Chmod Calculator: Octal, Symbolic & umask

How to use the chmod calculator

Tick what the owner, the group and everyone else may do, or type a mode into either box: an octal number such as 755 or 4755, or the string ls -l prints, such as rwxr-xr-x or drwxrwxrwt. The ready-to-paste chmod commands follow along. Enter a file name to put it in the commands, and tick Directory to see what each permission means for a folder.

How the octal number works

Read is 4, write is 2 and execute is 1. Add them up for each class and write the three sums as owner, group, others: rwx is 7 and r-x is 5, so rwxr-xr-x is 755. An optional fourth digit in front holds the special bits: setuid 4, setgid 2, sticky 1.

On a directory, read lets you list names, write lets you create, rename and delete entries, and execute lets you enter it and open files by name. Write does nothing without execute. Only one class applies to you: the owner gets the owner bits even when others are allowed more.

Special bits and s, S, t, T

setuid (4000) runs a program with its owner’s rights, which is how /usr/bin/passwd (rwsr-xr-x) can update the password file. setgid (2000) on a directory makes new files inherit its group. sticky (1000) on a directory lets only a file’s owner delete it, as on /tmp (1777). ls -l shows these in the execute position: lowercase s or t when the execute bit is also set, uppercase S or T when it is not.

umask: default permissions for new files

Programs usually create files with mode 666 and directories with 777, and the umask removes bits from that. With umask 022 new files get 644 and new directories 755; with 027 they get 640 and 750. Type a umask, or the mode you want new files or directories to get, and the calculator fills in the rest. The umask never adds execute to a file, and a program can always ask for less (SSH keys are created 600). Set it with umask 027 in ~/.profile, or UMask=0027 in a systemd unit.

Reading ls -l output

Paste lines from ls -l to get each entry’s octal mode, type and owner. The first character is the type: - file, d directory, l symbolic link, c or b device, p named pipe, s socket. A character after the nine permission letters is a marker:

A symbolic link always shows rwxrwxrwx; its own bits are unused and chmod changes the target instead.

ACLs and setfacl

An ACL grants rights to extra users or groups: setfacl -m u:alice:rwx file gives alice full access, getfacl file lists the entries and setfacl -b file removes them. With an ACL, the group digit ls -l shows is the ACL mask, the most any named user or group can get, so chmod g-w also takes write away from alice. A default ACL on a directory (setfacl -d -m g:devs:rwX dir) is copied to new files inside it and replaces the umask there.

Tips

• To give directories 755 and files 644 in a tree, use chmod -R u=rwX,go=rX DIR: capital X adds execute only to directories and to files someone can already execute.
• GNU chmod keeps a directory’s setuid and setgid bits when you give a three- or four-digit number. Use five digits, as in 00755, to clear them.