Linux File Permissions & Chmod Guide
How Linux file permissions work, why octal numbers like 755 and 644 are calculated, and why chmod 777 is a dangerous anti-pattern.
The Permission Triad: Owner, Group, and Others
Every file and directory in Linux has three distinct classes of users who can interact with it: the Owner (the user who created it), the Group (a team of users sharing permissions), and Others (everyone else with access to the system).
Each of these three classes can have up to three distinct rights: Read (r), Write (w), and Execute (x). When viewing permissions in terminal via `ls -l`, you see a 9-character string such as `-rwxr-xr--` reflecting these three groups.
The Octal Math: Read (4), Write (2), Execute (1)
Instead of writing out symbolic strings, Linux allows numeric shorthand called octal notation. Each permission is assigned a specific binary power of two:
Read = 4, Write = 2, Execute = 1. Combining them gives a unique sum between 0 and 7. For example: 4 + 2 + 1 = 7 (Read, Write, and Execute). 4 + 2 = 6 (Read and Write). 4 + 1 = 5 (Read and Execute). 4 = 4 (Read only).
A three-digit code like 755 simply concatenates the sum for each class: Owner gets 7 (rwx), Group gets 5 (r-x), and Others get 5 (r-x).
Why chmod 777 is a Severe Production Risk
Developers frequently run `chmod 777` when facing a 'Permission denied' error because it immediately solves the roadblock. However, 777 grants universal write access, meaning any compromised process or malicious local user can modify, replace, or execute arbitrary code inside that file.
In web servers (like Nginx or Apache), public writable files can allow attackers to inject web shells or overwrite environment secrets. Never deploy files with 777 in production.
Recommended Safe Permissions
For static web assets, configuration files, and scripts, the golden rule of least privilege applies:
Standard files: 644 (Owner can read/write; Group and Others can only read).
Standard directories: 755 (Owner has full control; Group and Others can traverse and read contents).
Private keys & credentials (.env, id_rsa): 600 or 400 (Only Owner can read/write, zero access for Group and Others).