How Linux and Unix file permissions work
Every file and directory on Linux, macOS and other Unix systems carries a set of mode bits. Nine of them say who may do what. There are three classes of users: the owner of the file, the other members of the file's group, and everyone else, called others. Each class gets three permissions: read, write and execute. That makes nine yes or no answers, and the chmod command is how you set them.
The octal notation packs one class into one digit. Read is worth 4, write 2 and execute 1, and you add up the ones you want. Read and write is 4 + 2 = 6, read and execute is 4 + 1 = 5, all three is 7 and none is 0. Three digits in a row then give owner, group and others, so 644 means the owner can read and write while the group and others can only read. This chmod calculator does the sum both ways and keeps the checkboxes, the octal number and the symbolic form in step.
| Permission | On a file | On a directory |
|---|---|---|
| Read (r, 4) | Read the contents | List the names of the entries in it |
| Write (w, 2) | Change the contents | Create and remove entries in it |
| Execute (x, 1) | Run it as a program | Access the files in it, also called search |
The directory column surprises people. Deleting a file is a change to its directory, not to the file itself, so the GNU coreutils manual points out that other users could still remove a file they cannot read if they have write permission on the directory it is in. And a directory with read but no execute lets you see the names inside without being able to open any of the files.
Reading ls -l output
The ls -l command shows the same bits as ten characters, such as -rwxr-xr-x. The first character is the file type: - for a regular file, d for a directory and l for a symbolic link, among others. Then come three groups of three for owner, group and others, each in the order r, w, x, with a hyphen for a permission that is missing. POSIX allows one more character after the ten when a file has an alternate or additional access control method, such as an access control list, and encourages + for it. The Symbolic field above accepts the string with or without the type letter and with a trailing + or @.
| Octal | ls -l | Symbolic chmod |
|---|---|---|
| 644 | rw-r--r-- | u=rw,go=r |
| 755 | rwxr-xr-x | u=rwx,go=rx |
| 600 | rw------- | u=rw,go= |
| 700 | rwx------ | u=rwx,go= |
| 775 | rwxrwxr-x | ug=rwx,o=rx |
| 4755 | rwsr-xr-x | u=rwxs,go=rx |
| 1777 | rwxrwxrwt | ug=rwx,o=rwxt |
Setuid, setgid and the sticky bit
Three more bits form an optional first digit: setuid is 4, setgid is 2 and the sticky bit is 1, so 4755 is 755 with setuid. ls -l shows them in the execute slots. Per POSIX, an s in the owner or group slot means the special bit is set and that class may execute; a capital S means the bit is set but execute is not. In the others slot, t and T do the same for the sticky bit.
- Setuid on a program makes it run with the user ID of the file's owner, whoever starts it. The GNU manual notes that only a few systems give it a meaning on directories.
- Setgid on a program makes it run with the file's group ID. On a directory, on most systems, new files inside get the directory's group, and new subdirectories inherit the setgid bit. That makes 2775 handy for a folder a team shares.
- Sticky on a directory stops unprivileged users from removing or renaming a file in it unless they own the file or the directory. The GNU manual names world-writable directories like /tmp as the usual place for it, which is mode 1777. POSIX leaves the effect of the sticky bit on other kinds of files unspecified.
Directories have one GNU quirk. GNU chmod keeps a directory's setuid and setgid bits when a numeric mode of up to four digits leaves them out, so chmod 755 on a 2775 folder gives 2755. To clear them, name them (chmod g-s), use an operator mode like chmod =755, or give five digits like chmod 00755. POSIX lets each system decide here, so portable scripts should not count on either result. Pick Directory above and the calculator applies the GNU rule in Apply a change.
Symbolic changes: u+x, go-w and friends
A numeric mode sets all bits at once. A symbolic mode changes only what you name, which is often what you want. It has three parts: who (u for the owner, g for the group, o for others, a for all three), an operator (+ adds, - removes, = sets exactly) and the permissions (r, w, x, s, t). chmod u+x script.sh makes a script runnable for its owner, chmod go-w file takes write access away from everyone but the owner, and several changes can be joined with commas, like u+x,g-w. To run such a script on a schedule, build the timing with the cron expression builder.
- X (capital) sets execute only on directories and on files that already have an execute bit for someone. chmod -R u=rwX,go=rX folder gives every directory 755 and every file 644, except files that someone could already execute, which get 755.
- Copying works too: g=u gives the group the same rights as the owner.
- Without who, as in +x, POSIX says chmod skips the bits that are set in your umask. With a umask of 022, chmod +x gives execute to all, but chmod +w only to the owner.
- Numbers after an operator, like +440 or =644, are a GNU extension that adds, removes or sets bits by their octal value.
Type any of these into Apply a change to see the result before you run it. Pasting a whole command, such as sudo chmod -R 750 /srv/app, works too; the calculator reads the mode and ignores the options and file names. To turn other numbers into octal, the number base converter converts between binary, octal, decimal and hex.
How to use the chmod calculator
- 1Choose File or Directory, then tick the boxes, type an octal mode like 644, or paste a symbolic string like rw-r--r-- from ls -l.
- 2Read the octal number, the ls -l string and what each class may do. Notes warn about risky settings such as world-writable files.
- 3Copy the numeric or the symbolic chmod command, or try a change like u+x,g-w under Apply a change before running it on your system.
Frequently asked questions
What does chmod 755 mean?
Each digit is one class of users: owner, group and others. A digit adds read (4), write (2) and execute (1), so 7 is read, write and execute and 5 is read and execute. chmod 755 lets the owner do everything and everyone else read and run the file or enter the directory. ls -l shows it as rwxr-xr-x, and the symbolic form is u=rwx,go=rx.
What is the difference between 644 and 755?
Only the execute bits. 644 (rw-r--r--) lets the owner read and write and everyone else read. 755 (rwxr-xr-x) adds execute for all three classes, which a program or script needs to run and a directory needs so that people can reach the files inside it.
What permissions should an SSH key have?
The OpenSSH ssh(1) manual says a private key such as ~/.ssh/id_ed25519 should be readable by you and not accessible by others, and that ssh ignores a private key file that others can access. chmod 600 does that (400 works too). For the ~/.ssh directory it recommends read, write and execute for you only, which is 700, and for authorized_keys read and write for you only, which is 600.
Is chmod 777 safe?
Rarely. 777 gives every user on the system read, write and execute. Anyone can change or empty the file, and in a directory anyone can create, delete and rename entries, including other people's files unless the sticky bit is set. Give write access only to the owner or the group that needs it, for example 755 or 775.
What do s, S, t and T mean in ls -l?
They show the special bits in the execute position. A lowercase s in the owner or group slot means setuid or setgid is set and that class can also execute; a capital S means the special bit is set without execute. In the others slot, t means the sticky bit is set with execute for others, and T means sticky without it.
What is the fourth digit, as in 0755 or 4755?
An optional first digit holds the special bits: 4 for setuid, 2 for setgid and 1 for the sticky bit. 0755 is the same as 755. GNU chmod reads every numeric mode as octal, so the leading 0 is not required, and it treats a mode with five or more digits, such as 00755, specially on directories.
Why did chmod +w not give write access to everyone?
Without u, g, o or a in front, POSIX says chmod leaves alone the bits that are set in your umask. With a umask of 022, chmod +w only adds write for the owner. Write a+w to change all three classes. The Apply a change box uses your umask setting for this case.