// FREE IT TOOLS

Chmod Calculator

Convert between octal and symbolic Linux permissions, and see exactly what each bit allows.

// PERMISSION MODE

Type a mode, or build one with the grid below

Presets

// MODE BITS

	Owner	Group	Others
Read
Write
Execute

Special bits

Octal

755

Symbolic

-rwxr-xr-x

Decimal

493

// ON A FILE

Owner can read, write, and execute it. Group can read and execute it. Others can read and execute it.

// ON A DIRECTORY

Owner can list its contents, create, rename, and delete entries, and enter it (traverse). Group can list its contents and enter it (traverse). Others can list its contents and enter it (traverse).

// FIND FILES WITH THIS MODE

find . -perm 755 # exactly this mode

find . -perm -755 # all of these bits are set

find . -perm /755 # any of these bits are set

// UMASK CALCULATOR

umasknew files 644 · new directories 755

A umask removes bits from the maximum a new file can receive — 666 for files, 777 for directories. It never grants a bit, so a umask cannot make a file executable.

Apply this mode with chmod 755 path for a file or directory, or chmod -R 755 path to recurse.

Symbolic modifiers such as u+x or g-w are not supported here: they change a mode relative to an existing one, so they need a starting mode to apply against. Build the result you want in the grid, then use the octal value.

How Unix Permissions Work

Every file and directory on a Unix system carries a mode: twelve bits that describe who may do what with it. Nine of those bits form a three-by-three grid — three classes of user (the owner, the group, and others) crossed with three permissions (read, write, and execute). The remaining three are the special bits: setuid, setgid and sticky.

The familiar octal notation is just those nine bits grouped in threes, with each digit the sum of read (4), write (2) and execute (1) for one class. That is why the digits only ever run from 0 to 7 — and why chmod 8 is not a permission error but a syntax error.

Permissions are checked in order, and the first class that matches wins. If you are the file’s owner, the group and others bits are never consulted — even if they would grant more access. A file owned by you with mode 000 is unreadable by you even though others can read it.

Octal Modes at a Glance

These are the modes you will meet in practice. The octal value is what you pass to chmod.

Mode	Symbolic	Owner	Group	Others
644	-rw-r--r--	read, write	read	read
600	-rw-------	read, write	none	none
755	-rwxr-xr-x	read, write, execute	read, execute	read, execute
700	-rwx------	read, write, execute	none	none
2775	-rwxrwsr-x	read, write, execute	read, write, execute (setgid)	read, execute
1777	-rwxrwxrwt	read, write, execute	read, write, execute	read, write, execute (sticky)
4755	-rwsr-xr-x	setuid	read, execute	read, execute

Reading Symbolic Permissions

The ten-character string that ls -l prints is a type character followed by the same nine bits: three for the owner, three for the group, three for everyone else. The leading character is - for a regular file, d for a directory, l for a symlink, and b, c, p or s for the special file types.

The detail most calculators get wrong: when a special bit lands on an execute position, the letter is lowercase only if the execute bit is also set. -rwsr-xr-x is setuid with execute and works. -rwSr--r-- is setuid without execute — the capital S is a warning sign, because the setuid bit is set on a file that cannot be run, so it accomplishes nothing. The same rule produces t versus T for the sticky bit.

This calculator reports both forms, so you can see immediately whether a setuid or sticky bit you have just set is doing anything.

Auditing Permissions on a System

Permissions drift. Files get created with an over-permissive umask, setuid binaries survive long after the vendor that shipped them has gone, and a world-writable directory turns up somewhere nobody expected. The three searches worth putting in a recurring audit are setuid and setgid files, world-writable files, and world-writable directories without the sticky bit — the last of which is the dangerous combination, since every user can delete every other user’s files.

Windows equivalents: if you are auditing NTFS ACLs rather than POSIX modes, the same reasoning applies with a different model — Allow and Deny entries, inheritance from parent folders, and the rule that an explicit Deny always wins. The NTFS Permissions Calculator works out the effective permissions when several sources combine.

Frequently Asked Questions

What does chmod 755 mean?: The three digits are the permissions for the owner, the group, and everyone else, in that order. Each digit is the sum of read (4), write (2), and execute (1). So 7 is 4+2+1 — read, write and execute — and 5 is 4+1 — read and execute. 755 therefore gives the owner full control, while the group and everyone else can read and execute but not modify.
What is the difference between 755 and 4755?: The leading digit in 4755 is the special bits field, and 4 there is setuid. It makes the program run with the privileges of the file owner rather than the privileges of whoever launched it. That is how passwd can let an ordinary user update /etc/shadow: the binary is owned by root and marked setuid, so it runs as root regardless of who invokes it. It is also a common privilege-escalation path, so every setuid file on a system deserves justification.
Why does the same mode behave differently on a directory?: Because read, write and execute mean different things on a directory. Read lets you list the names of the entries inside. Execute — also called search or traverse — lets you actually reach through it to a file, so a directory with read but no execute shows you the filenames while denying access to every one of them. Write lets you create, rename and delete entries, which means write on a directory is effectively the power to delete any file in it regardless of that file's own permissions.
What does the sticky bit do?: On a directory, the sticky bit (1000) means only the owner of a file — or root — may delete or rename it, even if the directory itself is world-writable. That is precisely what makes /tmp safe: everyone can create files there, but nobody can delete anyone else's. Without it, a world-writable directory lets any user destroy every other user's files.
How do I read the s and t characters in ls output?: The rule that trips people up is that the letter is lowercase only when the underlying execute bit is also set. So -rwsr-xr-x (4755) has setuid with execute, and -rwSr--r-- (4644) has setuid without execute — the uppercase S means the setuid bit is set but is doing nothing useful, because a program without execute cannot be run. The same applies to t and T for the sticky bit, and to the group position for setgid.
What is umask and how does it relate to chmod?: A umask is the set of permission bits to remove from a newly created file or directory. New files can never be executable, so they start from a maximum of 666 and new directories start from 777; the umask subtracts from that. With umask 022, new files become 644 and new directories become 755. A umask only ever removes permissions — it cannot grant them, and it has no effect on files that already exist.
How do I find all files with a particular permission?: Use find with -perm. An exact match is find . -perm 644. Prefix the mode with a hyphen to require all of those bits whether or not others are set, as in find . -perm -644. Prefix it with a slash to match files with any of those bits, as in find . -perm /o+w, which finds every world-writable file. The any-bits form is the one to remember for security audits.

// LINUX & INFRASTRUCTURE

Need help hardening your Linux estate?

DMC IT Services provides Linux server hardening, permission and privilege audits, and infrastructure support for SMBs across London, Cambridge, Hertfordshire, and Bedfordshire.

Talk to an Engineer

← Back to all free tools

Owner

Group

Others

Read

Write

Execute

How Unix Permissions Work

Octal Modes at a Glance

These are the modes you will meet in practice. The octal value is what you pass to chmod.

Mode	Symbolic	Owner	Group	Others
644	-rw-r--r--	read, write	read	read
600	-rw-------	read, write	none	none
755	-rwxr-xr-x	read, write, execute	read, execute	read, execute
700	-rwx------	read, write, execute	none	none
2775	-rwxrwsr-x	read, write, execute	read, write, execute (setgid)	read, execute
1777	-rwxrwxrwt	read, write, execute	read, write, execute	read, write, execute (sticky)
4755	-rwsr-xr-x	setuid	read, execute	read, execute

Reading Symbolic Permissions

This calculator reports both forms, so you can see immediately whether a setuid or sticky bit you have just set is doing anything.

Auditing Permissions on a System

Frequently Asked Questions

What does chmod 755 mean?

The three digits are the permissions for the owner, the group, and everyone else, in that order. Each digit is the sum of read (4), write (2), and execute (1). So 7 is 4+2+1 — read, write and execute — and 5 is 4+1 — read and execute. 755 therefore gives the owner full control, while the group and everyone else can read and execute but not modify.

What is the difference between 755 and 4755?

The leading digit in 4755 is the special bits field, and 4 there is setuid. It makes the program run with the privileges of the file owner rather than the privileges of whoever launched it. That is how passwd can let an ordinary user update /etc/shadow: the binary is owned by root and marked setuid, so it runs as root regardless of who invokes it. It is also a common privilege-escalation path, so every setuid file on a system deserves justification.

Why does the same mode behave differently on a directory?

Because read, write and execute mean different things on a directory. Read lets you list the names of the entries inside. Execute — also called search or traverse — lets you actually reach through it to a file, so a directory with read but no execute shows you the filenames while denying access to every one of them. Write lets you create, rename and delete entries, which means write on a directory is effectively the power to delete any file in it regardless of that file's own permissions.

What does the sticky bit do?

On a directory, the sticky bit (1000) means only the owner of a file — or root — may delete or rename it, even if the directory itself is world-writable. That is precisely what makes /tmp safe: everyone can create files there, but nobody can delete anyone else's. Without it, a world-writable directory lets any user destroy every other user's files.

How do I read the s and t characters in ls output?

The rule that trips people up is that the letter is lowercase only when the underlying execute bit is also set. So -rwsr-xr-x (4755) has setuid with execute, and -rwSr--r-- (4644) has setuid without execute — the uppercase S means the setuid bit is set but is doing nothing useful, because a program without execute cannot be run. The same applies to t and T for the sticky bit, and to the group position for setgid.

What is umask and how does it relate to chmod?

A umask is the set of permission bits to remove from a newly created file or directory. New files can never be executable, so they start from a maximum of 666 and new directories start from 777; the umask subtracts from that. With umask 022, new files become 644 and new directories become 755. A umask only ever removes permissions — it cannot grant them, and it has no effect on files that already exist.

How do I find all files with a particular permission?

Use find with -perm. An exact match is find . -perm 644. Prefix the mode with a hyphen to require all of those bits whether or not others are set, as in find . -perm -644. Prefix it with a slash to match files with any of those bits, as in find . -perm /o+w, which finds every world-writable file. The any-bits form is the one to remember for security audits.