Linux File Permissions Made Simple: A chmod Guide for Beginners

The "Permission Denied" Moment

You're following a tutorial. You type a command. The terminal replies:

bash: ./script.sh: Permission denied

This is every Linux beginner's first wall. And the fix is one command: chmod. But to use it confidently, you need to understand what those permissions actually mean.

Why Linux Has File Permissions

Linux is a multi-user system. Even if you're the only person using your laptop, Linux has dozens of system users running background services. Permissions exist so that:

• You can't accidentally delete system files
• A hacked web server can't read your personal documents
• Multiple people can share a server without seeing each other's files

Every file and directory has three levels of access, for three types of users.

Seeing Permissions: ls -l

Let's look at some actual files:

ls -l ~/Documents

Output:

drwxr-xr-x  2 alice alice  4096 Aug  7 10:00 projects
-rw-r--r--  1 alice alice  1234 Aug  7 09:30 notes.txt
-rwxr-xr-x  1 alice alice   256 Aug  7 08:00 backup.sh

Focus on the first column — the string of letters at the start:

drwxr-xr-x    (for the directory)
-rw-r--r--    (for notes.txt)
-rwxr-xr-x    (for backup.sh)

Let's break down -rwxr-xr-x:

Position:  1    2-4     5-7     8-10
           -    rwx     r-x     r-x
           │   └─┬─┘   └─┬─┘   └─┬─┘
           │   Owner    Group    Others
           │
      Type: -  = regular file
            d  = directory
            l  = symbolic link

The 10 characters split into four parts:

What r, w, x Actually Mean

For Files

For Directories

The directory execute bit is the most confusing one for beginners. Without x on a directory, you can't cd into it — even if you have read permission. A directory with rw- lets you list file names but not open any of them.

The Two Ways to Use chmod

Method 1: Symbolic Mode (Letters)

chmod [who][+/-/=][permissions] filename

Examples:

# Make a script executable by everyone
chmod a+x script.sh

# Owner can read+write, everyone else can read only
chmod u=rw,go=r notes.txt

# Remove write permission from group and others
chmod go-w config.yaml

# Make a file completely private (only owner can read)
chmod go-rwx secret.txt

Method 2: Numeric Mode (The Number System)

This is what people actually use day-to-day. Each permission gets a number:

Add them up for each user type:

7 = 4+2+1 = rwx (read, write, execute)
6 = 4+2+0 = rw- (read, write)
5 = 4+0+1 = r-x (read, execute)
4 = 4+0+0 = r-- (read only)
0 = 0+0+0 = --- (no permissions)

Then you give three digits: one for owner, one for group, one for others.

chmod 755 script.sh
#      │ │ │
#      │ │ └─ Others: 5 = r-x (read + execute)
#      │ └─── Group:  5 = r-x (read + execute)
#      └───── Owner:  7 = rwx (read + write + execute)

chmod 644 notes.txt
# Owner: read+write (6), Group: read (4), Others: read (4)
# This is the default permission for most files.

The Common Recipes

Here are the chmod commands you'll actually use:

# ── Scripts ──
chmod 755 script.sh         # Owner can edit+run, others can read+run
chmod 700 script.sh         # Private script — only owner can do anything

# ── Configuration Files ──
chmod 600 ~/.ssh/id_rsa     # SSH private key — ONLY owner can read/write
chmod 644 ~/.ssh/id_rsa.pub # SSH public key — owner rw, others read
chmod 640 config.env        # Owner rw, group r, others get nothing (secrets!)

# ── Directories ──
chmod 755 public_html/      # Standard directory: owner rwx, others rx
chmod 700 private/          # Private directory — only owner can enter

# ── Recursive (be careful!) ──
chmod -R 755 project/       # Apply 755 to EVERYTHING inside project/

A Real-World Example

Let's say you create a backup script. Here's the typical lifecycle:

# Create the script
vim backup.sh

# Check its permissions (it's not executable yet)
ls -l backup.sh
# -rw-r--r--  1 alice alice  512 Aug  7 10:00 backup.sh

# Try to run it
./backup.sh
# bash: ./backup.sh: Permission denied

# Make it executable
chmod +x backup.sh

# Now it works
./backup.sh
# Backup complete!

# Secure it — you're the only one who should modify it
chmod 755 backup.sh
# -rwxr-xr-x  1 alice alice  512 Aug  7 10:00 backup.sh

What is umask?

Ever wonder why new files get 644 (rw-r--r--) instead of 777? That's umask — a default permission mask.

# Check your current umask
umask
# Output: 0022

Think of it as "subtract these permissions from new files": - Default for files is 666 (rw-rw-rw-) - umask of 022 subtracts ----w--w- (group and others lose write) - Result: 644 (rw-r--r--)

You rarely need to change umask. Just know it's there — it's why you don't need to chmod every file you create.

Security Tips

1. Never use chmod 777 unless you absolutely know why. It gives everyone read, write, and execute. If a tutorial tells you to chmod 777 something, question it.

2. SSH private key must be 600. SSH will refuse to use a key that's readable by others.

3. Web servers: Files should be 644, directories 755. The web server only needs write access to specific folders (like uploads).

4. Environment files (.env) with secrets: chmod 600 — only the owner should read API keys and passwords.

Quick Reference

chmod 755 script.sh    → rwx r-x r-x (executable for everyone)
chmod 644 file.txt     → rw- r-- r-- (readable by all, writable by owner)
chmod 600 secret.txt   → rw- --- --- (only owner can read/write)
chmod 700 private.sh   → rwx --- --- (only owner can do anything)
chmod 750 team.sh      → rwx r-x --- (owner and group only)

Related Guides

• New to the command line? Start with Linux Terminal Basics — covers ls, cd, and 8 more essential commands.
• Setting up a server? Read our Ubuntu installation guide to get your environment ready.
• Want to automate? Check out Python Automated Backups — a practical script you can protect with the permissions you just learned.

File permissions are the gateway to Linux confidence. Once you understand chmod 755 without looking it up, you've leveled up.