Chmod Calculator

Three triads, three bits each

Every Unix file carries nine permission bits arranged as three groups of three. The first triad belongs to the file owner, the second to the file's group, and the third to everyone else on the system. Within each triad the bits mean read, write and execute, and they are worth 4, 2 and 1 respectively. Adding the values of the bits you want produces a single digit from 0 to 7, which is why permissions are traditionally written as three octal digits.

That is the whole trick behind a number like 755. The owner digit is 7, or 4 + 2 + 1, so the owner may read, write and execute. The group and other digits are both 5, or 4 + 1, so they may read and execute but not modify. Written symbolically the same value reads rwxr-xr-x, which is exactly what ls -l prints after the leading file-type character.

The three verbs mean something slightly different on a directory. Read lets you list the names inside it, write lets you create and delete entries, and execute lets you traverse into it to reach a path you already know. A directory with read but no execute is nearly useless: you can see the names but cannot open anything behind them.

The values you will actually type

A handful of combinations cover most real work. 644 (rw-r--r--) is the normal mode for a document or a source file: the owner edits it, everyone else reads it. 755 (rwxr-xr-x) is the normal mode for a directory or an executable script, because both need the execute bit to be usable at all. 600 (rw-------) keeps a file private to its owner, which is what OpenSSH insists on for private keys, and 700 does the same for a directory.

Modes that grant write access to others deserve a second look. 777 lets every account on the machine overwrite or delete the file, and it is almost never the right answer - it is simply the fastest way to make a permissions error disappear without understanding it. When a web server cannot write to an upload directory, the real fix is usually to change the owning user or group with chown, not to open the file to the world.

Permissions also interact with the umask. New files are created with a default mode reduced by the umask value, commonly 022, which is why a freshly created file tends to arrive as 644 rather than 666.

Setuid, setgid and the sticky bit

A fourth digit can sit in front of the three familiar ones, and it carries three special bits: setuid (4), setgid (2) and the sticky bit (1). They change who a program runs as and how a directory treats the files created inside it.

Setuid on an executable makes it run with the privileges of the file's owner rather than the user who launched it. This is how passwd can update a system-wide file while an unprivileged user runs it, and it is also why setuid binaries are audited so carefully - a bug in one is a direct route to the owner's privileges. Setgid does the same thing for the group. On a directory, setgid has a friendlier meaning: new files created inside inherit the directory's group, which keeps a shared project folder consistent no matter who writes to it.

The sticky bit is most familiar on /tmp, usually written 1777. It allows anyone to create files in the directory while restricting deletion to each file's own owner, so users cannot remove each other's temporary files. In a long listing these bits replace the execute character: an s in place of x means setuid or setgid is set, an uppercase S means the bit is set while execute is not, and t marks the sticky bit.