Three people, three digits

Order

The three rwx triplets control access for three different audiences. Read them from left to right: owner → group → others. The three numeric digits follow the same order.

Audiences

01 Owner
The account that owns the file.

02 Group
Accounts in the file's owning group.

03 Others
Everyone else.

Read / Write / Execute

Within each triplet, r means read, w means write, and x means execute. A dash means that permission is off.

Example

755 = rwx | r-x | r-x

Here the owner can read, write and execute; group members and everyone else can read and execute, but cannot write.

Remember

UGO: User (owner), Group, Others.

Access Rule

The owner's permissions apply to the owner; otherwise the group permissions apply to members of the owning group; otherwise the others permissions apply. The three groups aren't added together.

Read 4. Write 2. Execute 1.

The 4-2-1 Rule

r = 4
w = 2
x = 1

Start at four and halve: 4 → 2 → 1. The letters always stay in rwx order; a dash fills the place of a permission that is off.

Three Switches

100 = read
010 = write
001 = execute

These are binary bits. Add their values to get one octal digit, from 0 to 7.

Add the Enabled Bits

6 = 4 + 2    = rw-

5 = 4 + 1    = r-x

7 = 4 + 2 + 1 = rwx

Files and directories

r / Read / 4

file:   read contents
directory: list entry names

w / Write / 2

file: modify contents
directory: create, delete or rename entries¹

x / Execute / 1

file: run as a program²
directory: traverse and access entries

Notes

¹ Changing directory entries normally also requires execute permission. Deleting a file depends on its parent directory's permissions, rather than the file's write bit. A sticky directory adds restrictions.

² Execute allows execution, but the file must also be a runnable program or script. Script interpreters generally need read permission too.

Your eight-pattern cheat sheet

Octal / rwx / Calculation

0   ---   0 = 0

1   --x   1 = 1

2   -w-   2 = 2

3   -wx   2 + 1 = 3

4   r--   4 = 4

5   r-x   4 + 1 = 5

6   rw-   4 + 2 = 6

7   rwx   4 + 2 + 1 = 7

Shortcut

Even numbers have no execute bit. Odd numbers do. Six is read + write; seven adds execute.

Using chmod

Examples

$ chmod 644 file
$ chmod u+x script.sh
$ chmod go-w file

Syntax

A numeric mode sets all nine basic permission bits. Symbolic modes let you change selected bits.

u   owner
g   group
o   others
a   all three

+   add
-   remove
=   set exactly

Choosing a Mode

777 gives everyone write access; it is rarely a useful default. Choose the access the file actually needs.

Avoid applying one mode recursively to mixed files and directories: directories need execute for traversal, while ordinary files usually don't.

Scope

This calculator covers the nine basic bits. Special bits (setuid, setgid, sticky), ACLs and other system controls can also affect access.

See Also

GNU chmod manual >