Explain chmod code

What this chmod sample shows

the three digits

Each digit is a sum: read 4, write 2, run 1. The first digit is the file's owner, the second its group and the third everyone else. So 7 is 4+2+1, all three; 5 is read and run; 4 is read only; 0 is nothing. After the script, ls -l showed -rwxr-xr-x for deploy.sh (755) and -rw------- for secrets.env (600).

letter modes

Letters change one thing and leave the rest: u is the owner, g the group, o others and a all three, with + to add and - to take away. chmod u+x turned start.sh from 644 into 744, -rwxr--r--, and chmod go-w turned notes.txt from 666 into 644.

folders

On a folder, read lets you list the names in it, and run lets you go inside and open what's there. Capital X adds run only to folders, and to files that already have it: chmod -R a+rX public turned a 700 folder into 755 and a 600 page into 644, with no run bit on the page.

running scripts

A script needs the run bit to start as ./run.sh. At 644, ./run.sh stopped with Permission denied; sh run.sh still ran it, because then sh is the program being run and only reads the file. After chmod u+x run.sh it started directly.

Good to know

• Run with chmod from GNU coreutils 9.11 as a normal user, in a test folder, with umask 022: new files came out 644 and new folders 755.
• chmod 777 gives everyone read, write and run: ls -l showed -rwxrwxrwx. Any account on the machine can then change the file, so it's rarely the fix it looks like.
• 750 is -rwxr-x---: the owner does everything, the group can read and run, and everyone else gets nothing.

Watch out: chmod -R 644 on a folder locks you out of it, because it takes the run bit off folders too. chmod -R 644 site printed chmod: cannot access 'site/img': Permission denied partway through, and afterwards cd site/img and reading site/img/a.txt were refused. chmod -R u=rwX,go=rX site put it right: 755 for both folders and 644 for the file.