Calculate permissions
| Class | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | 7 | |||
| Group (g) | 5 | |||
| Others (o) | 5 |
Result
Octal: 755 Symbolic: rwxr-xr-x ls line: -rwxr-xr-x
Owner can read, write, and execute. Group can read and execute. Others can read and execute.
chmod 755 script.shchmod u=rwx,g=rx,o=rx script.shDecode an ls line
Paste one line from ls -l, for example -rw-r--r-- or drwxrwsr-x. The leading letter is the file type and is ignored. Letters s and t in execute positions set the matching special bit, and capital S and T mean the special bit is set without execute.
Umask defaults
Umask does not subtract in the usual arithmetic sense. It is a mask: each bit set in the mask is cleared from the starting mode. New files start at 666 and new directories start at 777, then the mask is applied with a bitwise AND NOT.
New file: 644 (rw-r--r--) New directory: 755 (rwxr-xr-x)
Umask 022 blocks write for group and others, so files stay readable and directories stay traversable.
| Umask | New file | New directory | Who else can read |
|---|---|---|---|
| 022 | 644 | 755 | Everyone |
| 027 | 640 | 750 | Group only |
| 077 | 600 | 700 | No one else |
Check the current mask in a shell with umask, and set it for one session with umask 027. A mask set in a shell affects only that shell and its children, not files that already exist.
How Linux permissions work
Every file has three classes. The owner is the user who owns the file. The group is the set of users in the file's group. Others means every other user on the system. Each class can read, write, and execute, or any combination of the three. Read, write, and execute mean different things for files and directories, which is the first thing people get wrong.
For a file, read lets you view its contents, write lets you change them, and execute lets you run it as a program. For a directory, read lets you list the names inside it, write lets you create, delete, and rename entries in it, and execute lets you pass through it to reach files inside, which is why a directory you can list but cannot enter is a common configuration mistake.
Each permission has a value: read is 4, write is 2, and execute is 1. Add the values for one class to get its digit. Read plus write plus execute is 7, read plus execute is 5, read plus write is 6, and no permission is 0. Put the owner, group, and others digits together, in that order, and you get the octal mode, such as 755 or 644.
Octal and symbolic form
The same mode can be written two ways. Octal uses the digits above, so 755 is one number. Symbolic spells out each class as three characters, so 755 is rwxr-xr-x: the first three characters are the owner, the next three are the group, and the last three are others. A dash means that permission is not granted. This is exactly what ls -l prints after the file type letter.
Use octal when you want to set everything at once, because one number replaces all nine bits. Use symbolic form when you want to change one bit without touching the rest. chmod u+x script.sh adds execute for the owner only. chmod go-w file removes write for group and others. chmod u=rw,go=r file sets the owner to read and write and everyone else to read only, which is the same end state as 644.
To convert by hand, split the nine characters into three groups and add each group with read as 4, write as 2, and execute as 1. For rwxr-xr-x, the owner group is 7, the group is 5, and others is 5, which gives 755. To go the other way, split 644 into 6, 4, and 4, then expand each digit back into its read, write, and execute bits to get rw-r--r--.
Special bits: setuid, setgid, and sticky
A fourth, leading digit controls three special bits. Setuid, value 4, runs an executable as its owner rather than as the user who started it. Setgid, value 2, runs an executable as its group, and on a directory it makes new files inside inherit the directory's group. The sticky bit, value 1, stops users from deleting each other's files in a shared directory, which is why /tmp is 1777.
In an ls -l line, these bits show up in the execute positions. An s in the owner execute position means setuid plus execute, and a capital S means setuid without execute. The same rule holds for setgid in the group position and for the sticky bit, which shows as t or capital T in the others execute position. So 4755 prints as -rwsr-xr-x, and 2775 prints as drwxrwsr-x for a directory.
Two cautions belong here. First, Linux ignores setuid on scripts in most configurations, so a setuid shell script does not gain the owner's rights the way a compiled binary does. Second, setuid combined with write access for group or others is a known bad combination: anyone who can write the file can replace what the owner's account will run. The calculator flags that combination above.
Common values
| Octal | Symbolic | Typical use |
|---|---|---|
| 644 | rw-r--r-- | Regular files: web pages, configs, documents |
| 755 | rwxr-xr-x | Directories, scripts, and executables |
| 600 | rw------- | SSH private keys, credentials, secrets |
| 700 | rwx------ | The .ssh directory and other private folders |
| 640 | rw-r----- | Readable by a group, but not by the rest of the world |
| 664 | rw-rw-r-- | Shared files a whole group needs to edit |
| 775 | rwxrwxr-x | Group-writable project directories |
| 750 | rwxr-x--- | Directories a group can use but others cannot enter |
| 1777 | rwxrwxrwt | Shared temp directories such as /tmp |
| 777 | rwxrwxrwx | Avoid: world-writable and a common security risk |
Eight values cover nearly everything you will set day to day. If a value is not in this table, work out what each class actually needs and build the number from those three digits, rather than copying a value from a forum post that solved a different problem.
Fix a permission error without reaching for 777
When a program reports permission denied, find which class the program runs as before changing anything. A web server usually runs as its own user, not as you, so a file owned by you with mode 600 is unreadable to it even though you can read it fine. The fix is usually ownership first, then a narrow mode: give the server's group read access with 640, or move the file into a directory the server can traverse with 755.
Recursive changes deserve the same care. chmod -R 755 directory makes every file inside executable, including documents and configs that should never run. chmod -R 644 directory has the opposite failure: it strips execute from directories, so nothing inside can be reached at all. The calculator above shows the split form when you tick recursive: one find command for directories and one for files, each with its own mode.
Ownership is the other half of the problem, and chmod cannot fix it. chown changes who owns a file, while chmod changes what can be done to it. So chown alice:developers app.log hands the file to user alice and group developers, by name rather than by number. It accepts the same recursive flag, and it normally needs sudo, since handing a file to another user is a privileged act.
Frequently asked questions
What does chmod 755 mean?
The owner can read, write, and execute (7), and the group and others can read and execute but not write (5 and 5). In symbolic form that is rwxr-xr-x. It is the standard mode for directories, scripts, and executables.
What is the difference between chmod 644 and 755?
Both give the owner read and write and give the group and others read access. The difference is the execute bit: 755 adds execute for everyone, so it fits directories and runnable scripts, while 644 has no execute bit and fits regular files such as documents, configs, and web pages.
How do I convert rwxr-xr-x to a number?
Split the nine characters into three groups of three, one each for owner, group, and others, then add read as 4, write as 2, and execute as 1, counting a dash as zero. For rwxr-xr-x that is rwx equals 7, r-x equals 5, and r-x equals 5, which gives 755.
What permission should I use for an SSH private key?
Use 600 (rw-------) so only the owner can read or write it, and set the .ssh directory itself to 700. OpenSSH refuses to use a private key that the group or others can read.
Is chmod 777 safe?
No. It lets every user and process on the system read, write, and execute the file, which means anyone can replace it. It is almost never the right fix for a permission error. Use the narrowest mode that works, usually 644 for files or 755 for directories and scripts.
Why is chmod -R 755 risky for a folder of files?
The recursive flag applies one mode to everything inside, so regular files also get the execute bit. That is harmless for scripts but wrong for documents and configs. Use find to set directories and files separately: directories to 755 and regular files to 644.
What does umask 022 mean?
Umask is a mask that blocks permission bits from new files and directories. With umask 022, new files get 644 and new directories get 755, because the mask removes write for group and others from the starting modes of 666 for files and 777 for directories.
Sources
- GNU coreutils, chmod invocation: https://www.gnu.org/software/coreutils/manual/html_node/chmod-invocation.html (numeric and symbolic modes, recursive operation, and the setuid, setgid, and sticky bits).
- GNU coreutils, ls invocation: https://www.gnu.org/software/coreutils/manual/html_node/ls-invocation.html (how the long listing prints file type and permission letters, including s, S, t, and T).
- OpenSSH, sshd manual page on key file permissions: https://man.openbsd.org/sshd.8 (why a private key readable by others is refused).
- Linux man-pages, umask: https://man7.org/linux/man-pages/man2/umask.2.html (how the file mode creation mask is applied to new files and directories).
This page is an independent tool, not affiliated with GNU, OpenSSH, or any Linux distribution. Modes shown here follow POSIX and GNU coreutils behaviour; some systems, including macOS access control lists, add rules on top of these nine bits.
Agents
Machine readable summary for AI assistants: