chmod 500 — what r-x------ means

When to use 500

• Private scripts only you run. 500 (r-x------) gives the owner read and execute and shuts out group and others completely. It's the natural mode for a personal automation script in your home directory — a backup runner or a deploy helper — that no other account has any business touching.
• A private directory you alone traverse. 500 on a directory lets the owner cd in and read its listing while denying every other user. Combined with a narrow parent, it hides a tree of personal tooling or staged secrets from co-tenants on a shared host.
• Tamper-proof personal executables. Because 500 omits the owner's write bit, your own scripts can't be silently rewritten by a misbehaving process running as you. You can still run them; modifying them takes a deliberate chmod u+w first.
• Service-account binaries with no sharing. When a daemon runs under a dedicated user and nothing else should read or run its executable, 500 keeps it fully private to that account — no group leakage, no world access.

Common mistakes & gotchas

• Not even the owner can write. 500 has no write bit at all. To edit, you must chmod u+w (or act as root) first, then restore 500. People expecting "it's mine so I can save" get tripped up.
• Group and others get total denial. The ------ tail means any other account — including service users like www-data or a teammate — hits permission denied. If anything beyond the owner needs the file, 500 is too tight; consider 550 (add a group) or 555.
• Execute on a directory ≠ execute on a file. 500 on a directory grants traverse plus listing to the owner; on a file it grants the right to actually run it. The same octal means different things depending on the inode type.
• 500 is about access, not secrecy of the data path. 500 protects the file's own contents and runnability, but a parent directory with loose permissions can still leak the filename or let others replace the file. Lock down the containing directory too if privacy matters.

500 vs the alternatives

• 550 (r-xr-x---) adds read+execute for a trusted group. Choose 550 when a team or service group must also run the script; keep 500 when it's strictly yours.
• 700 (rwx------) is the writable private mode — owner gets read, write, and execute, group/others nothing. Use 700 while you're actively editing the script; drop to 500 to freeze it against accidental changes.
• 400 (r--------) is read-only with no execute — for private data files and secrets like an SSH key, not scripts. Use 500 when the owner must also run the file, 400 when it should only be read.

Set it with chmod

Apply this permission to a single file:

chmod 500 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 500 directory/

The same thing in symbolic form:

chmod u=rx,g=,o= filename

Frequently asked questions

What does chmod 500 mean?

500 sets r-x------: the owner gets read and execute, while group and others get no permissions at all. There's no write bit even for the owner, so the file is private, runnable, and read-only.

How do I edit a file that's set to 500?

Restore the owner's write bit first: chmod u+w file, make your changes, then re-lock with chmod 500 file. Alternatively edit as root, which bypasses the permission bits.

What's the difference between 500 and 700?

The owner's write bit. 700 is rwx------ (owner can read, write, execute); 500 is r-x------ (owner can read and execute but not write). Use 700 while maintaining the script, 500 to make it tamper-resistant.

Should I use 500 or 400 for a private file?

Use 500 for something you need to execute, like a private script — it includes the execute bit. Use 400 for a file you only read, like an SSH private key or a secrets file, where execute makes no sense and read-only is the goal.

Other common permissions

• chmod 777 rwxrwxrwx
• chmod 755 rwxr-xr-x
• chmod 644 rw-r--r--
• chmod 700 rwx------
• chmod 600 rw-------
• chmod 640 rw-r-----

Or build any permission with the interactive chmod calculator.