chmod 750 (rwxr-x---)
Answer
chmod 750 sets rwxr-x---: the owner has full access, members of the group can read and execute (for a directory: list and enter it), and everyone else is shut out.
chmod 750 = rwxr-x---: owner full access, group read and execute, others nothing.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 7 | |||
| Group | 5 | |||
| Others | 0 | |||
| Special | 0 |
7Owner (user): 7 = 4 read + 2 write + 1 execute5Group: 5 = 4 read + 1 execute0Others: 0 = no permissions
On a file
- Owner (user) read it, change it and run it as a program
- Group read it and run it as a program
- Others no access
On a directory
- Owner (user) list the names inside, enter it and open files by name, create and rename and delete entries
- Group list the names inside and enter it and open files by name
- Others no access
chmod 750 filechmod u=rwx,g=rx,o= filels -l → -rwxr-x---
What to know
750 is 755 with the access for others removed. It suits a directory that one service account owns and a second account, made a member of the group, needs to read.
Ubuntu has created home directories with mode 750 since 21.04 (set by HOME_MODE in /etc/login.defs), so other users on the same machine can no longer browse your files.
Where it fits
- Application directories that the web server reads through a shared group, such as
chown -R deploy:www-data app/ - Home directories on multi-user systems
- Directories of scripts that only an operations group should run
Gotchas
- If a web server needs to serve files from your home directory, 750 blocks it unless the server's user is in your group. Do not "fix" this with 755 on the whole home directory; serve from a directory outside it.
- The files inside still need their own permissions; usually 640 for data files in a 750 directory.
Related explainers
- chmod 640 (rw-r-----)chmod 640 lets the owner read and write, the group read, and others nothing. The usual mode for secret...
- chmod 755 (rwxr-xr-x)chmod 755 gives the owner read, write and execute, and everyone else read and execute. When to use it for...
- chmod 700 (rwx------)chmod 700 gives the owner full access and everyone else none. The usual mode for ~/.ssh, ~/.gnupg and...