File permissions: chmod and chown

Every file in Linux has an owner, a group and three sets of permissions: one for the owner, one for the group and one for everyone else. To see them, run ls -l:

$ ls -l
-rw-r--r-- 1 ubuntu www-data 1520 Oct 12 10:15 index.php
drwxr-xr-x 3 ubuntu www-data 4096 Oct 12 10:15 uploads

The first character is the type: - is a file, d is a directory and l is a link. After that come three groups of letters: the permissions of the owner (ubuntu), of the group (www-data) and of everyone else.

Note the x on a directory: without it you cannot open any file inside, even if the file itself has the right permissions.

Numbers: 644, 755, 600

Each letter has a value: r = 4, w = 2, x = 1. Their sum gives the permissions for one set: 7 = rwx, 6 = rw-, 5 = r-x, 4 = r--, 0 = ---. Three digits in a row stand for the owner, the group and everyone else.

chmod: change permissions

chmod 644 index.php
chmod 755 deploy.sh
chmod 600 ~/.ssh/id_ed25519

Letters are handier when you want to add or remove a single permission without touching the others. u is the owner, g is the group, o is everyone else and a is all of them:

chmod +x deploy.sh        # allow the file to be run
chmod g+w uploads         # give the group write access
chmod o-rwx config.php    # give everyone else no access

The -R option changes permissions on a directory and everything inside it. However, chmod -R 755 also makes every file executable, and files and directories need different permissions. Set them separately:

find /var/www/example.co.uk -type d -exec chmod 755 {} +
find /var/www/example.co.uk -type f -exec chmod 644 {} +

Or do it in one command: chmod -R u=rwX,go=rX /var/www/example.co.uk. The capital X grants execute permission only to directories and to files that were already executable.

chown: change the owner

Only an administrator can hand a file over to another user, so use sudo:

sudo chown ubuntu index.php                  # owner
sudo chown ubuntu:www-data index.php         # owner and group
sudo chown -R www-data:www-data uploads      # a directory and everything in it

Permissions for website files

The web server and PHP run as their own user. On Ubuntu and Debian this is www-data; on AlmaLinux it is nginx for nginx and apache for PHP-FPM. To check on your own server, run ps -eo user,comm | grep -E 'nginx|php|apache|httpd'.

A safe set-up is for the website files to belong to you, not to the web server. PHP can then only read them, and can write only to the directories where the site stores uploads and cache:

sudo chown -R ubuntu:ubuntu /var/www/example.co.uk
find /var/www/example.co.uk -type d -exec chmod 755 {} +
find /var/www/example.co.uk -type f -exec chmod 644 {} +
sudo chown -R www-data:www-data /var/www/example.co.uk/wp-content/uploads

If someone breaks into the site through a vulnerability, they get the permissions of PHP — and cannot overwrite the site’s code. The trade-off is that you have to update the CMS over SSH rather than with a button in its admin area, because updates from the admin area need PHP to have write access to all the files.

Why not 777

Permissions of 777 let anyone on the server modify the file — any program, running as any user. People usually set them when “nothing works, but it works with 777”. In reality the file simply has the wrong owner, and the right fix is chown, not 777.

The opposite can happen too: some programs refuse to work with files that are too open. For example, SSH will not accept a key if the ~/.ssh directory or the authorized_keys file is writable by others, and the log will say bad ownership or modes. The correct permissions are chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.

Permission denied although the permissions are correct

• One of the directories on the path has no x permission. namei -l /var/www/example.co.uk/index.php shows the permissions at every step, from the root to the file.
• AlmaLinux: SELinux is getting in the way because the file has the wrong label. See how to fix it in the AlmaLinux reference.
• A script will not run and fails with bad interpreter and ^M at the end of the line — the file was saved on Windows: Files from Windows: line endings.

Permissions on cPanel hosting are covered in a separate article: File and directory permissions, CGI scripts.