If application truly need write to a directory, use chown hand the directory over to that application's user, instead of widening the mode for everybody.

The x bit mean say I fit execute directory?

No. For directory, x mean traverse. Na the right to resolve one name inside the directory as kernel dey walk through a path. cd need am, and every open of a file underneath the directory need am too. Every directory along the path need x. So, file wey get mode 644 still no reachable if directory above am no get x for you. namei -l /path/to/file go print the mode of every directory for the chain. This go show where the lookup stop.

chmod 777 ever be the correct fix?

Almost never for server. E give every account for the machine write permission, including accounts wey services dey use to run. So, one breached service fit rewrite the file. When application no fit write to directory, the real problem usually na ownership: sudo chown -R appuser:appuser /srv/app/storage with mode 755 give the application wetin e need and keep everybody else out. The common exception na /tmp at 1777. This one work because sticky bit stop users from deleting each other's files.

Why ls dey print dot or plus after the permissions?

That eleventh character describe rules wey dey beyond the nine permission bits. Dot, like drwxr-xr-x., mean SELinux security context dey attached. This normal for Fedora and Rocky. Plus, like drwxr-xr-x+, mean POSIX ACL (access control list) dey set. This mean some user or group get rights wey the three triads no show. Run getfacl <path> to list those extra entries.