Read chmod numbers and umask without memorising

Unix permissions look like a code you have to memorise: 755, 644, 600, 777. They are not. Every mode is built from three numbers (4, 2 and 1) added together three times, and once you see that, you can read any mode, write the one you need, and predict what a umask will do. This article works through the arithmetic with real examples, explains the part that surprises people (directories), and lists the mistakes that cause most permission problems. Every result can be checked in the chmod calculator.

Three classes, three bits each

A file has an owner and a group. Permissions are set for three classes of user: the owner (u), members of the group (g), and everyone else (o, "others"). Each class gets three switches:

Add the values of the switches that are on, and you get one digit from 0 to 7. Three digits, one per class, make the mode.

Worked example: 754. Owner 7 = 4+2+1 = rwx. Group 5 = 4+1 = r-x. Others 4 = r--. In ls -l that is -rwxr-xr--.

Going the other way: `rw-r-----`. Owner rw- = 4+2 = 6, group r-- = 4, others --- = 0, so the mode is 640. That is a sensible mode for a configuration file with a password in it, readable by a service's group and by nobody else.

The modes you meet most often follow directly:

• 755 (rwxr-xr-x): programs, scripts and directories that everyone may use.
• 644 (rw-r--r--): ordinary files: documents, images, web pages.
• 600 (rw-------): private files. SSH refuses to use a private key that others can read.
• 700 (rwx------): a private directory, such as ~/.ssh.

Why octal? Because three bits are exactly one octal digit, which is why the numbers never contain an 8 or a 9.

The fourth digit: special bits

A mode can have a fourth digit in front, built the same way: setuid is 4, setgid is 2, sticky is 1.

• 4755: setuid. The program runs with its owner's rights instead of the caller's. passwd is setuid root so that ordinary users can change their own password entry.
• 2775 on a directory: setgid. New files created inside get the directory's group instead of the creator's main group, so a team folder stays owned by the team.
• 1777: sticky. /tmp is writable by everyone, but the sticky bit means only the owner of a file can delete or rename it.

ls -l shows these bits in the execute position: s (setuid or setgid) and t (sticky) when the execute bit is also on, and capital S or T when it is not. A capital letter on a file usually means someone set the special bit and forgot execute.

Directories are different

The same three letters mean different things for a directory, and this is the source of many "permission denied" puzzles:

• r lets you list the names in the directory.
• x lets you enter it and open things inside by name.
• w lets you create, rename and delete entries, and it only works together with x.

So a directory with r-- shows file names but you cannot open any of them; one with --x lets you open report.pdf if you know its name, without being able to list it. And deleting a file is an operation on the directory: you can delete a read-only file from a directory you can write to, and you cannot delete a writable file from a directory you cannot.

umask: subtraction, not a mode

When a program creates a file, it asks for 666 (rw for everyone); for a directory it asks for 777. The umask lists the bits to take away. Strictly it is a bitwise "and not", but for the usual values, subtracting digit by digit gives the same answer:

Subtraction fails when the umask removes a bit that was not there: umask 033 on a file gives 644, not 633, because 666 has no execute bits to remove. The calculator does the bitwise version. The table also shows why a new script is never executable: files start from 666, which has no x at all, so you need chmod +x.

Symbolic chmod

Instead of numbers you can say what to change: chmod u+x,go-w file adds execute for the owner and removes write from group and others, leaving everything else as it was. Starting from 644 (rw-r--r--), that gives 744 (rwxr--r--). Useful forms:

• chmod -R a+rX dir makes a whole tree readable. Capital X adds execute only to directories and to files that are already executable, so documents do not become programs.
• chmod g=u file copies the owner's permissions to the group.
• chmod o= file removes everything for others.

One subtlety: with no u, g, o or a, chmod respects your umask. With umask 022, chmod +w file adds write for the owner only, while chmod a+w file adds it for everyone.

Common mistakes

• Using 777 to fix a permission error. It works because it allows everything, including any process on a web server rewriting your code. The real fix is usually ownership: chown www-data:www-data or adding a user to the right group.
• `chmod -R 755` on a whole tree. It makes every file executable. Use a+rX or set files and directories separately with find -type f and find -type d.
• Forgetting the directory. A file with 644 inside a directory with 700 is still unreadable to others.
• Leading zeros in config files. In YAML 1.1, mode: 0644 is octal (420 in decimal), in YAML 1.2 it is the decimal number 644. Quote the value or write it the way the tool documents.
• Private keys with 644. SSH refuses keys that others can read; use 600.

Try it

Tick boxes or type a mode in the chmod calculator, switch to the umask tab to see what your default creates, and try an expression on the "Apply chmod" tab before running it on a server. For octal arithmetic in general, the number base converter shows any number in base 8.