Linux File Permissions Made Simple: chmod, chown, and Octal Math Demystified

⚠️ Stop Typing chmod 777: When a bash script or web server throws a permission error, the quick StackOverflow copy-paste is often chmod -R 777. Doing this gives every local user and web service permission to modify or execute your files. This guide will show you how to set exact, secure permissions instead.

Every beginner in Linux eventually runs into a wall with three words: Permission denied. You write a bash script, try to run it with ./deploy.sh, and the terminal refuses. Or you copy an SSH key to a remote server, and SSH complains that your private key file is too open.

Linux file permissions look like random letters and numbers at first glance: -rwxr-xr--, chmod 755, chown www-data:www-data. But once you understand the simple three-part system and basic addition, reading and setting permissions becomes second nature.

1. Anatomy of a Permission String

When you run ls -l inside any Linux directory, the terminal prints a ten-character permission string on the far left of each line. Here is what an actual terminal entry looks like:

-rwxr-xr-- 1 pediaadmin developers 4096 Nov 06 10:00 script.sh

Let us split those ten characters into four distinct pieces:

[ - ]   [ rwx ]   [ r-x ]   [ r-- ]
Type    Owner     Group     Others

Character 1 (Type): A dash - means a regular file. A d means a directory. An l means a symbolic link.
Characters 2 to 4 (Owner): What the user who owns the file can do. In this example, rwx means read, write, and execute.
Characters 5 to 7 (Group): What members of the file's assigned group can do. Here, r-x means read and execute, but no permission to edit or write.
Characters 8 to 10 (Others): What everyone else on the entire system can do. Here, r-- means read only.

2. What r, w, and x Actually Mean

The permissions behave slightly differently depending on whether you are looking at a plain file or a directory:

r (Read): On a file, you can open and read its contents. On a directory, you can list the files inside with ls.
w (Write): On a file, you can modify or save changes. On a directory, you can create, rename, or delete files inside it.
x (Execute): On a file, you can run it as a program or bash script. On a directory, it allows you to cd into it and access its contents.

3. The Simple Math of Octal Numbers (4, 2, 1)

Instead of typing letters, Linux sysadmins almost always use three-digit numbers like 755 or 644. These numbers are calculated using elementary school addition:

Read    (r) = 4
Write   (w) = 2
Execute (x) = 1
No permission = 0

Whenever you see a three-digit permission number, each digit represents one group of users: [Owner] [Group] [Others]. You just add the numbers together:

7 (4 + 2 + 1): Full access (read, write, and execute).
6 (4 + 2): Read and write (standard for normal files you edit).
5 (4 + 1): Read and execute (can run, but cannot modify).
4 (4): Read only.
0: Zero access. Complete lockout for that group.

Let us look at two real examples:

chmod 644 file.txt: Owner gets 6 (read + write). Group gets 4 (read only). Others get 4 (read only). This is the safe default for 95% of documents and web assets.
chmod 755 script.sh: Owner gets 7 (read, write, execute). Group gets 5 (read + execute). Others get 5 (read + execute). This is standard for shell scripts and system binaries.

4. Using chmod: Number Method vs Symbolic Method

You have two ways to change permissions on Linux using the chmod (change mode) command.

The Number Method

Fastest when you want to set the exact full state of a file in one command:

chmod 644 config.json
chmod 755 backup.sh

The Symbolic Shortcut (+ and -)

When you just want to make a script executable without recalculating the existing read and write permissions, use +x:

# Make a script executable for yourself
chmod +x run_audit.sh

# Remove write access from everyone except the owner
chmod go-w sensitive_notes.txt

5. Fixing the Infamous SSH Key Error (chmod 600)

If you create an SSH private key or download a .pem file from AWS or DigitalOcean, trying to connect will often throw an error: "Permissions 0644 for id_rsa are too open. It is required that your private key files are NOT accessible by others."

SSH checks file permissions before sending your key. Because a private key holds your identity, other accounts on your computer must not be able to read it.

Fix it instantly by restricting access exclusively to your own user account:

chmod 600 ~/.ssh/id_ed25519
chmod 700 ~/.ssh

600 means: Owner gets Read + Write (4+2 = 6). Group gets 0. Others get 0. SSH is happy, and your connection succeeds.

6. Changing Ownership with chown

Permissions dictate what users can do, but who actually owns the file? The chown (change owner) command sets the user and group:

# Change owner to pediaadmin
sudo chown pediaadmin file.txt

# Change both owner and group at once (user:group)
sudo chown pediaadmin:developers file.txt

# Recursively fix ownership of an entire web folder
sudo chown -R www-data:www-data /var/www/html

Everyday Permission Cheat Sheet

644: Regular files (HTML, images, text, config files). Owner edits, others can only read.
755: Executable scripts and directories. Owner edits and runs, others can read and enter.
600: Private keys and secrets (SSH private keys, password vaults, .env files). Only you can read or write.
700: Private directories (like ~/.ssh/). Nobody else can see inside or enter.
777: Almost never needed in production. Leaves your file completely unprotected against any process on the machine.

Summary

Linux permissions are not black magic. Just remember the numbers: Read is 4, Write is 2, Execute is 1. The three digits correspond to Owner, Group, and Others.

Next time you encounter a Permission denied prompt, avoid the temptation to throw chmod 777 at the problem. Check ownership with ls -l, add execute rights with chmod +x, or set clean 644 or 755 values. Stay safe and audit carefully!