chmod command

The chmod command changes the access mode of one file or multiple files.

Syntax

The syntax for the chmod command is:

chmod [option] mode files

Options

Option	Description
-R	Descend directory arguments recursively while setting modes.
-f	Suppress error messages if command fails.

Mode

Mode	Description
Who	u=user, g=group, o=other, a=all (default)
Opcode	+ means add permission - means remove permission = means assign permission and remove the permission of unspecified fields
Permission	r=Read, w=write, x=Execute, s=set uid bit, t=sticky bit u=user, g=group, o=other, l=mandatory locking

Symbolic examples

Add write permission (w) to the group's(g) access modes of a directory, allowing users in the same group to add files:

$ ls -ld shared_dir # show access modes before chmod
drwxr-xr-x   2 teamleader  usguys 96 Apr 8 12:53 shared_dir
$ chmod  g+w shared_dir
$ ls -ld shared_dir  # show access modes after chmod
drwxrwxr-x   2 teamleader  usguys 96 Apr 8 12:53 shared_dir

Remove write permissions (w) for all classes (a), preventing anyone from writing to the file:

$ ls -l ourBestReferenceFile
-rw-rw-r--   2 teamleader  usguys 96 Apr 8 12:53 ourBestReferenceFile
$ chmod a-w ourBestReferenceFile
$ ls -l ourBestReferenceFile
-r--r--r--   2 teamleader  usguys 96 Apr 8 12:53 ourBestReferenceFile

Set the permissions for the user and the group (ug) to read and execute (rx) only (no write permission) on referenceLib, preventing anyone to add files.

$ ls -ld referenceLib
drwxr-----   2 teamleader  usguys 96 Apr 8 12:53 referenceLib
$ chmod ug=rx referenceLib
$ ls -ld referenceLib
dr-xr-x---   2 teamleader  usguys 96 Apr 8 12:53 referenceLib

Numerical permissions

The chmod numerical format accepts up to four octal digits. The three rightmost digits refer to permissions for the file user, the group, and others. The optional leading digit, when 4 digits are given, specifies the special setuid, setgid, and sticky flags.

Each digit of the three rightmost digits represent a binary value, which it's bits control the read, write and execute respectively, where 1 means allow and 0 means don't. This is similar to the octal notation, but represented in decimal numbers.

#	Permission	rwx	Binary
7	read, write and execute	rwx	111
6	read and write	rw-	110
5	read and execute	r-x	101
4	read only	r--	100
3	write and execute	-wx	011
2	write only	-w-	010
1	execute only	--x	001
0	none	---	000

For example, 754 would allow:

read, write, and execute for the user, as the binary value of 7 is 111, meaning all bits are on.

read and execute for the Group, as the binary value of 5 is 101, meaning read and execute are on but write is off.

read only for Others, as the binary value of 4 is 100, meaning that only read is on.

Numeric example

Change permissions to permit members of the programmers group to update a file.

$ ls -l sharedFile
-rw-r--r--  1 jsmith programmers 57 Jul  3 10:13  sharedFile
$ chmod 664 sharedFile
$ ls -l sharedFile
-rw-rw-r--  1 jsmith programmers 57 Jul  3 10:13  sharedFile

Command line examples

Command	Explanation
chmod a+r publicComments.txt	adds read permission for all classes (i.e. user, group and others)
chmod +r publicComments.txt	adds read permission for all classes depending on umask
chmod a-x publicComments.txt	removes execute permission for all classes
chmod a+rx viewer.sh	adds read and execute permissions for all classes
chmod u=rw,g=r,o= internalPlan.txt	sets read and write permission for user, sets read for group, and denies access for others
chmod -R u+w,go-w docs	adds write permission to the directory docs and all its contents (i.e. Recursively) for owner, and removes write permission for group and others
chmod ug=rw groupAgreements.txt	sets read and write permissions for user and group
chmod 664 global.txt	sets read and write permissions for user and group, and provides read to others.
chmod 0744 myCV.txt	sets read, write, and execute permissions for user, and sets read permission for group and others (the 0 specifies no special modes)
chmod 1755 findReslts.sh	sets sticky bit, sets read, write, and execute permissions for owner, and sets read and execute permissions for group and others (this suggests that the script be retained in memory)
chmod 4755 setCtrls.sh	sets UID, sets read, write, and execute permissions for owner, and sets read and execute permissions for group and others
chmod 2755 setCtrls.sh	sets GID, sets read, write, and execute permissions for user, and sets read and execute permissions for group and others
chmod -R u+rwX,g-rwx,o-rx personalStuff	Recursively (i.e. on all files and directories in personalStuff) adds read, write, and special execution permissions for user, removes read, write, and execution permissions for group, and removes read and execution permissions for others
chmod -R a-x+X publicDocs	Recursively (i.e. on all files and directories in publicDocs) removes execute permission for all classes and adds special execution permission for all classes

- rw- rw- r--  mik  mik    assgn1_client.c
- rw- rw- r--  mik  mik    assgn1_server.c
d rwx rwx r-x  mik  mik    EXAM
- rw- rw- r--  mik  mik    raw.c
- rwx r-x r-x  mik  mik    header.sh
... so on...

• The very first column represents the type of the file i.e. is it a normal file or a
  directory where d represents a directory and – represents a normal file.
• The first set three letters after the file type tell what the Owner of the file, have permissions to do. For example: In assgn1_client.c, has owner’s permission as rw-, which means the owner mik can only read(r) and write(w) the file but cannot execute(x).
• Note: The 3rd and 4th columns represents the name of the owner of the file and the group to which the owner belongs respectively.
• The next three letters after the user’s permission are the group’s permissions.
  For example: header.sh has group permissions as r-x, which means Other people in the mik group can not write(w) the header.sh script but can only read(r) or execute(x) it.
• Note that when a directory has the x set, this takes the special meaning of “permitted to search this directory”.
• The last three letters in the permissions column tell us what the “others” may do. The general practice is to protect the files from external access so that others can’t write any files or directories. They may read(r) or execute(x) it. For example: The assgn1_client.c has others permission as r- – which means it can only be read by other(external) access but cannot be written or executed by them.