chmod 750: owner full access, group read-only, others locked out

What chmod 750 means

In 750 the first digit is the owner, the second the group and the third everyone else: the owner gets read, write and execute, the group gets read and execute, and others get no access at all.

ls -l shows -rwxr-x---. The trailing 0 is what sets it apart from 755: the "everyone else" class has no bits, so an unrelated account cannot list the directory, cannot traverse into it, and cannot read a file by its full path even if that file's own mode is world-readable.

Typical uses

750 fits a directory owned by a deploy user and read by a service group. A common layout is chown -R deploy:www-data /srv/app with directories at 750 and files at 640, so the web server can read the code but not change it, and other local users see nothing.

Home directories on multi-user hosts are another case. Several distributions now create homes at 750 or 700 rather than the older 755, so one user cannot browse another's files by default.

Pitfalls

The group is the whole design, so check it. If the directory's group is the owner's personal group, 750 behaves like 700 for everyone else. Use ls -ld to confirm the group, and id <user> to confirm the service account is actually a member; group changes only apply to new login sessions or restarted services.

Because others lose traverse permission, a 750 directory hides everything beneath it, regardless of the children's modes. That is useful, but it also breaks things that expected to reach a path inside, such as a static file server running as a user outside the group.

Related values

750 is 755 with the world removed. Its file counterpart is 640, which keeps the same owner-group-nobody shape without execute. If the group does not need to see the contents either, step down to 700. If the files inside only need the owner, pair the 750 directory with 600 files. A group that also needs to create files wants 770, usually with the setgid bit so new entries keep the group.