Short answer: Linux permissions combine three classes—owner, group, and others—with read, write, and execute/search bits. chmod changes the mode of an existing file or directory; umask removes bits when a program creates a new one. On a VPS, reliable access control usually requires all of these details: directory traversal, parent-directory permissions, default creation modes, group inheritance, sticky directories, and sometimes ACLs.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How Linux permission bits are organized
Every inode has permission bits for three classes:
- Owner: the account that owns the inode.
- Group: the inode’s owning group.
- Others: every account that is neither the owner nor a member of the owning group.
Each class has read (r), write (w), and execute (x) bits. GNU’s chmod documentation describes these as the rwxXst mode letters; the meaning depends on whether the inode is a regular file or a directory.
Regular files
- Read: the process can read file contents.
- Write: the process can modify or truncate contents, subject to the application and filesystem.
- Execute: the kernel may execute the file as a program, provided other execution requirements are met.
Directories
Directory bits do not mean “open the directory like a file.” Read permits listing names. Write permits creating, deleting, or renaming entries when combined with search permission. Execute is search/traverse: it allows a process to access an entry whose name it knows and to pass through the directory in a path.
Recommended Free Tools
As an Amazon Associate I earn from qualifying purchases.
That distinction explains a common VPS failure. A service may have read permission on /srv/app/config/file but still receive “permission denied” because it lacks search permission on /srv, /srv/app, or /srv/app/config. Every directory component in the path must be traversable by the process.
Reading symbolic and numeric modes
ls -l displays a ten-character string such as -rwxr-x---. The first character identifies the file type; the remaining nine are owner, group, and others in that order. A regular file shown as -rw-r----- gives its owner read/write access, its group read access, and everyone else no access.
#1 Best Overall
Numeric modes add the values within each class:
| Bit | Value | Meaning |
|---|---|---|
| Read | 4 | Read file contents or list directory names |
| Write | 2 | Modify file contents or create/delete/rename directory entries |
| Execute/search | 1 | Execute a file or traverse a directory |
Thus 6 means read plus write, 5 means read plus execute/search, and 0 means no permission. The command chmod 0644 file gives the owner read/write and group and others read. chmod 0755 directory gives the owner read/write/search and group and others read/search.
Free tools Windows power users keep installed
One-click scans. No signup required.
What “chmod 755” means
0755 is conventionally written as 755 when no special-bit digit is present. The owner digit 7 is read, write, and execute/search; each 5 is read plus execute/search. On a directory, that lets non-owners traverse and list it but not create or remove entries. On a regular file, it makes the file executable by all three classes, which is appropriate only when the file is intended to be run.
What chmod changes—and what it does not
chmod changes mode bits on existing inodes. It does not change the owner or group, and it does not establish a process’s identity. Use chown or chgrp separately when ownership is wrong.
Symbolic modes can target one or more classes, for example chmod u=rw,g=r,o= file. Numeric modes are easier to audit in deployment scripts because every class is explicit. Before a recursive command, inspect the tree and define the trust boundary. A blanket chmod -R 777 grants every account write access and commonly exposes secrets or permits code tampering.
Special bits: setuid, setgid, and sticky
Numeric modes can begin with a fourth digit for special behavior:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Digit | Octal constant | Primary use |
|---|---|---|
| 4 | 04000 | setuid |
| 2 | 02000 | setgid |
| 1 | 01000 | sticky |
These bits affect privilege or directory behavior and deserve a deliberate review before deployment.
Setgid for shared project directories
Setgid on a directory makes newly created entries inherit that directory’s group. This is the practical answer when several accounts, a deployment user, and a service account must collaborate without repeatedly repairing group ownership.
For example:
groupadd project
usermod -aG project deploy
usermod -aG project app
chgrp project /srv/project
chmod 2775 /srv/project2775 combines setgid with owner and group read/write/search and other read/search. Existing files keep their current group until changed; the inheritance applies to new entries. Each user must start a new login session, or otherwise refresh supplementary groups, after being added.
Sticky bit for shared-write directories
A world-writable directory such as a drop area can be made sticky with chmod 1777 /srv/drop. Users may create entries, but a file or subdirectory can be renamed or deleted only by its owner, the directory owner, or a privileged process. The Linux inode documentation defines this deletion and rename restriction; sticky does not make file contents private and does not prevent an owner from changing their own entry.
umask: why new files are often 644
umask is a per-process mask applied at creation time. The Linux manual describes it as turning permission bits off from the mode argument supplied to system calls such as open(2) and mkdir(2). It is not a command that edits existing files.
Most programs request a base mode of 0666 for regular files and 0777 for directories, then the kernel removes masked bits. With the common umask 0022:
| Object | Requested mode | umask | Typical result |
|---|---|---|---|
| Regular file | 0666 | 0022 | 0644 |
| Directory | 0777 | 0022 | 0755 |
This is why a newly created text file normally appears as -rw-r--r-- rather than executable. A program can request a more restrictive mode, so the result is not always a simple subtraction from the displayed digits.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspecting and setting umask
Run umask in a shell to display the current mask, usually in octal form. To test a policy for the current shell:
Rank #4
umask 0027
touch /tmp/example-file
mkdir /tmp/example-dir
stat -c '%a %n' /tmp/example-file /tmp/example-dirA mask of 0027 commonly produces files readable by the owner and group but inaccessible to others, and directories searchable by the owner and group but inaccessible to others, assuming the program requests the usual base modes. The setting affects processes that inherit that shell environment; it does not retroactively alter /tmp/example-file.
For services, set the mask in the service manager or launch environment rather than assuming an interactive shell’s profile is loaded. Verify the effective value in the running process’s environment and test the application’s actual creation path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When ACLs change the simple calculation
The mode-plus-umask explanation is the default path, not an absolute guarantee. A parent directory can carry a default access control list (default ACL). When present, that ACL can determine the inherited permissions for newly created files and directories and override the result you would predict from umask alone.
If a new entry has surprising permissions, inspect both the process’s umask and the directory’s ACL. On systems with ACL tools installed, getfacl /path/to/parent reveals access and default entries. Do not “fix” an unexpected mode with a broader chmod until you know whether an ACL or a service-specific creation request will recreate the problem.
Best Value
Diagnosing “permission denied” on a VPS
- Identify the process account. Check the service unit or process list; test as that account rather than as root.
- Inspect every path component. Run
namei -l /srv/app/config/filewhen available, or inspect each parent withls -ld. The service needs search permission on every directory. - Inspect the target inode. Use
ls -lorstatto confirm owner, group, and mode. - Check group membership. A correct group bit is useless if the service account is not actually in that group, or if its long-running process has not been restarted since membership changed.
- Check ACLs. An access ACL may grant or restrict a named user or group beyond the nine mode bits.
- Retest with least privilege. Use the service account and the exact path. Avoid testing only as root, which bypasses normal permission checks.
Remember that directory write controls namespace operations. To delete a file, a process generally needs write and search on the containing directory; write permission on the file itself is not the decisive check.
A practical shared-project policy
For a project edited by several administrators and read by a service, create a dedicated group, make the project directory group-owned, set the setgid bit, and choose a restrictive umask for collaborators. A typical starting point is:
chgrp -R project /srv/project
chmod 2775 /srv/project
umask 0002The directory’s setgid bit keeps new entries in group project; a 0002 mask allows group write when applications request the usual modes. Apply a different mask when other local users must not read project files. Existing files may need a one-time mode and group cleanup, and private configuration or credentials should be separated with narrower permissions instead of relying on the shared directory default.
Quick Recap
Permission checklist before production
- Use
0644for ordinary non-secret files only when read access for group and others is intended. - Use
0755on directories only when non-owners should list and traverse them. - Keep secrets and private keys out of broadly readable paths; give them the minimum owner or group access required.
- Use setgid, not repeated manual
chgrp, for a genuinely shared project group. - Use sticky only for shared-write namespaces where users must not remove one another’s entries.
- Review setuid and setgid files before recursive operations; privilege bits can have security consequences.
- Check default ACLs when a file’s mode does not match its creator’s umask.
- Document the service account, owning group, expected umask, and every parent directory’s traversal requirement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
