How macOS actually works
The rwxr-xr-x string is less cryptic than it looks, and understanding it fixes most 'permission denied' moments.
-rwxr-xr-x
- file, d directory, l symlinkr read, w write, x execute (or, for folders, "enter")So rwxr-xr-x = owner can do everything; group and others can read and enter but not change.
Each group is a digit, summing r=4, w=2, x=1:
755 = rwxr-xr-x (owner full, others read+enter) — the normal folder644 = rw-r--r-- (owner read/write, others read) — the normal file700 = private to you777 = everyone can do anything — almost always a mistakechmod u+w file # give yourself write
chmod 644 file # standard file
chmod 755 folder # standard folder
chmod -R u+rw folder # fix a whole tree you own
sudo chown -R "$(whoami)" folder # take ownership after a migration
A folder needs x (execute) to be entered, even just to list it — which is why 644 on a folder locks you out and 755 is the folder norm. Apply the two correctly across a tree:
find folder -type d -exec chmod 755 {} \;
find folder -type f -exec chmod 644 {} \;
Two things masquerade as permission problems: SIP (system paths, unfixable by design) and TCC/Full Disk Access (personal data, fixed by granting the app access, not by chmod). If chmod does not help, it is probably one of those — the permissions article and the Full Disk Access article cover each.
Owner can read, write and execute; group and everyone can read and execute (enter, for folders) but not write. The standard folder permission.
Folders need execute (x) to be entered. 644 works for a file but locks a folder; 755 is the folder equivalent.
Everywhere keeps track of every file on your Mac — including the folders Spotlight hides and drives you have unplugged. Free for a day, then $19 once.
Download for Mac