File Permissions Print

Linux permissions control access for a file's owner, its group and other users. Check both permissions and ownership before changing them. These examples are for a Linux VPS you administer, not a request to change ownership on an ArkHost shared hosting server.

Read the current permissions

stat -c '%A %a %U:%G %n' /path/to/file
namei -l /path/to/file

Replace the example path with the actual file. The first command shows its mode and owner. The second shows the parent directories, which also need suitable access permissions.

-rwxr-x---
 rwx  r-x  ---
 owner group others

The first character identifies the file type. The next three groups describe owner, group and other-user access. For a file, r means read, w write and x execute. For a directory, read lists names, write permits changes to directory entries, and execute allows traversal. Directory operations often need more than one of these permissions.

Common numeric modes

• 600: only the owner can read and write. Common for private keys and credentials.
• 640: the owner can read and write; the group can read.
• 644: the owner can read and write; everyone else can read. Suitable only for non-secret files.
• 700: only the owner can access a directory or execute a program.
• 750: owner access and group read/traversal, with no access for others.
• 755: owner write access with read/traversal for everyone. Common for public website directories where the hosting setup requires it.

Numeric permissions use read = 4, write = 2 and execute = 1. Add the values for each of the three user classes. Defaults also depend on the process umask and any access-control lists.

Change only the required file

These commands change permissions. Use your actual paths and confirm the intended owner first:

chmod 600 /path/to/private-file
chmod 750 /path/to/private-directory
chmod u+x /path/to/script.sh
chmod go-w /path/to/file

Do not apply a recursive permission reset to a whole website or home directory. It can expose secrets, remove executable permissions and break applications. Record the old mode and ownership so a scoped change can be reversed.

Website upload or permission errors

Identify the account running PHP or the application before changing ownership. On managed hosting it may be the individual hosting account, not www-data. Use the control panel or ask support if you are unsure.

Do not use 777 as a website repair. Grant write access only to the account and directories that need it. Configuration files must remain readable by the application but should not be readable by unrelated users. A blanket 400 setting can break an application running as a different account.

Permissions are only one possible cause. ACLs, parent-directory access, read-only mounts, SELinux and AppArmor can also deny access.

Special permission bits

Setuid changes execution privileges, setgid on a directory can make new entries inherit its group, and the sticky bit restricts who may delete or rename entries in a shared directory. Do not add these bits to fix an unexplained error or change system directories such as /tmp from a generic tutorial.

See the chmod manual for the full syntax.