Use chmod on Linux Without Blanket Recursive Permission Changes

chmod changes file mode bits. It does not change the owner, fix every access-denied error or establish that a website is secure. Use it only on an identified object whose intended access you understand.

Symbolic and numeric modes

Symbolic modes select owner u, group g, other o or all a, then add +, remove – or assign = permissions. Numeric triplets add read 4, write 2 and execute/search 1 separately for each class. Thus 600 is owner read/write only, 640 also permits group reading, and 750 permits group reading/execution but no access for others.

The old explanation of 755 as group/other read-only was wrong: its 5 includes execute/search. Likewise, 770 adds broad owner/group access rather than merely removing other access. On a directory, execute means search/traversal; on a regular file it relates to execution.

Practice on a new disposable file

Run this GNU/Linux example in a shell you control. It creates a private temporary directory and a synthetic file, not a production website:

lab=$(mktemp -d) || exit 1
cd "$lab" || exit 1
printf 'sample\n' > sample.txt
chmod 600 -- sample.txt
stat -c '%a %n' -- sample.txt
chmod g+r -- sample.txt
stat -c '%a %n' -- sample.txt

The reported modes are 600 and then 640. The generated directory remains for inspection; do not reuse an unrelated directory or replace its path with a website root.

Execution, recursion and exceptions

Grant a script execution rights only to the users who need direct execution; invoking a readable script through an interpreter is a different path. GNU chmod’s uppercase X can add search to directories or execute to already-executable files; it does not mean unconditional execute on every regular file.

A recursive 755 operation can make data files executable and expose secret material. Neither a blanket 777 repair nor recursively changing /var/www/html is a sensible default. Review distinct files, directories, ACLs, special bits, symlink handling and runtime-writable paths before designing any recursive operation.

Mode 444 is not immutable: an owner may be able to change it back, and removal depends largely on the parent directory. Privileged processes and other security controls also affect access. Inspect the result and test the intended allowed and denied actions rather than relying on a numeric mode alone.

References: GNU chmod; Linux access checks; file removal rules.

Reviewed October 15, 2026. The exact example was checked in an isolated Linux container; no customer permissions were changed.