Linux and Mac commands

chmod, chown and sudo: permissions

Every file on Linux and the Mac records who owns it and what each kind of user may do with it. Permissions explain why a script will not run, why a file cannot be saved, and why some commands need sudo. The examples on this page are illustrations, not real runs, because the tools used to check this site run on Windows, where these permissions do not behave in the same way.

Reading permissions

ls -l shows them at the start of each line.

-rw-r--r-- 1 asha staff   51 Nov 10 09:30 notes.txt
-rwxr-xr-x 1 asha staff  120 Nov 10 09:30 backup.sh
drwxr-xr-x 2 asha staff 4096 Nov 10 09:30 photos

The first character is the kind: - for a file, d for a folder. The next nine are three groups of three.

In each group, the three positions are r, w and x. A dash means "not allowed".

So -rw-r--r-- means: the owner may read and write, the group may read, and others may read. -rwxr-xr-x adds permission to run it, for everyone.

chmod with letters

chmod changes permissions. The letter form says who, then plus or minus, then what.

chmod u+x backup.sh
chmod go-w notes.txt
chmod a+r notes.txt
chmod u=rw,go=r notes.txt

In order: let the owner run the script; take write permission away from the group and others; let everyone read; and set the permissions exactly, to read and write for the owner and read for the rest.

Making a script runnable

The commonest reason to use chmod. A new script cannot be run until it is marked executable.

./backup.sh
chmod +x backup.sh
./backup.sh

The first attempt fails with "Permission denied". After chmod +x, it runs. chmod +x with no letter before the plus means "for everyone".

chmod with numbers

Each permission has a value: read 4, write 2, execute 1. Add them up for each group, and write the three totals side by side.

chmod 644 notes.txt
chmod 755 backup.sh
chmod 600 id_rsa

Danger. chmod 777 gives everyone on the computer permission to read, change and run a file. It is often offered online as a cure for "Permission denied". It is almost never the right cure, and on a server it is a security hole. Find out who should own the file and give that user the permission instead.

Folders and everything inside: -R

-R applies a change to a folder and all it contains.

Danger. chmod -R on the wrong folder can break a system. chmod -R 777 / or chmod -R 000 ~ leave a computer that will not start or an account that cannot sign in. Never use -R on /, on system folders, or on your whole home folder. Files and folders also need different permissions (folders need x to be entered), so one number for both is usually wrong. chmod -R u+rwX,go+rX folder uses a capital X, which adds execute only to folders and to files that are already executable.

chown: changing the owner

sudo chown asha notes.txt
sudo chown asha:staff notes.txt
sudo chown -R asha:staff project

The form is owner, optionally a colon and a group, then the file. Changing ownership normally needs sudo. It is the right fix when files copied or created as the administrator cannot be edited by the ordinary user.

sudo: act as the administrator

Ordinary accounts cannot change system files. sudo in front of a command runs that one command with the administrator's powers, after asking for your password. Nothing appears on screen as you type the password. That is normal.

sudo apt update

sudo protects the system from accidents: you have to ask on purpose.

Danger. With sudo, a command can do anything, including destroying the system. Do not put sudo in front of a command you do not understand, and never in front of one pasted from an untrusted page. If a command fails with "Permission denied", ask why before reaching for sudo. Often the right answer is that you should not be changing that file at all.

Who am I?

whoami prints your user name. id adds your groups. ls -ld folder shows a folder's own permissions.

Sensible habits

• Give the least permission that works.
• Keep private keys and password files at 600.
• Use 755 for folders and scripts you share, 644 for ordinary files.
• Fix ownership with chown instead of opening permissions to everyone.

On Windows, permissions are managed from a file's Properties, on the Security tab. The nearest command-line idea there is attrib, which is much simpler.

Examples shown with output were run on 12 November 2026 in a practice folder: Windows commands in cmd.exe on Windows 11, Linux commands with the GNU tools of Git Bash. The folder path and user name were replaced with made-up ones. Commands marked "not run here" are shown as you would type them.

This is an independent learning site. It is not connected with Microsoft, Apple or any Linux distribution. Windows, macOS and other names belong to their owners. Try commands first in a practice folder, never on files you cannot afford to lose.