Owner can read and write. Group can read. Others can read.
| Read | Write | Execute | |
|---|---|---|---|
| Owner | ✓ | ✓ | – |
| Group | ✓ | – | – |
| Others | ✓ | – | – |
Typical use
Regular files: everyone can read them, only you can edit.
Good to know
644 (rw-r--r--) is the default for ordinary files: the owner reads and writes, everyone else only reads. New files get it automatically, since programs create files with 666 and the usual umask 022 removes write for group and others. It suits HTML, CSS, images, source code and config without secrets, and a web server can serve such files as long as every folder above them has x.
644 is wrong for anything secret: on a shared server every local user, and any compromised service account, can read an .env file, database password or private key. Use 600 or 640 for those. Scripts need x to run directly, so ./deploy.sh fails with “Permission denied” at 644; use 755 or run bash deploy.sh. On a folder, 644 is broken: without x, nobody can enter it.
Commands
| Set the mode | chmod 644 file |
|---|---|
| The same with letters | chmod u=rw,g=r,o=r file |
| A folder and everything in it | chmod -R 644 folder |
| Only the folders inside | find folder -type d -exec chmod 644 {} + |
| How ls -l shows it | -rw-r--r-- |