What it means
chmod 711 gives the owner read, write and execute permission, and gives the group and everyone else execute only. In ls -l it shows as drwx--x--x on a directory. It's mostly a directory mode.
| Who | Digit | Read | Write | Execute | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | yes | yes | yes | rwx |
| Group (g) | 1 | no | no | yes | --x |
| Others (o) | 1 | no | no | yes | --x |
The symbolic equivalent:
chmod u=rwx,go=x /home/deploy
On a directory
Execute on a directory means "pass through": a user can cd into it and open a file inside if they already know its name. Without read, they can't list what's there. So with 711:
- The owner can do everything.
- Other users can't run
ls /home/deploy("Permission denied"). - Other users can open
/home/deploy/public_html/index.html, if that path's own permissions allow it.
That makes 711 a "hallway" mode. It lets processes reach a known subdirectory without exposing the rest of the folder's contents.
The classic use: serving files from a home directory
Suppose nginx (running as www-data) serves a site from /home/deploy/site. If /home/deploy is 700, nginx can't get through, and every request returns 403 Forbidden. With 711 on the home directory, nginx can walk through it to site without being able to list the deploy user's other files:
chmod 711 /home/deploy
chmod 755 /home/deploy/site
find /home/deploy/site -type f -exec chmod 644 {} +
sudo -u www-data cat /home/deploy/site/index.html # test it
Every directory on the path needs at least x for the server's user. namei -l /home/deploy/site/index.html prints the mode of each step, which makes the blocked one easy to spot.
A tighter alternative is chmod 750 on the home directory with the web server's user added to the deploy user's group, so only that group can pass through rather than every account on the machine.
On a file
On a file, 711 means everyone can execute it but only the owner can read it. That works for compiled binaries, since the kernel loads them without the user needing read access. It does not work for scripts: a shell, Python or PHP script must be read by its interpreter, which runs as the calling user, so others get "Permission denied". Use chmod 755 for scripts others should run.
Don't count on 711 to keep a binary secret, either. Anyone who can run it can still observe what it does.
Hidden is not protected
711 hides names, not files. If someone guesses or learns a path (~/.bash_history, ~/backup.sql), they can open it if the file itself is readable to others. Keep private files at chmod 600 even inside a 711 directory, and don't rely on obscure names.
Recursive pitfalls
Never run chmod -R 711 on a tree. Every file would become unreadable to others and executable by everyone, which breaks web content and makes data files look like programs. Apply 711 only to the specific directories that need it.
Related modes
- chmod 700: nobody else can pass through.
- chmod 750: only the group can enter and list.
- chmod 755: everyone can enter and list.
Toggle the read and execute bits in the chmod calculator to see the difference.