chmod / Unix Permissions Calculator

How chmod / Unix Permissions Calculator works

A Unix file mode is nine permission bits arranged as three groups of three: read, write and execute, granted separately to the file’s owner, to its group, and to everyone else. Within a group the bits are worth 4, 2 and 1, so each group collapses to one octal digit and the whole mode to three — 755 for rwxr-xr-x, 644 for rw-r--r--. The kernel checks the groups in order and stops at the first that applies, which means an owner denied write cannot fall back to the more generous permission the group bits offer.

Execute means two unrelated things depending on what it is set on. On a regular file it permits running the file as a program. On a directory it permits traversal — resolving a name through that directory to reach what is beyond it — while READ on a directory is what permits listing the names inside. The two are genuinely independent, so a directory with read but not execute lists its contents and lets you open none of them, and a directory with execute but not read lets you open a file whose exact name you already know while ls returns nothing.

A fourth leading digit carries three special bits: setuid at 4, setgid at 2, and sticky at 1. They are displayed in the execute column rather than in one of their own, as s, s and t. When the underlying execute bit is off the letter is shown uppercase — S or T — which almost always marks a mistake, because a setuid bit on a file nobody may execute does nothing at all. Sticky on a directory is what makes /tmp workable at mode 1777: anyone may create a file there, but only a file’s owner may delete it.

umask is not a permission. It is a mask of bits to strip from whatever a program requests at creation time, and the requests are fixed: 666 for a regular file and 777 for a directory. That asymmetry is why a freshly created file is never executable no matter which umask is set — the execute bit was never in the request for the mask to preserve. The common umask 022 therefore yields 644 files and 755 directories, and the stricter 027 yields 640 and 750.

Reference

read = 4, write = 2, execute = 1 — summed within each class
mode = special owner group other, e.g. 2775
setuid 4000 · setgid 2000 · sticky 1000
new file mode = 666 AND NOT umask
new directory mode = 777 AND NOT umask

How to use this calculator

Set the bits whichever way suits

Tick the nine checkboxes, type the octal digits, or paste the symbolic string from an ls listing. All three views describe one mode and stay in step with each other.

Add the special bits if they apply

Setuid, setgid and sticky occupy a fourth leading digit and land in the execute columns as s or t — uppercase where the matching execute bit is off, which is the shape worth double-checking.

Take the command

Copy the ready-made chmod invocation, or the ls -l line the mode produces, for pasting into a script, a Dockerfile, or a review comment that needs to show the before and after.

Work backwards from a umask

Enter a umask value to see the file and directory modes it produces, or a wanted default mode to see which umask yields it.

Worked examples

A configuration file

Given: Owner reads and writes, everyone else reads
Result: 644 — rw-r--r--

The default for most files created under umask 022. Nothing is executable, which is correct: a config file that the shell would run is a config file with a problem.

The shared temp directory

Given: World-writable, but nobody may remove another user’s files
Result: 1777 — rwxrwxrwt

The trailing t is the sticky bit. Without it, any user could delete any other user’s files in /tmp, which is precisely the attack it was introduced to close.

A tighter default

Given: umask 027
Result: Files created 640, directories created 750

Group members read, others get nothing. The directory keeps its execute bits because the request it is masked against is 777 rather than 666.

A setuid bit doing nothing

Given: Mode 4644 on a file
Result: rwSr--r-- — the S is uppercase

Setuid is set but owner execute is not, so the bit has no effect. The capital letter is the display telling you the combination is incoherent.

Symbolic change applied to a mode

Given: Starting at 755, apply go-w,o-rx
Result: 750 — rwxr-x---

Symbolic changes are relative. The same go-w,o-rx applied to 644 gives 640, which is why scripts that must land on an exact mode should state it numerically.

When to use it

Fixing an SSH key or a private certificate that the client refuses to use because the mode is too permissive.

Choosing the mode for a directory shared by a service account and a deploy user without opening it to everything else.

Reading a mode out of an ls -l listing during a permissions incident and seeing at once which class is being denied.

Setting a umask in a Dockerfile or a systemd unit so that files a service writes are not world-readable.

Explaining in a code review why a proposed 777 is never the fix that the error message seems to be asking for.

Things to watch out for

Permission classes are checked in order and the first match wins. An owner with mode 400 cannot write to their own file even when the group bits allow it, because the group bits are never reached.

Removing execute from a directory blocks access to everything beneath it, however permissive those files are. Path resolution has to traverse every directory in the path.

Setuid on a shell script is ignored by every modern kernel. The bit only takes effect on compiled binaries, so a script that appears to need it needs sudo rules instead.

umask is inherited per process, not stored per directory. A file’s mode depends on the umask of whatever created it, which is why the same deploy produces different modes under a shell and under a service manager.

Access control lists and mandatory access control sit on top of these bits. A mode that looks correct can still be overridden by an ACL entry or an SELinux label that the octal digits say nothing about.

Frequently asked questions

What does chmod 755 actually grant?

The owner may read, write and execute; group members and everyone else may read and execute but not write. It is the usual mode for directories and for programs, since both need the execute bit to be reachable or runnable.

Why is a new file never executable?

Because the mode a program requests when creating a regular file is 666, which contains no execute bits for the umask to preserve. Directories are requested at 777, so their execute bits survive and traversal keeps working.

What does the sticky bit do?

On a directory it restricts deletion and renaming to the owner of each file, regardless of who may write to the directory itself. That is what allows /tmp to be world-writable at mode 1777 without users being able to remove each other’s files.

Why does ls show a capital S instead of s?

The setuid or setgid bit is set while the corresponding execute bit is not. Uppercase marks the combination as inert — the special bit cannot take effect on something that may not be executed — and it usually indicates a mode applied in the wrong order.

Is chmod 777 ever the right answer?

Almost never outside a throwaway container. It grants write access to every account on the machine, including any service that gets compromised, and it usually masks a wrong owner or a missing group rather than fixing an actual permission problem.

What is the difference between chmod 755 and chmod u=rwx,go=rx?

Nothing in the result — the symbolic form with = assigns absolutely, so it lands on the same mode. Forms using + or - are relative to whatever the file already has, and those do depend on the starting mode.

umask