chmod +x

The typical workflow is: write the script, add a shebang line such as #!/usr/bin/env bash as the very first line, run chmod +x deploy.sh, then start it with ./deploy.sh. Without the execute bit the shell answers bash: ./deploy.sh: Permission denied; without the shebang the kernel does not know which interpreter to use.

On a file created with the default mode 644, chmod +x produces 755 (rwxr-xr-x). If only you should run it, prefer chmod u+x, which gives 744. Interpreters do not need the bit at all: bash deploy.sh or python3 tool.py work on a 644 file.

If ./script.sh still fails after chmod +x, check the filesystem: partitions mounted with noexec (often /tmp and some USB or network mounts) refuse to execute anything. Windows line endings cause /usr/bin/env: ‘bash\r’: No such file or directory; fix them with dos2unix.

In Git, the execute bit is tracked. Commit it with git update-index --chmod=+x deploy.sh when you work from Windows, where the filesystem cannot store it.

• chmod +x deploy.sh: add execute for all classes (subject to umask).
• chmod u+x deploy.sh: only the owner may run it.
• chmod +x *.sh: every shell script in the current directory.
• find bin -type f -name "*.sh" -exec chmod +x {} +: scripts in a tree, without touching data files.
• ls -l deploy.sh: confirm the x positions in -rwxr-xr-x.

chmod +x script.sh results in mode 755, shown by ls -l as -rwxr-xr-x. In plain terms: owner: read, write, execute; group: read, execute; other: read, execute.

• Use it for: Making a freshly written script runnable with ./script.sh.
• Avoid it for: Files that are only ever passed to an interpreter (bash script.sh works without +x).
• Risk rating: Standard: no write access for others. World-readable: avoid for private keys, .env files and credentials.

chmod stands for change mode. Every file and directory on a Linux or Unix system carries a mode: nine permission bits split into three triplets for the owner (user), the group, and others (everyone else). Each triplet answers three questions: can this class read the file, write to it, and execute it?

Octal notation compresses each triplet into one digit by adding weights: read = 4, write = 2, execute = 1. A digit of 7 is 4+2+1 (read, write, execute), 6 is read and write, 5 is read and execute, and 4 is read-only. That is why chmod 755 means the owner gets everything while group and others can read and execute but never modify.

For directories the bits mean something slightly different. Read lets you list names, write lets you create, rename or delete entries, and execute (the search bit) lets you traverse into the directory at all. A directory with r but no x is a common source of confusing “permission denied” errors.

The 644 file permission (rw-r--r--) is the default for regular files: the owner can edit, everyone else can read. Web assets, configuration files and documentation normally use 644 permissions. chmod 755 is its counterpart for directories and executables.

chmod 600 restricts a file to its owner: nobody else can read it. Use it for SSH private keys, .env files, kubeconfig files and API tokens. OpenSSH refuses to use a private key that is readable by group or others, which is why chmod 600 ~/.ssh/id_ed25519 (or 400) fixes the “UNPROTECTED PRIVATE KEY FILE” warning.

chmod 777 grants read, write and execute to every account on the system. It is almost never the right fix. On a web server it lets any compromised process overwrite your code, and on shared hosts it lets other tenants plant files. The calculator marks 777, 666 and anything world-writable as high risk.

Symbolic mode edits permissions relative to what is already there. chmod +x deploy.sh adds execute for everyone (subject to the umask), chmod -x notes.txt removes it, and chmod u=rw,go=r file sets exact values per class. The letters are u (user/owner), g (group), o (others) and a (all).

Use the capital X with recursive changes: chmod -R u=rwX,go=rX dir gives execute only to directories and to files that already had it, so data files do not become executable by accident.

• + adds bits, - removes bits, = sets bits exactly and clears the rest for that class.
• Multiple clauses are comma-separated without spaces: chmod u+x,g-w file.
• chmod a-w makes a file read-only for everyone, including the owner.

Paste a permission string such as -rwxr-x--- into the Symbolic field and the calculator works backwards: the matrix, octal value and command update immediately. -rwxr-x--- is 750: the owner has rwx (4+2+1 = 7), the group r-x (4+1 = 5) and others nothing (0). You can paste a whole ls -l line (drwxr-x---+ 2 root adm 4096 …) or chmod -rwxr-x---; the file type letter and the trailing + (ACL) or . (SELinux) markers are ignored.

As a chmod maker this works in both directions: tick boxes to build a mode, or paste what ls -l shows to find the number to reuse with chmod on another server.

A fourth, leading octal digit controls special bits. 4 is setuid: the program runs with the file owner’s privileges (this is how passwd edits /etc/shadow). 2 is setgid: programs run with the group’s privileges, and new files inside a setgid directory inherit its group. 1 is the sticky bit: in a shared directory such as /tmp (1777), users can delete only their own files.

Setuid binaries owned by root are a classic privilege-escalation path. During a security review, list them with find / -perm -4000 -type f 2>/dev/null and compare against a known-good baseline.

chmod -R applies a mode to a directory and everything beneath it. Running chmod -R 755 on a tree makes every file executable, which is rarely what you want. Prefer two passes with find: one for directories (755) and one for files (644).

You need sudo only when you are not the file’s owner. The owner can always change a file’s mode; root can change any mode. Changing ownership itself is a separate command, chown.