glunty A file listing like -rwxr-xr-x looks like line noise until you know it is really three small groups of yes-or-no switches. Those switches decide who can read a file, change it, or run it, and chmod is the command that flips them. Once you see the structure behind them, a mode like 755 becomes something you can read at a glance.
The three permission classes
Every file and directory tracks permissions for three separate classes of user, always in the same order:
- Owner (also called user): the single account that owns the file, usually whoever created it.
- Group: one group of users. Every file belongs to exactly one group, and members of that group share its group permissions.
- Other: everyone else on the system who is neither the owner nor a member of the group.
When you see a string like rwxr-xr-x, read it as three blocks of three: rwx for the owner, r-x for the group, r-x for other. The leading character in -rwxr-xr-x is the file type, not a permission, so ignore it when reading access.
Read, write, and execute
Within each class there are exactly three permissions, each with a fixed numeric value:
- Read (
r) = 4: view the contents of a file, or list the names inside a directory. - Write (
w) = 2: change a file’s contents, or add and remove files in a directory. - Execute (
x) = 1: run a file as a program, or enter a directory (more on that below).
A dash in any position means that permission is off, so r-x is read and execute but not write.
Octal: adding the values up
The numbers behind chmod are those values added together for each class. Because 4, 2, and 1 are powers of two, each combination gives a unique total from 0 to 7:
rwx= 4 + 2 + 1 = 7rw-= 4 + 2 = 6r-x= 4 + 1 = 5r--= 4
String three of these digits together, one per class, and you have the octal mode. 755 prints as rwxr-xr-x: the owner can do everything, while everyone else can read and run but not modify. 644 prints as rw-r--r--: the owner can read and write and everyone else can only read, the standard for a plain data file. If the arithmetic ever feels fiddly, the chmod calculator converts between the checkboxes, the letters, and the octal number instantly.
Symbolic notation
chmod also accepts a symbolic form that changes permissions without recomputing the whole number. You name a class, an operator, and the permissions:
- Classes:
u(user/owner),g(group),o(other),a(all three). - Operators:
+adds,-removes,=sets exactly. - Permissions:
r,w, andx.
So chmod u+x script.sh adds execute for the owner and leaves everything else untouched. chmod go-w file removes write for group and other. chmod a=r file sets every class to read-only in one move. Symbolic mode is best for nudging a single bit; octal is best for setting everything at once.
What execute means on a directory
Execute is the permission people misread most, because it behaves differently on a directory than on a file. On a file, x means the file can be run as a program. On a directory, x means you can enter it and reach the files inside by name, sometimes called the traverse or search permission.
This leads to a common trap. A directory with read but not execute (r--) lets you list the names inside but not open any of them or cd in. A directory with execute but not read (--x) lets you reach a file if you know its exact name, but not list what is there. Most usable directories need both, which is why 755 is the typical directory mode.
The special bits and the four-digit form
Beyond the nine basic bits there are three special ones, written as an optional fourth digit in front of the mode. They follow the same 4, 2, 1 pattern:
- setuid (4): a program runs with the privileges of the file’s owner rather than the user who launched it.
- setgid (2): on a program it runs with the file’s group; on a directory, new files inside inherit that directory’s group.
- sticky bit (1): on a shared directory, only a file’s owner can delete or rename it, which is what protects
/tmp.
So chmod 1777 /tmp/shared sets full read, write, and execute for everyone plus the sticky bit. In a four-digit mode, read the first digit as these special flags and the remaining three exactly as before. A leading 0, as in 0644, means no special bits are set.
Reading a mode in one pass
Any permission string now decodes in seconds. Split it into three groups of three, add 4, 2, and 1 wherever a letter appears, and account for the special digit if present. -rw-r--r-- is 644, a normal file; drwxr-xr-x is 755, a normal directory, where the leading d marks the type. To check a mode before you apply it, the chmod calculator shows the letters and octal side by side. And when a chmod command turns up inside a longer script, the bash explainer breaks the whole line down in plain English.