Last updated
Understanding Unix File Permissions
Every file and directory on a Unix/Linux system has a set of permission bits that control who can read, write, or execute it. Permissions are divided into three groups: owner (the user who created the file), group (a set of users), and others (everyone else). Each group gets three bits: read (r), write (w), execute (x).
The chmod command changes these permissions. You can express permissions either
symbolically (chmod u+x file) or as a 3-digit octal number (chmod 755 file).
The octal form is more compact and is what this calculator works with.
The Octal Permission System
Each permission group (owner, group, others) is represented by a single octal digit (0–7). The digit is the sum of the active permission bits:
| Permission | Bit value | Symbol |
|---|---|---|
| Read | 4 | r |
| Write | 2 | w |
| Execute | 1 | x |
| None | 0 | - |
So 7 = 4+2+1 = read+write+execute, 6 = 4+2 = read+write,
5 = 4+1 = read+execute, 4 = read only.
Most Common chmod Values
| Octal | Symbolic | Typical use |
|---|---|---|
755 | rwxr-xr-x | Executable scripts, web directories |
644 | rw-r--r-- | Regular files, HTML, CSS, config files |
600 | rw------- | SSH private keys, sensitive config |
700 | rwx------ | Private scripts, user home directories |
777 | rwxrwxrwx | Fully open (avoid in production) |
400 | r-------- | Read-only files (e.g., AWS .pem keys) |
664 | rw-rw-r-- | Shared group-writable files |
Special Permission Bits
Beyond the standard 9 bits, Unix has three special bits represented by a 4th octal digit:
- Setuid (4000): When set on an executable, it runs with the file owner's privileges. Used by
/usr/bin/passwdto allow users to change their own password. - Setgid (2000): On executables, runs with the group's privileges. On directories, new files inherit the directory's group.
- Sticky bit (1000): On directories, only the file owner can delete their own files. Used on
/tmpto prevent users from deleting each other's temp files.
# Set setuid on a binary
chmod 4755 /usr/local/bin/mytool
# Set sticky bit on a shared directory
chmod 1777 /tmp/shared
# Recursive permission change
chmod -R 755 /var/www/html
# Symbolic form: add execute for owner only
chmod u+x deploy.sh
# Remove write from group and others
chmod go-w config.ymlSSH will refuse to use a private key file if its permissions are too open. AWS EC2 requires chmod 400 your-key.pem before connecting. The error "WARNING: UNPROTECTED PRIVATE KEY FILE!" means the key is readable by others.