File Permissions Reference

---

No permission at all.

--x

Execute only; the file runs but cannot be read.

-w-

Write only; rarely useful in practice.

-wx

Write and execute.

r--

Read only; the usual mode for read-only files and keys.

r-x

Read and execute, the classic mode for scripts and binaries.

rw-

Read and write, the classic mode for data files.

rwx

Full permission; a directory needs this to be entered.

7

Letters to digits: r=4, w=2, x=1, summed per triad.

0

Placeholder shown when a permission bit is off.

-

Type bit: d for directory, dash for regular file, l for symlink.

第 2 位 = 同组

Read permissions as three triads: owner, group, others.

r--------

Owner read only; required for private keys.

r--r-----

Owner and group can read.

r--r--r--

Readable by everyone; common for cron files.

rw-------

Owner read-write only, for configs holding secrets.

rw-r-----

Owner read-write, group read.

rw-r--r--

The default for regular files.

rw-rw----

Owner and group read-write.

rw-rw-r--

Group writable; common in shared directories.

rw-rw-rw-

Read-write for everyone; usually a mistake.

rwx------

Owner-only access; private directories.

rwxr-x---

Owner full, group read and traverse.

rwxr-xr-x

The default for directories and scripts.

rwxrwxr-x

Group-writable directory for team shares.

rwxrwxrwx

Full access for everyone; never on production web roots.

r-xr-xr-x

Read-only directory; prevents deletion but also writes.

r-x------

Owner-only executable.

--x--x--x

Executable by all but readable by none; rare and hard to debug.

chmod 755 dir

On a directory the x bit allows entering; r alone only lists names.

644 文件 / 755 目录

Files 644, directories and scripts 755: the general default.

chown -R www-data:www-data dir

Give ownership to the service account instead of opening permissions.

setuid

setuid: run as the file owner; a risky bit.

setgid

setgid: run as the file group; on directories, new files inherit the group.

sticky

sticky: only the owner may delete files in the directory; this is what /tmp uses.

-rwsr-xr-x

setuid plus 755, common for binaries that need elevation.

-rwxr-sr-x

setgid plus 755.

rwxrwsr-x

setgid directory: the standard for team shares.

rwxrwxrwt

sticky plus 777; /tmp uses exactly this.

4755

Add setuid to a file.

2775

Add setgid to a directory so new files inherit its group.

1777

Add the sticky bit.

rwSr--r--

Lowercase s means the x bit is set; uppercase S means it is not, so it does nothing.

文件 644 / 目录 755

The default mask: removes group and other write from 666 and 777.

文件 664 / 目录 775

Allows group write; common on shared machines.

文件 640 / 目录 750

Denies others entirely; stricter servers.

文件 600 / 目录 700

Strictest: only you can touch new files and directories.

当前掩码

Show the current mask; it can differ per shell.

u=rwx,g=rx,o=rx

Show the mask symbolically, easier to read.

666 与 022 得到 644

New files start from 666 minus the mask; directories from 777.

仅当前 shell 生效

The mask lasts only for the current session; make it persistent in shell config.

数字改权限

The usual way to set permissions.

给所有者加执行位

Symbolic form: change one bit and leave the rest.

递归改目录内全部

Recursive change also hits files; usually not what you want.

b 复制 a 的权限

Copy the mode from another file instead of computing it.

同时改所有者与组

Change owner and group together.

递归改归属

Hand the web root to the service account; far better than 777.

只改所属组

Change only the group.

-rw-r--r-- 1 ada dev

Read the first column: type bit plus three triads.

644 file

Print the numeric mode; far more reliable than parsing ls.

只改文件

Set modes per type; the standard fix for a 777 accident.

只改目录

Pair it with the previous command.

查看 ACL

Inspect ACLs beyond the standard permission bits.

给指定用户授权

Grant via ACL without changing groups.

以指定用户身份执行

Run a command as another user, useful for permission debugging.