chmod Calculator

Linux stores 12 permission bits for every file. Nine are read (4), write (2) and execute (1) for the owner, the group and everyone else; each digit of 755 is the sum for one of those classes. The optional fourth digit in front holds the special bits: setuid (4), setgid (2) and sticky (1).

In ls -l output the special bits replace the execute letter: s for setuid or setgid, t for sticky. A capital S or T means the special bit is set but the execute bit under it is not.

The commands shown set exactly the mode in the box. On a directory, GNU chmod leaves setuid and setgid alone unless you mention them, so for directories the calculator uses the 5-digit numeric form (for example 00755) and adds ug-s to the symbolic form. That behavior is described in the GNU coreutils manual. Every one of the 4,096 modes was tested against real GNU chmod, for files and directories.

A web app directory should be readable by everyone, writable only by its owner, and new files inside should keep the directory's group. That is rwx for the owner, r-x for group and others, plus setgid:

• Owner 4+2+1 = 7, group 4+1 = 5, others 4+1 = 5, special setgid = 2
• Numeric mode: 2755, shown by ls as drwxr-sr-x
• Command: chmod 02755 mydir or chmod u=rwx,g=rxs,o=rx,u-s mydir

For a shared upload folder like /tmp, 1777 (drwxrwxrwt) lets anyone create files but only the owner of a file can delete it.

The owner can read, write and execute; the group and everyone else can read and execute but not change the file. It is the usual mode for programs and directories.

644 (rw-r--r--) has no execute bit, which suits ordinary files like documents and config files. 755 adds execute for everyone, which programs, scripts and directories need.

GNU chmod does not clear setuid or setgid on a directory unless you ask. Use chmod 00755 (five digits) or chmod ug-s to remove them.

Rarely. It lets every account on the system change or replace the file. Use the narrowest mode that works, and fix ownership with chown instead of opening permissions.

The setuid, setgid or sticky bit is set but the execute permission in that position is not, so the special bit usually has no useful effect.