chmod Calculator

about this tool

Three ways to write one mode

A Unix mode is twelve bits: three special bits, then read, write and execute for the owner, the group and everyone else. The grid, the octal field and the ls -l field are three views of the same number, and changing any of them updates the others. The octal form is three digits, or four when a special bit is set (4 setuid, 2 setgid, 1 sticky, added together in the leading digit); the ls -l form is the nine characters ls prints, and the field also accepts the full ten with the type character and the +, . or @ ls adds for ACLs, SELinux labels or extended attributes.

The s, S, t and T letters follow the POSIX rules exactly: lowercase when the special bit and execute are both on, uppercase when the special bit is on without execute. The uppercase forms are almost always a mistake and the tool says what each one actually does.

chmod expressions

The expression field takes what you would type after chmod: one or more clauses separated by commas, each [ugoa][+-=][rwxXst], following the POSIX grammar. = sets a class exactly and clears the special bit that class governs unless it is named again; X adds execute only to directories and to files already executable for someone; u, g or o on the right of an operator copies that class's current bits (g=u). A clause with no class applies to all three, and the tool notes that real chmod would also honour your umask there, which this page cannot know.

What the bits mean

For a file, read, write and execute mean what they say. For a directory they mean list, add-and-remove entries, and enter, and several combinations are traps: read without execute lets someone see the names of files but reach none of them; execute without read lets them use paths they already know but not list. The result panel describes each class in the right vocabulary once you say which kind of thing it is.

Warnings

The tool flags the modes that go wrong in practice rather than every unusual one: world-writable files (anyone can change them), world-writable directories without the sticky bit (anyone can delete anyone's files; 1777 is the fix), setuid on anything world-writable, a group or others with more access than the owner, a file its owner cannot write, and the list-but-not- enter directory. None of these is illegal; all of them are usually not what was meant.

Limits

This is arithmetic on twelve bits. It knows nothing about ACLs, SELinux contexts, capabilities or immutable flags, all of which can override what the mode says. It does not apply your umask to a class-less expression. And it describes Linux and BSD behaviour; setuid on directories and sticky on files mean other things on some older systems.

Octal is three bits per digit, which the number base converter makes plain if the notation ever confuses you. Dev reference has the same tables alongside HTTP status codes and other lookups.

questions

What do the s, S, t and T in ls -l mean?

They sit where the x would be. A lowercase s means setuid (owner column) or setgid (group column) is on and execute is on too; an uppercase S means the special bit is on but execute is off, which is almost always a mistake. Likewise t is sticky with execute for others and T is sticky without it.

Why does the calculator sometimes show four digits?

The fourth, leading digit holds the special bits: 4 for setuid, 2 for setgid, 1 for sticky, added together. 2775 is a directory whose new files inherit its group; 1777 is a world-writable directory where only a file’s owner can delete it, like /tmp. With no special bits the leading digit is 0 and is left off.

What is the difference between +x and +X?

A lowercase x sets execute unconditionally. Capital X sets it only on directories and on files that are already executable for someone, so chmod -R a+X makes directories enterable without turning every data file into a program. That is why chmod -R 755 on a tree is usually wrong and chmod -R a+rX is usually right.

What does g=u do?

Copies the owner’s permissions to the group. The letters u, g and o can appear on the right of an operator to mean “whatever that class has now”, so o=g makes others match the group and g=u makes the group match the owner.

Is 777 ever the right answer?

Almost never for a file: it lets anyone on the system modify it. For a directory that many users must write to, 1777 is the traditional answer: the sticky bit stops users deleting or renaming each other’s files. The calculator flags 777 and the other combinations that usually mean something has gone wrong.