600, 644, and 755 are octal permission modes that specify which operations a file’s owner, group, and other users may perform. The digits are not security labels or universal defaults: choose a mode based on whether the target is a file or directory and who needs access.
How to read a three-digit permission mode
The three digits correspond, in order, to the file’s owner, users in its group, and others—everyone who is neither the owner nor in that group. Each digit adds together the permissions assigned to that class:
As an Amazon Associate I earn from qualifying purchases.
- 4 = read
- 2 = write
- 1 = execute for a regular file, or search/traversal for a directory
So 7 means read, write, and execute/search (4 + 2 + 1); 6 means read and write; 5 means read and execute/search; 4 means read alone; and 0 means no permission. GNU’s file-permissions documentation describes this three-class, three-permission model.
What 600, 644, and 755 allow
| Mode | Owner | Group | Others | Typical interpretation |
|---|---|---|---|---|
600 |
Read, write | None | None | Private regular file for its owner |
644 |
Read, write | Read | Read | Owner can edit; group and others can read |
755 |
Read, write, execute/search | Read, execute/search | Read, execute/search | Executable file or traversable directory, when intended |
The table describes the ordinary permission bits, not a recommendation for every object. In particular, 755 grants execute permission to group and others on a regular file. Use that only when they should be able to run it. For an ordinary data file, execute is usually unnecessary.
What is the difference between chmod 644 and 755?
Both modes let the owner read and write, and let group and others read. The difference is the final permission in each digit: 644 gives no one execute/search permission, while 755 also gives the owner, group, and others execute/search permission. For a regular file, that means the latter can be run by all three classes. For a directory, it means all three classes can search or traverse it, subject to access on parent directories and other controls.
Why directories use execute permission differently
On a regular file, read lets a user read its contents, write lets them change those contents, and execute lets them run it as a program. On a directory, read allows listing names, write allows creating or removing entries, and execute means searching the directory—accessing an entry by name or traversing it. It does not mean running the directory as a program.
As a result, someone who should access files inside a directory generally needs search permission on that directory and its parent path, even if the person must not execute any program there. A directory intended to be listable but not writable may need read and search, for example; the appropriate mode depends on who needs to list, traverse, or change its contents.
Rank #2
- The Unix Programming Environment (Prentice-Hall Software Series)
- Product Type: ABIS_BOOK
- Pearson
Why Unix permissions use numbers
Read, write, and execute/search are represented as three bits with values 4, 2, and 1. Adding those values produces one compact octal digit for each user class. Three digits then express owner, group, and other permissions together: 600 is 6-0-0, while 644 is 6-4-4. This is a concise way to set the ordinary permission bits.
Symbolic modes can express the same permissions more visibly. For example, u=rw,go=r means the owner gets read and write, while group and others get read. GNU’s mode-structure documentation explains numeric and symbolic forms.
How to choose a mode using least privilege
Start with the object and the work users must do, then grant only those permissions. Ask whether each class needs to read, change, run, list, or traverse—not merely whether a familiar number is commonly used.
Rank #3
- Used Book in Good Condition
- For an owner-only regular file that must remain editable by its owner,
600allows owner read/write and denies group and others access through these ordinary bits. - For a regular file that the owner edits and others only read,
644allows that access without granting execute. - For an executable file that group and others are meant to run, or a directory they must traverse,
755grants execute/search to all three classes. Confirm that this broader access is intended.
These are examples, not universal defaults. A file’s mode is only one layer of access control: group membership, permissions on parent directories, access-control lists (ACLs), privileged users, filesystem attributes, and application-level controls can affect what users can actually do.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Why a new file may not start as 644 or 755
When a process creates a file or directory, it requests a mode and the process’s umask restricts the permissions granted. A default ACL may further restrict the result. The umask varies between systems and environments, so there is no single universal creation default. GNU Coreutils explains this interaction in The Umask and Protection.
Check the mode actually assigned on your system rather than assuming a newly created file will be 644 or a directory will be 755. Creation mode, umask, and any default ACL all matter.
Rank #4
Using chmod without changing more than intended
A numeric mode sets the ordinary permission bits to the specified values. For example, chmod 600 filename gives the owner read/write and removes group and other access through those bits. chmod 644 filename gives the owner read/write and group and others read. GNU’s chmod documentation uses chmod 644 foo as an example of a world-readable file with owner write access.
- Identify the exact file or directory and confirm which users need access.
- Choose the least-permissive mode that permits the required operations for each class.
- Apply it to the intended target, such as
chmod 600 filename. - Inspect the resulting permissions on your system, especially when ACLs or platform-specific behavior may apply.
Only the owner or a suitably privileged process can change a file’s mode. On typical systems, applying chmod to a command-line symlink changes the target rather than permissions on the link itself; symlink permission behavior is system-specific and often ignored.
Free tools Windows power users keep installed
One-click scans. No signup required.
Be especially cautious with recursive changes. GNU documents symlink traversal options and warns that recursive traversal following symlinks can pose a security risk if an attacker can introduce a symlink during traversal. Avoid recursive chmod unless you have checked the target tree and understand how your implementation handles symlinks.
When a leading digit changes the meaning
The three-digit examples above cover ordinary owner/group/other permissions. A fourth, leading octal digit can specify special bits: set-user-ID (4), set-group-ID (2), and the sticky or restricted-deletion bit (1). These can change program or directory behavior and should not be added casually. On directories, setgid commonly makes new entries inherit the directory’s group; sticky behavior on a shared writable directory limits who may remove or rename entries.
Behavior can vary between platforms and command implementations. GNU documents a difference between chmod 755 dir and chmod =755 dir in how set-ID bits are handled. Consult the documentation for the system in use before relying on portability-sensitive details; GNU’s mode-structure reference describes its mode syntax.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
