Chmod

Template:Short description Template:Lowercase title {{#invoke:Infobox|infobox}}Template:Template other{{#invoke:Check for unknown parameters | check | showblankpositional=1 | unknown = Template:Main other | preview = Page using Template:Infobox software with unknown parameter "_VALUE_"|ignoreblank=y | AsOf | author | background | bodystyle | caption | collapsetext | collapsible | developer | discontinued | engine | engines | genre | included with | language | language count | language footnote | latest preview date | latest preview version | latest release date | latest release version | latest_preview_date | latest_preview_version | latest_release_date | latest_release_version | licence | license | logo | logo alt | logo caption | logo upright | logo size | logo title | logo_alt | logo_caption | logo_upright | logo_size | logo_title | middleware | module | name | operating system | operating_system | other_names | platform | programming language | programming_language | released | replaced_by | replaces | repo | screenshot | screenshot alt | screenshot upright | screenshot size | screenshot title | screenshot_alt | screenshot_upright | screenshot_size | screenshot_title | service_name | size | standard | title | ver layout | website | qid }}Template:Main other <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight> is a shell command for changing access permissions and special mode flags of files (including special files such as directories). The name is short for change mode where mode refers to the permissions and flags collectively.<ref>The modes/permissions are shown when listing files in long format.</ref><ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

The command originated in AT&T Unix version 1 and was exclusive to Unix and Unix-like operating systems until it was ported to other operating systems such as Windows (in UnxUtils)<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and IBM i.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

In Unix and Unix-like operating systems, a system call with the same name as the command, Template:Mono, provides access to the underlying access control data. The command exposes the capabilities of the system call to a shell user.

As the need for enhanced file-system permissions grew, access-control lists<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> were added to many file systems to augment the modes controlled via <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight>.

The implementation of <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight> bundled in GNU coreutils was written by David MacKenzie and Jim Meyering.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

Use

Although the syntax of the command varies somewhat by implementation, it generally accepts either a single octal value (which specifies all the mode bits on each file), or a comma-delimited list of symbolic specifiers (which describes how to change the existing mode bits of each file). The remaining arguments are a list of paths to files to be modified.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }} (note that "space delimited" is a feature of the shell, not of chmod itself.)</ref>

Changing permissions is only allowed for the superuser (root) and the owner of a file.

If a symbolic link is specified, the target of the link has its mode bits adjusted. Permissions directly associated with a symbolic link file system entry are typically not used.

Options

Optional, command-line options may include:

• <syntaxhighlight lang="text" class="" style="" inline="1">-R</syntaxhighlight> recursive; include contained files and subdirectories of specified directories
• <syntaxhighlight lang="text" class="" style="" inline="1">-v</syntaxhighlight> verbose; log changed file names

Octal notation

Given a numeric permissions argument, the <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight> command treats it as an octal number, and replaces all the mode bits for each file. (Although 4 digits are specified, leading <syntaxhighlight lang="text" class="" style="" inline="1">0</syntaxhighlight> digits can be elided.)<ref>This differs from the “C” language, where the <syntaxhighlight lang="text" class="" style="" inline="1">0</syntaxhighlight> prefix for octal numbers is a remnant of its early period.</ref>

Why octal rather than decimal? <ref>Although rarely used today, during the early development of UNIX, octal was very useful because repeating groups of 3 bits were common in the physical structure of computers at the time, and these bits were easier to read & understand when encoded as octal digits, just as groups of 4 bits are easier when grouped into hexadecimal digits. The numeric expression of filesystem permissions in octal is one of the few of the few remnants of this time.</ref>

There are twelve standard mode bits, comprising 3 special bits (Template:Mono, Template:Mono, and Template:Mono), and 3 permission groups (controlling access by user, group, and other) of 3 bits each (read, write, and exec/scan); each permission bit grants access if set (1) or denies access if clear (0).

As an octal digit represents a 3-bit value, the twelve mode bits can be represented as four octal digits. <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight> accepts up to four digits and uses 0 for left digits not specified (as is normal for numeric representation). In practice, 3 digits are commonly specified since the special modes are rarely used and the user class is usually specified.

In the context of an octal digit, each operation bit represents a numeric value: read: 4, write: 2 and execute: 1. The following table relates octal digit values to a class operations value.

Octal digit permission

#	bits	rwx	granted operations
7	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">rwx</syntaxhighlight>	read, write and execute
6	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">rw-</syntaxhighlight>	read and write
5	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">r-x</syntaxhighlight>	read and execute
4	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">r--</syntaxhighlight>	read only
3	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">-wx</syntaxhighlight>	write and execute
2	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">-w-</syntaxhighlight>	write only
1	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">--x</syntaxhighlight>	execute only
0	Template:Mono	<syntaxhighlight lang="text" class="" style="" inline="1">---</syntaxhighlight>	none

The command <syntaxhighlight lang="text" class="" style="" inline="1">stat</syntaxhighlight> can report a file's permissions as octal. For example:

<syntaxhighlight lang="console"> $ stat -c %a findPhoneNumbers.sh 754 </syntaxhighlight>

The reported value, <syntaxhighlight lang="text" class="" style="" inline="1">754</syntaxhighlight> indicates the following permissions:

• user class: read, write, and execute; 7 => (4 + 2 + 1)
• group class: read and execute; 5 => (4 + 1)
• others class: read only; (4)

A code permits execution if and only if it is odd (i.e. 1, 3, 5, or 7). A code permits read if and only if it is greater than or equal to 4 (i.e. 4, 5, 6, or 7). A code permits write if and only if it is 2, 3, 6, or 7.

Symbolic notation

The <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight> command accepts symbolic notation that specifies how to modify the existing permissions.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The command accepts a comma-separate list of specifiers like: [classes]+|-|=operations

Classes map permissions to users. A change specifier can select one class by including its symbol, multiple by including each class's symbol with no delimiter or if not specified, then all classes are selected and further the bits of umask mask will be unchanged.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Class specifiers include:

Class specifiers

symbol	description
Template:Mono	user: file owner
Template:Mono	group: members of the file's group
Template:Mono	others: users who are neither the file's owner nor members of the file's group
Template:Mono	all three classes; same as <syntaxhighlight lang="text" class="" style="" inline="1">ugo</syntaxhighlight>

As ownership is key to access control, and since the symbolic specification uses the abbreviation o, some incorrectly think that it means owner, when, in fact, it is short for others.

The change operators include:

Operators

symbol	description
Template:Mono	add operations/flags
Template:Mono	remove operations/flags
Template:Mono	set the entire operations/flags field; grants the specified operations and denies others

Operations can be specified as follows:

Operation specifiers

symbol	description
Template:Mono	read a regular file or list a directory's contents
Template:Mono	write to a file
Template:Mono	execute a regular file or recurse a directory tree
Template:Mono	special execute: selects to apply execute to directories (regardless of their current permissions) and apply execute to files that already have at least one execute permission granted (for any class); only useful with operation <syntaxhighlight lang="text" class="" style="" inline="1">+</syntaxhighlight> and usually in combination with option <syntaxhighlight lang="text" class="" style="" inline="1">-R</syntaxhighlight> for giving group or others access to a directory tree without setting execute permission on regular files, which would normally happen if with <syntaxhighlight lang="text" class="" style="" inline="1">chmod -R a+rx .</syntaxhighlight>; instead use <syntaxhighlight lang="text" class="" style="" inline="1">chmod -R a+rX .</syntaxhighlight>
Template:Mono	setuid mode or setgid mode
Template:Mono	sticky mode

Most <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight> implementations support the specification of the special modes in octal, but some do not which requires using the symbolic notation.

The <syntaxhighlight lang="text" class="" style="" inline="1">ls</syntaxhighlight> command can report file permissions in a symbolic notation that is similar to the notation used with <syntaxhighlight lang="text" class="" style="" inline="1">chmod</syntaxhighlight>. <syntaxhighlight lang="text" class="" style="" inline="1">ls -l</syntaxhighlight> reports permissions in a notation that consists of 10 letters. The first indicates the type of the file system entry, such as dash for regular file and 'd' for directory. Following that are three sets of three letters that indicate read, write and execute permissions grouped by user, group and others classes. Each position is either dash to indicate lack of permission or the single-letter abbreviation for the permission to indicate that it's granted. For example:

<syntaxhighlight lang="console"> $ ls -l findPhoneNumbers.sh -rwxr-xr-- 1 dgerman staff 823 Dec 16 15:03 findPhoneNumbers.sh </syntaxhighlight>

The permission specifier <syntaxhighlight lang="text" class="" style="" inline="1">-rwxr-xr--</syntaxhighlight> starts with a dash which indicates that <syntaxhighlight lang="text" class="" style="" inline="1">findPhoneNumbers.sh</syntaxhighlight> is a regular file; not a directory. The next three letters <syntaxhighlight lang="text" class="" style="" inline="1">rwx</syntaxhighlight> indicate that the file can be read, written, and executed by the owning user <syntaxhighlight lang="text" class="" style="" inline="1">dgerman</syntaxhighlight>. The next three letters <syntaxhighlight lang="text" class="" style="" inline="1">r-x</syntaxhighlight> indicate that the file can be read and executed by members of the <syntaxhighlight lang="text" class="" style="" inline="1">staff</syntaxhighlight> group. And the last three letters <syntaxhighlight lang="text" class="" style="" inline="1">r--</syntaxhighlight> indicate that the file is read-only for other users.

Examples

Add write permission to the group class of a directory, allowing users in the same group to add files:

<syntaxhighlight lang="console" highlight="3"> $ ls -ld dir # before drwxr-xr-x 2 jsmitt northregion 96 Apr 8 12:53 shared_dir $ chmod g+w dir $ ls -ld dir # after drwxrwxr-x 2 jsmitt northregion 96 Apr 8 12:53 shared_dir </syntaxhighlight>

Remove write permission for all classes, preventing anyone from writing to the file:

<syntaxhighlight lang="console" highlight="3"> $ ls -l ourBestReferenceFile -rw-rw-r-- 2 tmiller northregion 96 Apr 8 12:53 ourBestReferenceFile $ chmod a-w ourBestReferenceFile $ ls -l ourBestReferenceFile -r--r--r-- 2 tmiller northregion 96 Apr 8 12:53 ourBestReferenceFile </syntaxhighlight>

Set the permissions for the user and group classes to read and execute only; no write permission; preventing anyone from adding files:

<syntaxhighlight lang="console" highlight="3"> $ ls -ld referenceLib drwxr----- 2 ebowman northregion 96 Apr 8 12:53 referenceLib $ chmod ug=rx referenceLib $ ls -ld referenceLib dr-xr-x--- 2 ebowman northregion 96 Apr 8 12:53 referenceLib </syntaxhighlight>

Enable write for the user class while making it read-only for group and others:

<syntaxhighlight lang="console"> $ chmod u=rw,go=r sample $ ls -ld sample drw-r--r-- 2 oschultz warehousing 96 Dec 8 12:53 sample </syntaxhighlight>

To recursively set access for the directory docs/ and its contained files:

chmod -R u+w docs/

To set user and group for read and write only and set others for read only:

chmod 664 file

To set user for read, write, and execute only and group and others for read only:

chmod 744 file

To set the sticky bit in addition to user, group and others permissions:

chmod 1755 file

To set UID in addition to user, group and others permissions:

chmod 4755 file

To set GID in addition to user, group and others permissions:

chmod 2755 file

See also

• attrib
• cacls, modifies access control lists
• chattr, changes the attributes of a file
• chgrp, changes the group of a file
• chown, changes the owner of a file
• Template:Annotated link
• Template:Annotated link
• Template:Annotated link
• umask, restricts permissions at file creation

External links

• Template:Man
• Template:Man
• Template:Man
• chmod — manual page from GNU coreutils.
• GNU "Setting Permissions" manual
• CHMOD-Win 3.0 — Freeware Windows' ACL ↔ CHMOD converter.
• Beginners tutorial with on-line "live" example