chmod Permission Calculator

Read is 4, write is 2, execute is 1, and the three digits of a mode are owner, group and others in that order. So 7 is 4+2+1 and 5 is 4+1, which makes 755 mean the owner can do everything and everyone else can read and execute. Everything on this page is that arithmetic in both directions, plus the two things the arithmetic leaves out.

The first thing it leaves out: directories read differently

The same three bits mean something else on a directory. Read lists the names inside. Write creates, renames and deletes entries — which means write on a directory lets you delete a file inside it that you cannot write to. Execute means traverse: enter the directory and reach entries by name. A directory with read and no execute gives you a list of names you cannot open, which is the most common source of a permission error that looks impossible.

The second: the fourth digit

setuid (4), setgid (2) and the sticky bit (1) sit in a leading digit and overwrite the execute position in symbolic notation. rwsr-xr-x is setuid with execute; rwSr-xr-x is setuid without it, and the capital letter almost always means someone set a bit on something that cannot run. A setuid binary runs with its owner’s privileges rather than the caller’s, so every one on a system is a privilege boundary worth knowing about deliberately.

Why this page describes rather than scores

A mode is only right or wrong relative to what the file is for. 777 on a scratch path inside a container is unremarkable; on anything a privileged process reads it means any account on the machine can change what that process runs. So each observation says what the bits permit and leaves the judgement where it belongs.

644 is rw-r--r--: the ordinary mode for a file. 600 is what an SSH private key needs — OpenSSH refuses a key any other account can read. 1777 is rwxrwxrwt, the mode of /tmp, where the sticky bit is what stops one user deleting another’s files in a directory everyone can write to. Paste -rw-r----- 1 root adm 4096 auth.log and only the first field is read.