Three tabs for Unix file permissions:
- Calculator. Tick read, write and execute for the owner, the group and everyone else, or type an octal mode (
755, 2775) or the symbolic form shown by ls -l (rwxr-xr-x, -rw-r--r--, drwsr-x---). All three stay in sync, and the result shows the four-digit mode, what ls -l would print, ready-to-copy chmod commands in both forms, and what each class can actually do, for a file or a directory. - umask. Type a umask such as
022 or 027 and see the permissions new files and new directories get, and the umask -S form. - Apply chmod. Start from a mode, type a symbolic expression such as
u+x,go-w, a=rX or g=u, and see the result after each clause.
Reading the numbers without memorising
Each digit is one class: owner, group, others. Inside a digit, read is 4, write is 2 and execute is 1, and you add them: 7 = 4+2+1 = rwx, 6 = 4+2 = rw-, 5 = 4+1 = r-x, 4 = r--, 0 = ---. So 755 is rwx for the owner and r-x for everyone else, the usual mode for programs and directories, and 644 is rw- for the owner and r-- for the rest, the usual mode for documents and web pages. 600 keeps a file private, which is what SSH expects for a private key.
A fourth digit in front holds the special bits: setuid is 4, setgid is 2, sticky is 1. 4755 is a setuid program such as passwd; 1777 is /tmp, writable by everyone but where only the owner of a file can delete it; 2775 on a shared directory makes new files inherit its group. In ls -l they replace the x: s or t when the x bit is also set, a capital S or T when it is not, which usually means a mistake.
Files and directories differ
For a file, r means read the contents, w means change them and x means run it as a program. For a directory, r means list the names, x means enter it and reach what is inside by name, and w means create, rename and delete entries, which also needs x. A directory with r-- lets you see names but not open anything; one with --x lets you open a file whose name you already know. Deleting a file depends on the directory's permissions, not the file's.
umask and symbolic chmod
Programs create files asking for 666 and directories asking for 777; the umask removes bits from that. A umask of 022 gives 644 files and 755 directories, 027 gives 640 and 750, and 077 keeps everything private. A umask never adds execute to a new file, which is why a freshly written script needs chmod +x.
In symbolic expressions, u, g, o and a pick the classes, +, - and = add, remove or set, and X adds execute only to directories and to files that already have an execute bit, which makes chmod -R a+rX safe for a tree of documents. g=u copies the owner's bits to the group. Without u, g, o or a, chmod leaves alone the bits your umask blocks: with umask 022, chmod +w only adds write for the owner. The = operator clears setuid with u, setgid with g and the sticky bit with o, as GNU chmod on Linux does; macOS and BSD chmod keep the sticky bit on o=.
For a worked explanation with common mistakes, read reading chmod numbers and umask without memorising. To convert other bases, use the number base converter.
