chmod 711 — what does it mean?
711 is a subtle mode. On a directory, execute without read means 'you may pass through, but you may not look': other users cannot list the contents, but they can open a file inside it if they know its exact name and the file's own permissions allow it. That makes it a neat fit for home directories that must expose ~/public_html to a web server. On a compiled binary, 711 lets others run it without being able to copy or read it.
711
rwx--x--x
The owner has full access; the group and other users can only execute: run a binary, or pass through a directory to a path they already know.
Symbolic equivalent: chmod u=rwx,g=x,o=x /home/alice
What each digit in 711 means
Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.
| Class | Digit | Sum | r w x | ls -l |
|---|---|---|---|---|
| Owner (u) | 7 | 4 + 2 + 1 | rwx | rwx |
| Group (g) | 1 | 0 + 0 + 1 | --x | --x |
| Others (o) | 1 | 0 + 0 + 1 | --x | --x |
- Owner: can list the names of entries, create, rename and delete entries and enter the directory and open files by name.
- Group: can enter the directory and open files by name; no read or write.
- Others: can enter the directory and open files by name; no read or write.
When to use chmod 711
- Home directories that serve ~/public_html (Apache userdir): the web server can reach /home/alice/public_html but cannot list /home/alice.
- Directories that act as a known-path drop point, where you hand out exact file paths but do not want the directory listable.
- Compiled binaries that others should be able to run but not read or copy. Some distributions historically shipped sudo as 4111 for the same reason.
Security risks and gotchas
Scripts at 711 do not run for others
A shell, Python or Node script must be read by its interpreter, so for group and others a 711 script fails with 'Permission denied'. 711 only works as an executable mode for compiled binaries. Use 755 for scripts.
Hidden is not private
Anyone who can guess a name, such as .bashrc, .ssh/authorized_keys or public_html, can still reach it through a 711 directory if the file itself is readable. Keep sensitive files at 600 and sensitive subdirectories at 700.
Commands
Traverse-only home directory
chmod 711 /home/aliceEquivalent to chmod u=rwx,go=x /home/alice.
Expose ~/public_html through it
chmod 711 ~
chmod 755 ~/public_html
find ~/public_html -type f -exec chmod 644 {} +The web server can enter ~ (but not list it), list public_html, and read the files.
Check that listing is blocked
sudo -u www-data ls /home/aliceShould fail with 'Permission denied', while sudo -u www-data cat /home/alice/public_html/index.html succeeds.
How to check for 711
# Symbolic view
ls -ld /home/alice
drwx--x--x 14 alice alice 4096 Oct 16 09:12 /home/alice
# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' /home/alice
711 drwx--x--x /home/alice
# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' /home/aliceThe first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.
Related chmod modes
700rwx------
Owner full access, nobody else
755rwxr-xr-x
Owner full access, everyone else read and execute
750rwxr-x---
Owner full access, group read and execute, others none
4755rwsr-xr-x
setuid: runs as the file's owner
Try variations of 711 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.
Frequently Asked Questions
What does execute permission mean on a directory?▾
It is the search or traverse permission: the right to access entries inside the directory by name, cd into it and use it in a path. Read is the separate right to list the names. 711 grants the first to everyone and the second only to the owner.
Is chmod 711 secure for a home directory?▾
It is tighter than 755, because other users cannot list your files, and looser than 700, because they can open any file whose name they know and whose own permissions allow it. Use 700 if nothing outside needs to reach into it.
Why can't others run my 711 script?▾
Running a script means the interpreter (bash, python) opens and reads the file as the calling user. Without read permission it cannot. Compiled binaries are loaded by the kernel and only need execute.