chmod 755 vs 644 vs 777: Linux File Permissions Explained

When a Linux application reports “Permission denied,” one of the most common bad fixes is:

chmod -R 777 .

It may make the immediate error disappear, but it often gives far more access than necessary.

Understanding 755, 644, and 777 makes permission problems much easier to solve safely.

The three permission groups

Traditional Unix permissions are shown for:

1. owner;
2. group;
3. others.

Each group can have:

• read (r);
• write (w);
• execute (x).

A mode such as rwxr-xr-x can be represented numerically as 755.

Use Duck Cloud's chmod Calculator to convert between numeric and symbolic permissions.

How numeric chmod works

The values are:

• read = 4;
• write = 2;
• execute = 1.

Add them for each permission group.

Examples:

• 7 = read + write + execute;
• 6 = read + write;
• 5 = read + execute;
• 4 = read only.

Therefore:

755 = owner 7, group 5, others 5.

chmod 755

755 is:

rwxr-xr-x

The owner can read, write, and execute.

The group and others can read and execute but cannot write.

This is common for directories and executable files that need to be traversed or run by other users.

chmod 644

644 is:

rw-r--r--

The owner can read and write.

The group and others can read but cannot write.

This is common for ordinary non-executable files that are intended to be readable but only changed by the owner.

chmod 777

777 is:

rwxrwxrwx

Everyone can read, write, and execute.

That is extremely permissive.

Using 777 as a universal fix can allow unrelated users or processes to modify files. On multi-user systems, web servers, shared hosts, and containers, that can become a serious security problem.

Files and directories behave differently

The execute bit has different practical meaning on directories.

For a directory:

• read allows listing names;
• write allows modifying directory entries, subject to other rules;
• execute allows traversing or accessing items through that directory.

A directory may therefore need execute permission even when nothing inside it is an executable program.

Ownership may be the real problem

Before changing permissions, inspect ownership.

A web application may fail because files belong to the wrong user or group, not because the mode is too restrictive.

Typical causes include:

• running package installation as root;
• copying deployment files under the wrong account;
• containers writing files with unexpected UID/GID values;
• a web server and deployment user using different groups.

Correcting ownership or group membership is often better than making files world-writable.

Avoid recursive permission changes without inspection

Commands such as:

chmod -R 755 /path

apply the same mode to files and directories.

That can accidentally make ordinary files executable.

If a tree needs different file and directory permissions, handle them separately and verify the result.

Secrets need tighter permissions

Files containing secrets should not be broadly readable.

Examples include:

• private keys;
• .env files;
• database credentials;
• API tokens;
• deployment secrets;
• SSH keys.

Use the least access required by the process that needs them.

Symbolic chmod can be clearer

Instead of memorizing only numeric values, symbolic changes can express intent.

Examples include granting or removing specific permissions for owner, group, or others.

The chmod Calculator is useful when translating between the two forms during troubleshooting.

Permission troubleshooting checklist

1. Identify the exact file or directory causing the error.
2. Inspect current permissions.
3. Inspect owner and group.
4. Identify which user the failing process runs as.
5. Decide the minimum required read, write, or execute access.
6. Change only what is necessary.
7. Avoid 777 unless you have a very specific, understood reason.
8. Re-test the application.
9. Re-check secret files and deployment directories.

Linux permissions are easier when you stop thinking of numeric modes as magic numbers. Translate them into owner, group, others, and the exact access each process needs.