Linux File Permissions Explained: chmod 644, 755, 600 and Safer Fixes

Your deploy script fails with "permission denied." You run chmod 777, the error disappears, and you move on. 🚀

That shortcut leaves the file writable by every local user. If a cron job, CI runner, or service executes it with higher privileges, you have created a possible privilege escalation path. ⚠️

The model behind chmod is small enough to memorize:

🔹 Read = 4, Write = 2, Execute = 1
🔹 Add them per class: owner, group, others
🔹 So 644 = rw-r--r--

Safer defaults

• 644 for regular files
• 755 for scripts and directories
• 600 for SSH private keys and secrets 🔑
• 640 for configs a service group must read
• 700 for private directories like ~/.ssh

Avoid blanket recursive chmod

chmod -R 755 makes every file executable. Set directories and files separately instead:

find project/ -type d -exec chmod 755 {} +
find project/ -type f -exec chmod 644 {} +

Audit for risky permissions (read-only)

find / -xdev -type f -perm -0002 2>/dev/null
find / -xdev -type f -perm -4000 2>/dev/null

The first lists world-writable files. The second lists setuid files, which should only be familiar system binaries. 🛡️

The full guide also covers SSH key rules, setgid, the sticky bit, and auditd logging of permission changes.

👉 Full Linux chmod cheat sheet: https://www.xpert4cyber.com/2026/09/linux-chmod-cheat-sheet-file-permissions.html

What is the worst permission mistake you have found in a repo or server? Share it below. 💬