chmod - change file modes

chmod is used to change the permissions of a file (its protection mode).

Only the owner or the POSIX administrator is authorized to change the permissions of a file. A file’s set-group-id bit can be set only by a user whose current group ID is the same as the file’s group ID (see chgrp and newgrp).

Syntax

chmod [-R] mode file ...

-R

(recursive)
chmod recursively descends through the specified directories, changing the mode for each file it encounters.

mode

In mode you specify how the permissions for one or more named files are to be changed.
There are two forms of mode specification:

• symbolic

• absolute

file

Name of the file for which you wish to define or alter the permissions. file may also be a directory. Multiple names are also allowed.

Symbolic form

[who]op[permission][,[who]op[permission]]...

who

In who you say who the file permissions apply to.

The choices for who are:
u	for the owner (user)
g	for the group
o	for others
a	for ugo, i.e. all users
or any combination of the letters u, g, o.

who not specified:
who defaults to ugo, i.e. all users. The permissions for ugo are set with allowance for the bits in the file-creation mode mask (see umask).

op

In op you specify whether permissions are to be granted, left unchanged, or revoked.

The choices for op are:
+	to add (grant) permissions
-	to take away (revoke) permissions
=	to assign permissions absolutely, i.e. only the listed permissions are granted, all others are revoked

permission

In permission you specify which permission(s) you wish to grant or revoke.

The choices for permission are:
r	for read permission
w	for write permission
x	(x - execute) for execute permission or for permission to browse files and directories.
X	for execute permission or for permission to search in a file, if at least one x bit is set, or in directories. If the file is not a directory, or if no x bit has been set for the file, this option is ignored.
s	for the set-user-ID or set-group-ID bit. Entering s in a chmod command is only useful in conjunction with u, g, or ug (if who is not specified, it defaults to ug). Set-user-ID and set-group-ID bits only apply to executable binary files (not to shell scripts) (see The s bits).
t	for sticky bit (t bit). Only the POSIX administrator is able to set the sticky bit. Attempts by nonprivileged users to set the sticky bit are ignored. Entering t in a chmod command is useful only in combination with u or a or if who is not defined. A set sticky bit only applies to executable files (see The sticky bit). If you change the mode of a file which has the sticky bit set, the sticky bit is automatically cleared.
l	(lock) for mandatory locking of files, directories or records, referring to a file’s ability to have its reading or writing permissions locked while a program is accessing it. file’s l bit can be set only if its group execute permission is not set and its set-group-id bit is set. Thus the following examples are not correct and would result in error messages:   chmod g+x,+l file   chmod g+s,+l file
u	Use the permissions of the current owner.
g	Use the permissions of the current group.
o	Use the permissions of the current others mode.

permission not specified:
This is only useful in combination with the = operator; all permissions are then revoked for the who in question.

As indicated above, you can specify several "who-op-permission" arguments in a row, provided they are separated by commas as follows:

chmod g-w,o-rw file

The string you specify for mode is processed by chmod from left to right. For instance, a-w,u+w grants write permission to the owner, revoking it for all others.

Absolute form

An absolute mode is a three or four digit octal number. The admissible octal values are obtained by logically ORing (in binary) the octal modes shown below. The effect is the same as adding the modes in octal or decimal. A leading zero (neither the s bit nor the sticky bit set) may be omitted.
The specified permissions are granted; all other permissions are revoked.

4000	Set user ID on execution
20#0	Set group ID on execution if # is 7, 5, 3 or 1.Set mandatory locking if # is 6, 4, 2 or 0.The value of # is ignored if file is a directory. In this case you can only use the symbolic form for mode.
1000	sticky bit (t bit)
0400	read permission for owner
0200	write permission for owner
0100	execute permission (or directory search permission) for owner
0040	read permission for group
0020	write permission for group
0010	execute permission (or directory search permission) for group
0004	read permission for others
0002	write permission for others
0001	execute permission (or directory search permission) for others

Example

To grant read, write, and execute permission to the owner and read and execute permission to the group, you would enter a value of 750 for mode:

400 + 200 + 100 + 40 + 10 = 750

The file then has the permissions rwxr-x---

The s bit

When an executable program which has the set-user-ID bit set is called, the effective user ID of the associated process is the same as the user ID of the owner of the file (and not that of the caller). In other words, the process runs under the user ID of the program owner and can therefore also access files for which the caller of the program does not have explicit access permission.
The real user ID of the process remains that of the program caller.

If the set-group-ID bit is set, the effective group ID of the process is the same as the group ID of the program owner. This means that the process runs under the group ID of the program owner.
The real group ID of the process remains that of the program caller.

The s bits are only useful for executable binary files (executable programs) and not for shell scripts. Although chmod can be used to set the s bits for files that contain a shell script, the setting will essentially have no effect.

When changes are made to a file, the s bits are reset for security reasons.

If the POSIX administrator sets the s bit for a program which he or she owns, all users who can call the program are thereby authorized to carry out any operations that the POSIX administrator is allowed to perform using the program. Hence the POSIX administrator should not set the s bit unless it is certain that security will not be compromised, leading to data loss for example.

Example of an s bit application

One example of an s bit application is the mailx command.

Messages sent with mailx to user USER1 are written to the file /var/mail/USER1. This file belongs to the group MAIL, and its owner is USER1. Both group and owner have read and write permission; no other users have any permissions for the file:

-rw-rw---- USER1 MAIL /var/mail/USER1

Thus ordinarily a user from a different group (USER2, for example) would be unable to write messages to this file. However, since the mailx command has the s bit set for the MAIL group, after calling mailx USER2 temporarily becomes an effective member of the MAIL group and thus has write permission for /var/mail/USER1.

The sticky bit (t bit)

Only the POSIX administrator is able to set the sticky bit (t bit). Attempts by non-privileged users to set the sticky bit are ignored.

The sticky bit only has an effect on directories and executable files. It is possible to use chmod to set it on other files, but it will then have no effect.

If the sticky bit is set on an executable file, it is possible to some extent to save on the overhead usually involved in reading a program in from the disk file again every time the program is started.

If a directory is writable and has the sticky bit set, files within the directory cannot be removed, renamed or linked to unless one or more of the following conditions apply:

• the file belongs to the user

• the directory belongs to the user

• the user has write permission for the file

• the user is a privileged user

In the output of the ls -l command, the sticky bit if set appears in the last position of the listed permissions. If the x bit has simultaneously been set for "other users", a t appears; if not, a T.

The l bit

The lockf() function allows a program to place a lock on a file which it is accessing. If this file has its l bit set, the function call results in mandatory locking of the file (see lockf() [4]).

Error

chmod: ERROR: Invalid mode

You have defined an illegal set of permissions for chmod.

chmod: WARNING: Locking not permitted on file, a group executable file

Files with group execute permission cannot also have the l bit set.

chmod: WARNING: Execute permission required for set-ID on execution for file
In order to turn on a file’s set-user-ID bit you need to have execute permission for the file.

Locale

The following environment variables affect the execution of chmod:

LANG

Provide a default value for the internationalization variables that are unset or null. If LANG is unset of null, the corresponding value from the implementation-specific default locale will be used. If any of the internationalization variables contains an invalid setting, the utility will behave as if none of the variables had been defined.

LC_ALL

If set to a non-empty string value, override the values of all the other internationalization variables.

LC_CTYPE

Determine the locale for the interpretation of sequences of bytes of text data as characters (for example, single- as opposed to multi-byte characters in arguments). LC_CTYPE governs character classes, character conversion (shifting) and the behavior of character classes in regular expressions.

LC_MESSAGES

Determine the locale that should be used to affect the format and contents of diagnostic messages written to standard error.

NLSPATH

Determine the location of message catalogs for the processing of LC_MESSAGES.

Example

The following examples all refer to a file with the permissions rw-------.

The first two columns of the table contain possible mode arguments; the last column shows the result of a chmod call using these arguments.

Symbolic form         Absolute form      Result
u-w                     400              r--------
-w                      400              r--------
go+r                    644              rw-r--r--
go=r                    644              rw-r--r--
go+rw                   666              rw-rw-rw-
=rw                     666              rw-rw-rw-
+rx                     755              rwxr-xr-x
=r                      444              r--r--r--
ug=rw,o=r               664              rw-rw-r--
u=rwx,g=rx,o=           750              rwxr-x---
+x,u+s                 4711              rws--x--x
+xt                    1711              rwx--x--t

The sticky bit (last example) can only be set by the POSIX administrator. Attempts by nonprivileged users to set the sticky bit are ignored.

See also

chgrp, ls, newgrp, umask

chmod(), chown() [4]