Chmod Calculator

How Linux file permissions work

Every file and directory on Linux, macOS and other Unix-like systems has an owner, a group, and three sets of permissions: one for the owner (user, u), one for members of the file's group (g), and one for everyone else, the others (o). Each set has three switches:

• Read (r): view the contents of a file, or list the names in a directory.
• Write (w): change a file, or create, rename and delete entries inside a directory.
• Execute (x): run a file as a program or script, or enter a directory (cd into it and reach the files inside). A directory with r but no x lets you see names but not open anything.

The kernel checks only one set: if you own the file, the owner bits apply; otherwise if you are in its group, the group bits apply; otherwise the others bits. So chmod 707 really does lock group members out even though "everyone" has access.

Octal notation: the maths behind 755

Each permission has a value: read = 4, write = 2, execute = 1. Add the values you want to get one digit from 0 to 7 per set, then write the three digits in owner, group, others order.

  owner     group     others
  r w x     r - x     r - x
  4+2+1     4+0+1     4+0+1
    7         5         5      →  chmod 755

So 6 is read + write, 5 is read + execute, 4 is read only and 0 is nothing. In ls -l output the same thing is written as ten characters, for example -rwxr-xr-x: the first character is the type (- file, d directory, l symlink) and the next nine are the three sets.

Special bits: setuid, setgid and sticky

An optional fourth digit goes in front of the other three and is built the same way: setuid = 4, setgid = 2, sticky = 1.

• setuid (4xxx): an executable runs with the permissions of the file's owner instead of the user who started it. /usr/bin/passwd is 4755 owned by root so ordinary users can update the password database. Shown as s in the owner execute position, or a capital S if execute is not set (which is almost always a mistake).
• setgid (2xxx): on an executable, it runs with the file's group. On a directory it is much more common: new files created inside inherit the directory's group, which makes shared team folders work (chmod 2775 /srv/project). Shown as s/S in the group execute position.
• sticky (1xxx): on a directory, users can only delete or rename files they own, even if the directory is world-writable. This is why /tmp is 1777 (drwxrwxrwt). Shown as t/T in the others execute position.

Note that GNU chmod does not clear setuid/setgid on directories when you give a 3-digit mode, so chmod 755 dir leaves an existing setgid bit in place. Use chmod g-s dir or a 5-digit mode such as chmod 00755 dir to remove it.

Symbolic mode: u, g, o, a with +, - and =

Instead of a number you can describe a change: who (u, g, o or a for all), an operator (+ add, - remove, = set exactly) and the permissions. Clauses are separated by commas. chmod u+x script.sh makes a script executable for you without touching anything else, chmod go-w file removes write access for group and others, and chmod u=rwx,g=rx,o= dir is the same as chmod 750 dir. Symbolic changes are relative, which is handy when you don't know or care about the current mode. (If you leave out the "who" part, real chmod applies the change to all three sets but respects your umask; this calculator treats it as a.)

What is umask?

The umask is a mask of permissions that are removed from newly created files and directories. Programs usually create files with 666 (no execute) and directories with 777, and the kernel clears every bit that is set in the umask. With the common umask 022, new files become 644 and new directories 755: write access is taken away from group and others. A umask of 077 makes everything private (600 / 700). It is a bitwise mask, not subtraction, so umask 033 gives files 644, not 633.

Common mistakes

• SSH keys with loose permissions. OpenSSH refuses to use a private key that others can read and prints "UNPROTECTED PRIVATE KEY FILE". Use chmod 600 ~/.ssh/id_ed25519 (or 400, as AWS suggests for a downloaded .pem key pair), chmod 700 ~/.ssh, and 644 or 600 for ~/.ssh/authorized_keys. Your home directory must not be group or world writable either.
• Reaching for chmod 777. It lets every user and every compromised service on the machine modify or replace the file, which on a web server can mean an attacker uploading and running code. If a web app cannot write to a folder, fix the owner or group (chown/chgrp) and use 775 or 770 instead.
• Recursive chmod on mixed trees. chmod -R 644 site/ removes execute from directories, so nobody can enter them. Use capital X (chmod -R u=rwX,go=rX site/) to add execute only to directories and files that are already executable, or find site -type d -exec chmod 755 {} + and find site -type f -exec chmod 644 {} +.
• Forgetting the execute bit on scripts. "Permission denied" when running ./deploy.sh usually just needs chmod +x deploy.sh.
• Expecting chmod to work on every file system. FAT/exFAT drives, many network shares and some container volumes ignore Unix permissions; the mode is decided by mount options instead.