chmodChange file permissions
chmod sets who may read, write and execute a file: its owner (u), its group (g) and everyone else (o). You can give the mode as octal digits (640) or symbolically (u+x, go-w). It's the fix for 'Permission denied' on scripts and the guard on SSH keys and secrets.
chmod [-R] [-v | -c] MODE[,MODE]... FILE...You wrote deploy.sh and running it says Permission denied.
chmodChange mode: rewrites the permission bits stored in each file's inode (coreutils).
Every inode stores 12 mode bits: setuid, setgid and sticky, then read, write and execute for owner, group and others (rwx = 4+2+1, so 640 = rw-r-----). chmod calls fchmodat() for each file; only the file's owner or root (CAP_FOWNER) may do this. Octal modes replace all bits; symbolic modes (u+x, go-w, a=r) are applied to the current mode. When a process opens a file, the kernel picks exactly ONE class: if the process's effective UID is the owner, only the owner bits count; else if any of its groups matches the file's group, only the group bits count; otherwise the other bits. The first match wins, so an owner with --- is denied even if others have r. On directories r lets you list names, w lets you create, rename and delete entries (together with x), and x lets you traverse into it and reach files by name. Root bypasses read and write checks, but needs at least one x bit to execute.
On every open the kernel picks one class (owner, group or other) for the process and checks only those three bits.
An nginx worker running as www-data (uid 33) asks the kernel to open /srv/app/config.yml for reading.
-RRecursive (prefer X over x, or use find for files vs dirs)-vPrint a line for every file processed-cPrint only files whose mode actually changed--reference=FILECopy the mode of another fileu g o aWho: user/owner, group, others, all three+ - =Add bits, remove bits, set exactlyr w x XRead, write, execute; X = execute only on dirs/already-executables tsetuid/setgid (u+s, g+s) and sticky (+t)755 / 644 / 600Typical: scripts and dirs / normal files / secrets2775 / 1777Leading digit: 4 setuid, 2 setgid, 1 stickychmod -R 777 /var/www to fix a 403Every user and every compromised process on the box can now modify your site. The real problem is usually ownership or a missing x on a parent directory.
sudo chown -R www-data: /var/www/app && find ... dirs 755, files 644chmod -R 755 on a tree of filesEvery config, log and data file becomes executable.
chmod -R u=rwX,go=rX DIR (capital X), or find -type d / -type f separatelychmod 644 ~/.ssh/id_ed25519 (or a 755 home and ~/.ssh)ssh refuses group/world-readable private keys, and sshd ignores authorized_keys when the home or ~/.ssh is writable by others.
chmod 700 ~/.ssh; chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keysGiving a file 644 and wondering why another user still can't read itEvery parent directory needs x for that user too. A 700 home blocks access to everything inside.
namei -l /path/to/file shows the mode of every componentTry these on a Linux machine of your own. Each task has a hint and a solution.
Create ~/app/run.sh containing 'echo ok', make it executable only for you, and run it.
Make ~/data/secret.txt readable and writable only by you. Show the octal mode with stat.
Recursively make ~/app readable by group and others, with directories traversable but no regular file made executable.
Find all setuid files under /usr/bin.
chmodChange file permissions
chmod sets who may read, write and execute a file: its owner (u), its group (g) and everyone else (o). You can give the mode as octal digits (640) or symbolically (u+x, go-w). It's the fix for 'Permission denied' on scripts and the guard on SSH keys and secrets.
chmod [-R] [-v | -c] MODE[,MODE]... FILE...You wrote deploy.sh and running it says Permission denied.
chmodChange mode: rewrites the permission bits stored in each file's inode (coreutils).
Every inode stores 12 mode bits: setuid, setgid and sticky, then read, write and execute for owner, group and others (rwx = 4+2+1, so 640 = rw-r-----). chmod calls fchmodat() for each file; only the file's owner or root (CAP_FOWNER) may do this. Octal modes replace all bits; symbolic modes (u+x, go-w, a=r) are applied to the current mode. When a process opens a file, the kernel picks exactly ONE class: if the process's effective UID is the owner, only the owner bits count; else if any of its groups matches the file's group, only the group bits count; otherwise the other bits. The first match wins, so an owner with --- is denied even if others have r. On directories r lets you list names, w lets you create, rename and delete entries (together with x), and x lets you traverse into it and reach files by name. Root bypasses read and write checks, but needs at least one x bit to execute.
On every open the kernel picks one class (owner, group or other) for the process and checks only those three bits.
An nginx worker running as www-data (uid 33) asks the kernel to open /srv/app/config.yml for reading.
-RRecursive (prefer X over x, or use find for files vs dirs)-vPrint a line for every file processed-cPrint only files whose mode actually changed--reference=FILECopy the mode of another fileu g o aWho: user/owner, group, others, all three+ - =Add bits, remove bits, set exactlyr w x XRead, write, execute; X = execute only on dirs/already-executables tsetuid/setgid (u+s, g+s) and sticky (+t)755 / 644 / 600Typical: scripts and dirs / normal files / secrets2775 / 1777Leading digit: 4 setuid, 2 setgid, 1 stickychmod -R 777 /var/www to fix a 403Every user and every compromised process on the box can now modify your site. The real problem is usually ownership or a missing x on a parent directory.
sudo chown -R www-data: /var/www/app && find ... dirs 755, files 644chmod -R 755 on a tree of filesEvery config, log and data file becomes executable.
chmod -R u=rwX,go=rX DIR (capital X), or find -type d / -type f separatelychmod 644 ~/.ssh/id_ed25519 (or a 755 home and ~/.ssh)ssh refuses group/world-readable private keys, and sshd ignores authorized_keys when the home or ~/.ssh is writable by others.
chmod 700 ~/.ssh; chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keysGiving a file 644 and wondering why another user still can't read itEvery parent directory needs x for that user too. A 700 home blocks access to everything inside.
namei -l /path/to/file shows the mode of every componentTry these on a Linux machine of your own. Each task has a hint and a solution.
Create ~/app/run.sh containing 'echo ok', make it executable only for you, and run it.
Make ~/data/secret.txt readable and writable only by you. Show the octal mode with stat.
Recursively make ~/app readable by group and others, with directories traversable but no regular file made executable.
Find all setuid files under /usr/bin.