chmod 755 (rwxr-xr-x)
chmod 755 sets rwxr-xr-x: the owner can read, write and execute; the group and everyone else can read and execute but not change anything. It is the standard mode for directories and for programs and scripts that other users need to run.
chmod 755 = rwxr-xr-x: owner full access, everyone else read and execute.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 7 | |||
| Group | 5 | |||
| Others | 5 | |||
| Special | 0 |
7Owner (user): 7 = 4 read + 2 write + 1 execute5Group: 5 = 4 read + 1 execute5Others: 5 = 4 read + 1 execute
On a file
- Owner (user) read it, change it and run it as a program
- Group read it and run it as a program
- Others read it and run it as a program
On a directory
- Owner (user) list the names inside, enter it and open files by name, create and rename and delete entries
- Group list the names inside and enter it and open files by name
- Others list the names inside and enter it and open files by name
chmod 755 filechmod u=rwx,go=rx filels -l → -rwxr-xr-x
What to know
The three digits are owner, group and others. 7 is read (4) + write (2) + execute (1); 5 is read (4) + execute (1). So only the owner can modify the file or directory, and nobody else can.
On a directory, the 5 for group and others means they can list it and reach the files inside, but cannot create, rename or delete entries. That is why web server document roots and most system directories are 755: the server process can walk into them, but only the owner can change what is there.
755 is also what a new directory gets when your umask is the common 022. See umask 022.
Where it fits
- Directories in a web root such as /var/www/html, so the server user can traverse them
- Shell scripts and compiled programs in /usr/local/bin or ~/bin
- Most directories in a home directory or project tree
- CGI scripts and other files a server must execute
Gotchas
- Do not use 755 for ordinary data files such as HTML, images or config files. They do not need the execute bit; use 644.
- Running
chmod -R 755on a tree marks every file executable. To give directories 755 and files 644 in one pass, usechmod -R u=rwX,go=rX(see capital X). - Others can read everything in a 755 directory tree, so it is wrong for anything holding secrets. Use 750 or 700 there.
- On a directory that already has the setgid bit, GNU
chmod 755keeps it (the result is 2755). Usechmod 00755orchmod g-sto clear it.
Related explainers
- chmod 644 (rw-r--r--)chmod 644 lets the owner read and write a file while everyone else can only read it. The default for...
- 755 vs 644755 and 644 differ only in the execute bit. Use 755 for directories and programs, 644 for regular files;...
- chmod 775 (rwxrwxr-x)chmod 775 gives the owner and group full access and others read and execute. Used for shared directories;...
- chmod 750 (rwxr-x---)chmod 750 gives the owner full access, the group read and execute, and others nothing. Used for app...
- chmod X (capital X)Capital X in chmod adds execute only to directories and to files that already have an execute bit. Use it...