CHMOD Permissions Calculator
Unix permissions are three sets of three bits, expressed as three octal digits. The arithmetic is simple. What catches people out is that the same bits mean quite different things on a file and on a directory.
How to use it
- Tick read, write, and execute for owner, group, and others.
- The octal value updates as you go.
- Use it with chmod. Nothing is transmitted.
The arithmetic
Read is 4, write is 2, execute is 1. Each digit is the sum of the permissions granted to one class, and the three digits are owner, group, and everyone else in that order.
So 7 is read, write, and execute. 6 is read and write. 5 is read and execute. The familiar values follow directly: 644 gives the owner read and write while everyone else reads only, and 755 adds execute for everyone, which is what a directory or a program needs.
On a directory, the bits mean something else entirely
This is the part that causes real confusion, and it explains most permission problems that look inexplicable.
Read on a directory means you can list its contents. Execute means you can traverse it, that is, access something inside it by name. Write means you can create and delete entries within it.
Two consequences follow that surprise people. A directory with read but not execute lets you see filenames and nothing else; you cannot open any of them, and even stat fails. A directory with execute but not read lets you open a file inside it if you already know its exact name, but you cannot list what is there. That combination is a real technique for semi-private directories.
The third consequence is the important one: write permission on a directory lets you delete any file inside it regardless of that file own permissions. Deleting is modifying the directory, not the file. This is why a read-only file in a world-writable directory is not protected, and why the sticky bit exists.
The fourth digit
A leading digit sets three special bits, using the same 4-2-1 scheme.
What each one does:
- Setuid, value 4. An executable with this bit runs as its owner rather than the invoking user. It is how passwd lets an ordinary user modify the shadow file, and it is a large share of local privilege escalation vulnerabilities. Never set it on a script; most systems ignore it there precisely because it cannot be made safe.
- Setgid, value 2. On an executable it works like setuid for the group. On a directory it is far more useful: new files inherit the directory group rather than the creating user primary group, which is the standard way to make a shared project directory work.
- Sticky, value 1. On a directory it restricts deletion to the file owner, the directory owner, and root. This is what makes /tmp usable, and it is why /tmp is 1777 rather than 777.
Why 777 is almost never the answer
Setting 777 is what people try when something does not work, and it does often make the symptom go away, which is why the habit persists. It also grants write access to every user and every process on the machine, including anything an attacker manages to run.
For a web application the correct permissions are usually narrower than they first appear. Application code should be readable by the web server and not writable by it, typically 644 with directories at 755. An upload directory needs to be writable by the web server user and should not be executable as code, which is enforced by web server configuration rather than by the permission bits. Configuration files containing credentials should be 600 and owned by the account that reads them.
When 777 appears to be the only thing that works, the actual problem is nearly always ownership rather than permissions. Fixing the owner with chown is the correct repair.
One more thing that catches people: umask. A new file is created with its requested permissions masked by the process umask, commonly 022, which strips group and other write. This is why a file you expected to be 666 arrives as 644.
At a glance
| Values | Read 4, write 2, execute 1 |
|---|---|
| Digit order | Owner, group, others |
| Special bits | Optional leading digit: setuid 4, setgid 2, sticky 1 |
| Transmitted | Nothing |
Frequently asked questions
What does execute mean on a directory?
Traversal. It lets you access entries inside by name. Read lets you list the names. A directory with read but no execute shows you filenames you cannot open.
Why can someone delete my read-only file?
Deletion modifies the directory, not the file, so it is governed by write permission on the directory. The sticky bit restricts deletion to the file owner, which is why /tmp is 1777.
Is 777 ever appropriate?
Essentially never. It grants write access to every process on the machine. When it appears to be the only thing that works, the real problem is usually file ownership, and chown is the fix.
Why did my new file not get the permissions I set?
The umask masked them. A typical umask of 022 strips group and other write from newly created files, so a requested 666 becomes 644.
Read more
Timestamps, permissions, subnets, and cron — Four operational primitives with unintuitive semantics, and the specific failures each one causes.