Linux File Permissions Explained (chmod, chown and What 755 Means)
Half the "permission denied" errors you'll ever see on a server come down to two commands: chmod (who can do what) and chown (who owns it). Once you can read the permissions line in ls -l, most of those errors fix themselves.
Quick reference
| Task | Command |
|---|---|
| See permissions | ls -l |
| Change owner | sudo chown john:john file |
| Change owner of a folder and everything in it | sudo chown -R www-data:www-data /var/www |
| Make a script runnable | chmod +x script.sh |
| Typical file | chmod 644 file |
| Typical folder or script | chmod 755 folder |
| Private file (passwords, keys) | chmod 600 file |
Reading the permissions line
-rwxr-xr-- 1 john staff 4096 Oct 8 10:15 report.sh
Split the first block into four parts:
| - | rwx | r-x | r-- |
|---|---|---|---|
| Type (- file, d folder) | Owner: read, write, execute | Group: read, execute | Everyone else: read |
john is the owner, staff is the group. So John can do anything, people in the staff group can read and run it, and everyone else can only read it.
The numbers
Each letter has a value: r = 4, w = 2, x = 1. Add them up per section:
| Number | Meaning |
|---|---|
| 7 | rwx — everything |
| 6 | rw- — read and write |
| 5 | r-x — read and run |
| 4 | r-- — read only |
| 0 | --- — nothing |
So chmod 755 = owner 7, group 5, others 5 = rwxr-xr-x. The ones you'll use:
- 644 — normal files. You can edit; everyone can read.
- 755 — folders and scripts. Folders need x to be entered.
- 600 — private files such as SSH keys and config files with passwords.
- 700 — private folders, like ~/.ssh.
Changing permissions
chmod 644 config.txt
chmod -R 755 /var/www/html
chmod +x backup.sh
-R applies to everything inside a folder. +x adds execute without touching the rest.
Changing the owner
sudo chown sarah file.txt
sudo chown sarah:sarah file.txt
sudo chown -R www-data:www-data /var/www/html
owner:group sets both. Web servers run as www-data, so website files usually need that owner before Nginx or WordPress can write to them.
Who am I, and what groups am I in?
whoami
groups
Add yourself to a group with sudo usermod -aG groupname john, then log out and in.
Troubleshooting
"Permission denied" when editing a file in /etc. Those belong to root. Use sudo nano file.
"Permission denied" running a script you wrote. It needs execute: chmod +x script.sh, then run it as ./script.sh.
A website shows a blank page or can't upload. The web server can't read or write the folder. sudo chown -R www-data:www-data /var/www/html and sudo chmod -R 755 /var/www/html.
SSH refuses your key. Permissions too open on .ssh: chmod 700 ~/.ssh && chmod 600 ~/.ssh/*.
Don't chmod 777. It makes the file writable by anyone on the system. It "fixes" the error by removing all the protection. Fix the owner instead.
Wrapping up
Read the rwx blocks as owner / group / everyone, remember 644 for files and 755 for folders, use chown when the wrong user owns something and chmod when the right user lacks a permission. And resist 777.
