chmod and chown: File and Directory Permissions Explained

chmod controls what can be done to a file (read/write/execute); chown controls who it belongs to. They solve different problems and get confused constantly.

Reading a permission string

ls -l app.sh
# -rwxr-xr-- 1 sheetal developers 220 Sep 3 14:30 app.sh

That rwxr-xr-- breaks into three groups of three:

rwx   r-x   r--
owner group other

• Owner (sheetal): read, write, execute
• Group (developers): read, execute
• Other (everyone else): read only

The numbers, explained (not memorized)

Each permission has a value: r=4, w=2, x=1. Add them up per group:

chmod 755 app.sh
# 7 = 4+2+1 = rwx  (owner)
# 5 = 4+0+1 = r-x  (group)
# 5 = 4+0+1 = r-x  (other)

Common ones worth actually knowing rather than looking up every time:

• 755 — standard for scripts and executables: owner can edit, everyone can run
• 644 — standard for regular files: owner can edit, everyone can read, no one can execute
• 600 — private files (SSH keys, .env files): only the owner can read or write, no one else can even look
• 777 — everyone can do everything. Almost never the right answer, even to "just make it work"

chown: changing ownership

sudo chown www-data:www-data /var/www/mysite
#           ^user    ^group

This is the one people reach for when a web server (running as www-data) can't write to a directory that's currently owned by their own login user. The fix is chown, not a looser chmod — widening permissions to 777 because ownership is wrong just trades one problem for a security hole.

Recursive changes — read this before running -R

sudo chown -R www-data:www-data /var/www/mysite

-R applies to every file and subdirectory. That's usually fine for ownership, but recursive chmod is where people get hurt:

# DON'T do this on a whole project:
chmod -R 777 /var/www/mysite

This makes every file executable and every directory world-writable, including your .env, database config, and any private keys sitting in the tree. If you genuinely need to fix permissions across a directory, set files and directories differently:

find /var/www/mysite -type d -exec chmod 755 {} \;   # directories need execute to be entered
find /var/www/mysite -type f -exec chmod 644 {} \;   # files don't