chmod 750

chmod 750 sets the mode to rwxr-x---: the owner can read, write and execute (7), the group can read and execute (5), and everyone else gets nothing (0). It’s 755 with others shut out: a directory or program shared with one group and hidden from every other local user.

What each class can do

On a directory, the owner can change its contents, the group can list it and open what’s inside (as far as each file’s own mode allows), and others can’t even see the names. On a program, the group can run it and others can’t.

Where it’s used

• Home directories. Ubuntu has created new ones as 750 since 21.04, so other users can no longer browse them.
• Web roots kept from other users. The files belong to a deploy user, the group is the web server’s, and others get nothing:

sudo chown -R deploy:www-data /var/www/site
sudo find /var/www/site -type d -exec chmod 750 {} +
sudo find /var/www/site -type f -exec chmod 640 {} +
stat -c '%a %U:%G %n' /var/www/site   # 750 deploy:www-data /var/www/site

nginx and PHP-FPM, running as www-data, can read everything and change nothing; nobody else on the box can read it at all.

• PostgreSQL’s data directory, which since PostgreSQL 11 may be 0750 instead of 0700, so a backup tool in the server’s group can read it. initdb --allow-group-access creates it that way.
• Service directories such as /etc/myapp or /opt/myapp/bin, owned by root with the service’s group.

The home directory trap

A site served from /home/alice/site breaks once /home/alice is 750: nginx logs open() "/home/alice/site/index.html" failed (13: Permission denied), because its user has no execute on the home directory. Move the site under /var/www, or grant traverse only, with no listing: setfacl -m u:www-data:x /home/alice. Adding www-data to alice’s group works too, but lets the web server read everything group-readable in her home.

Umask

Umask 027 produces this mode: 777 with 027 cleared is 750 for directories, and files come out 640. Set it for a service with UMask=0027 in its systemd unit.

In git and containers

Git stores no directory modes, and a 750 script goes in as 100755 and comes back 755. Set group-only modes in the deploy step or the image. In a Dockerfile, COPY --chown=app:app --chmod=750 run.sh /app/ sets both at once; for a whole directory, RUN chmod 750 /app after the copy.