Chmod Calculator

What the digits mean

Permissions are written as three digits: owner, group, everyone else. Each digit is a sum of three values:

• 4 — read;
• 2 — write;
• 1 — execute.

So 6 means read plus write, 5 means read plus execute, and 7 means all of them. A digit never goes above 7, which is why a value like 788 does not exist.

A fourth digit in front sets the special bits: setuid is 4, setgid is 2, sticky is 1. You write it only when that bit is needed: 4755, 2775, 1777. A leading zero changes nothing, so 0644 and 644 mean the same thing.

Why ls -l sometimes shows a capital S

In an ls -l listing the special bits occupy the same spot as the execute permission. When execute is allowed, the letter is lowercase: rwsr-xr-x for setuid, rwxrwxrwt for sticky. When execute is not allowed, the letter is a capital: rwSr--r--, rwxrwxrwT. The capital form means the bit is set, but there is nothing to apply it to.

A permission means different things for a file and for a directory

For a file it is simple: read the contents, change them, run the file. For a directory, read shows the list of names, write allows creating and deleting files inside, and execute lets you go inside and open a file by its name. A directory without execute is useless: you can see the names, but the files stay unreachable.

Setgid on a directory works differently than on a file: new files inside get the directory's group instead of the primary group of whoever created them. That is how a shared folder that several people write to is kept working. Sticky is also about directories: only the file's owner can delete it from inside, and shared access to /tmp rests on this rule.

What chmod 755 will not remove from a directory

The chmod command keeps setuid and setgid on a directory if the mode you type does not mention them. So chmod 755 will not remove setgid from a shared folder: the bit stays where it was. To clear the bit, use chmod g-s or a five-digit mode, chmod 00755. This is GNU coreutils behavior, verified on chmod 9.4.

Permissions 777 give write access to everyone who gets onto the machine. A regular website file needs 644, a directory 755, and a key or a database password file 600.