chmod 644 (rw-r--r--)
Answer
chmod 644 sets rw-r--r--: the owner can read and write, and the group and everyone else can only read. It is the normal mode for ordinary files that are not secret and not executable.
chmod 644 = rw-r--r--: owner read and write, everyone else read.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 6 | |||
| Group | 4 | |||
| Others | 4 | |||
| Special | 0 |
6Owner (user): 6 = 4 read + 2 write4Group: 4 = 4 read4Others: 4 = 4 read
On a file
- Owner (user) read it and change it
- Group read it
- Others read it
On a directory
- Owner (user) list the names inside; write without x does nothing useful (names only: without x the files cannot be opened or even stat'ed)
- Group list the names inside (names only: without x the files cannot be opened or even stat'ed)
- Others list the names inside (names only: without x the files cannot be opened or even stat'ed)
chmod 644 filechmod u=rw,go=r filels -l → -rw-r--r--
What to know
6 is read (4) + write (2); 4 is read alone. No one has execute permission, so the file cannot be run directly as a program, and only its owner can change it.
This is what a new file gets when your umask is 022, so most files you create on a typical Linux system are already 644. Web pages, stylesheets, images and most files under /etc are 644.
Where it fits
- HTML, CSS, JavaScript and image files served by a web server
- Configuration files that contain no passwords or keys
- Source code and documents in a project
- Public SSH keys (
id_ed25519.pub) and~/.ssh/authorized_keys(600 is also fine)
Gotchas
- 644 on a directory is almost always a mistake: without the execute bit nobody, not even the owner, can enter it or open the files inside; they can only list the names. Directories want 755.
- Readable by every local user. Database passwords, API tokens and
.envfiles should be 600 or 640. - OpenSSH refuses a private key that is 644 ("UNPROTECTED PRIVATE KEY FILE"). Private keys must not be readable by group or others.
Related explainers
- chmod 755 (rwxr-xr-x)chmod 755 gives the owner read, write and execute, and everyone else read and execute. When to use it for...
- chmod 600 (rw-------)chmod 600 makes a file readable and writable by its owner only. The right mode for SSH private keys, .env...
- chmod 640 (rw-r-----)chmod 640 lets the owner read and write, the group read, and others nothing. The usual mode for secret...
- 755 vs 644755 and 644 differ only in the execute bit. Use 755 for directories and programs, 644 for regular files;...
- 600 vs 644600 makes a file readable by its owner only; 644 lets every user read it. Which to use for SSH keys, .env...