Understanding Chmod and Unix File Permissions
On Unix and Linux systems, every file and directory carries a set of permissions for three categories of user: the owner, the group, and others (everyone else). Each category can be granted read (r), write (w), and execute (x) access. The chmod ("change mode") command sets these permissions, either with a symbolic string like rwxr-xr-x or with a three-digit numeric (octal) mode like 755.
The formula
Each permission digit is calculated by summing weighted bits, whichever of the three are granted for that category:
- Read is worth 4
- Write is worth 2
- Execute is worth 1
Add the values for whatever is granted: read + write + execute = 4 + 2 + 1 = 7 (full access). Read + execute with no write = 4 + 1 = 5. No permissions at all = 0. The full mode is three such digits written in order — owner, then group, then others — so 755 means the owner gets 7 (rwx), while the group and others each get 5 (r-x).
Special permissions
An optional fourth digit, placed before the other three, sets special permissions: setuid = 4 (the program runs with the file owner's privileges), setgid = 2 (it runs with the file's group privileges, and on directories new files inherit that group), and the sticky bit = 1 (on a shared directory, only a file's owner, the directory owner, or root can delete or rename it). These add together the same way — setuid plus sticky is 4 + 1 = 5, shown as a leading digit, e.g. 4755 or 5755. In symbolic notation, an active setuid or setgid bit replaces the owner's or group's execute character with s (or S if execute is not also set), and an active sticky bit replaces others' execute character with t (or T).
Common permission presets
- 755 (rwxr-xr-x): the owner can read, write, and execute; everyone else can read and execute. Typical for scripts, programs, and directories.
- 644 (rw-r--r--): the owner can read and write; everyone else can only read. Typical for ordinary documents and web assets.
- 700 (rwx------): only the owner has any access at all. Common for private scripts or SSH key directories.
- 600 (rw-------): only the owner can read or write; nobody else has access. Common for private keys and credential files.
- 750 (rwxr-x---): owner has full access, the group can read and execute, and others have nothing.