Linux file permissions control who can read, write, or execute files.
Permission Structure
-rwxr-xr-x │││├─┼─┼─ Others (everyone else) ││└──┴─┴─ Group └┴──────── Owner
Each position: r (read), w (write), x (execute), or - (none)
Numeric Values
4 = read 2 = write 1 = execute Add them up: 7 = rwx (4+2+1) 6 = rw- (4+2) 5 = r-x (4+1) 4 = r-- 0 = ---
Common Permissions
Files:
644 = rw-r--r-- (default for files) 600 = rw------- (private files) 400 = r-------- (read-only)
Directories:
755 = rwxr-xr-x (default for directories) 750 = rwxr-x--- (group access only) 700 = rwx------ (private directory)
Scripts:
755 = rwxr-xr-x (executable by all) 700 = rwx------ (private scripts)
Setting Permissions
# Numeric method chmod 644 file.txt chmod 755 directory/ # Symbolic method chmod u+x script.sh # Add execute for owner chmod go-w file.txt # Remove write for group/others chmod a+r document.pdf # Add read for all
WordPress Permissions
# Standard setup
find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
# Secure wp-config.php
chmod 400 wp-config.php
# Uploads directory
chmod 755 wp-content/uploads
Troubleshooting
Permission Denied:
# Check current permissions ls -la filename # Check ownership ls -la | grep filename # Fix ownership chown user:group filename
Can't upload files:
# Web server needs write access chmod 775 uploads/ chown www-data:www-data uploads/
Security Rules
- Never use 777 - World writable = security hole
- Config files: 400 or 440 - Read-only
- Private keys: 600 - Owner only
- Web directories: 755 - Standard
- Web files: 644 - Standard
Bulk Operations
# Set all files to 644
find /path -type f -exec chmod 644 {} \;
# Set all directories to 755
find /path -type d -exec chmod 755 {} \;
# Remove execute from all files
find . -type f -exec chmod -x {} \;
# Make all .sh files executable
find . -name "*.sh" -exec chmod +x {} \;
Special Permissions
Setuid (4):
chmod 4755 file # Run as file owner
Setgid (2):
chmod 2755 dir # Inherit group ownership
Sticky bit (1):
chmod 1755 /tmp # Only owner can delete
Quick Reference
400 r-------- Read-only by owner 444 r--r--r-- Read-only by all 600 rw------- Read/write by owner 644 rw-r--r-- Standard file 664 rw-rw-r-- Group writable 666 rw-rw-rw- All writable (bad) 700 rwx------ Private executable 755 rwxr-xr-x Standard directory 777 rwxrwxrwx Never use this
