How Linux permissions work
Every file and directory carries nine basic permission bits: read, write,
and execute, for each of three classes — the owner, the group, and everyone
else. Each class's three bits form one octal digit (r = 4, w = 2, x = 1), so a
mode like 755 means the owner has all three (7 = 4+2+1) and group
and other have read and execute (5 = 4+1). The symbolic form
rwxr-xr-x spells the same thing out.
Common modes
| Mode | Symbolic | Typical use |
|---|---|---|
| 644 | rw-r--r-- | ordinary files |
| 755 | rwxr-xr-x | directories, executables, scripts |
| 600 | rw------- | private files; SSH refuses keys any wider |
| 700 | rwx------ | private directories |
| 775 / 664 | rwxrwxr-x | shared group directories / files |
The special bits
A fourth, leading octal digit holds three special bits. setuid (4) on
an executable makes it run as its owner rather than the user who launched it —
the classic example is passwd. setgid (2) does the same for
the group, and on a directory it makes new files inherit the directory's group,
which is handy for shared project folders. sticky (1) on a directory
means only a file's owner can delete it, even if others can write to the
directory — this is why anyone can create files in /tmp but not
delete each other's. In the symbolic string these replace the execute
character: a lowercase s or t when execute is also
set, uppercase S or T when it is not.
Octal or symbolic
The chmod command accepts either an octal mode
(chmod 644 file) or symbolic changes relative to the current mode
(chmod u+x file to add owner-execute, chmod go-w file
to remove write for group and other). Octal sets every bit at once; symbolic
edits are handy when you only want to flip one.
Related tools: the subnet calculator is the other everyday sysadmin bit-twiddler, and the number base converter handles octal alongside binary and hex.