How to calculate chmod permissions
- Tick the read, write and execute boxes for the owner, the group and everyone else. The octal number and the symbolic form update instantly.
- Or type an octal value such as
755, or a symbolic string such asrw-r--r--, and the boxes follow. - Add setuid, setgid or the sticky bit if you need them, which gives a four-digit mode such as
2775. - Copy the ready-made
chmodcommand, with-Rif you want to apply it to a whole directory.
How Unix permissions work
Every file on Linux, macOS and other Unix systems has three sets of permissions: for its owner, its group and others. Each set combines read (4), write (2) and execute (1), so a single digit from 0 to 7 describes one set. 7 is rwx, 6 is rw-, 5 is r-x and 4 is read only.
For directories, read lets you list the contents, write lets you create and delete files inside, and execute lets you enter the directory. That is why directories normally need the x bit (755) while plain files do not (644).
- 644: typical for web files and documents. The owner can edit, everyone can read.
- 755: typical for directories and scripts.
- 600 or 400: private files such as SSH keys. SSH refuses keys readable by others.
- 777: everyone can change the file. Avoid it, especially on web servers.
The special bits are setuid (4000), which runs a program as its owner; setgid (2000), which makes new files in a directory inherit its group; and sticky (1000), which stops users deleting each other's files in shared folders such as /tmp.
What does chmod 755 mean?
The owner can read, write and execute (7), while the group and others can read and execute (5). It is the usual setting for directories and programs.
Why is chmod 777 dangerous?
It lets any user or process on the machine modify or replace the file, which attackers can use to inject code. Give write access only to the owner or a specific group.
What is the difference between s and S in ls output?
Lower-case s means the setuid or setgid bit is set and the execute bit is also set. Upper-case S means the special bit is set without execute, which is usually a mistake.