How Unix File Permissions Work

Every developer has typed chmod 755. Many could not say what the 7, the 5 and the other 5 each mean, and fewer still could write the equivalent rwxr-xr-x from memory. Yet the whole system is nine bits and a little arithmetic — small enough to hold in your head once someone shows you the trick.

Three roles, three permissions

Unix attaches nine permission bits to every file, arranged in three triples. The first triple governs the owner (the user who owns the file), the second the group (a set of users the file belongs to), and the third everyone else. Within each triple sit the same three powers: read (r) — inspect the contents; write (w) — change them; execute (x) — run the file as a program. For directories the powers shift meaning slightly but stay parallel: read lists the names inside, write creates and deletes entries, execute lets you pass through the directory to reach its contents. That last one is why a directory without execute is useless even with read set — you can see the menu but not enter the restaurant.

The octal shorthand

Each triple is three yes/no answers, and three bits make one octal digit. Read counts 4, write counts 2, execute counts 1, and the digit is their sum. rwx is 4+2+1 = 7. r-x is 5. rw- is 6. r-- is 4. A full mode is three such digits, owner first: 755 says the owner can do everything, the group and the world can read and run. 644 says the owner edits, everyone else only reads. 600 locks a file to its owner alone — the recommended mode for private keys. The mapping is a bijection, which is why tools happily accept either form: the octal digits and the symbolic string are two spellings of the same nine bits.

Special bits: setuid, setgid, sticky

Above the nine basic bits live three specials. Setuid makes a program execute with the file owner’s privileges rather than yours — the mechanism that lets passwd update the password database. Setgid does the same with the group’s, and on a directory it makes new files inherit that directory’s group. Sticky, on a directory, means only a file’s owner may delete or rename it — /tmp is world-writable (777) but sticky, so strangers cannot delete each other’s files. In octal, the specials form a leading fourth digit: 4 for setuid, 2 for setgid, 1 for sticky. 4755 is setuid plus rwxr-xr-x; 1777 is sticky plus rwxrwxrwx.

Reading ls -l output

Run ls -l and the mode appears as ten characters: one file-type letter (d for directory, - for a regular file) followed by the nine permission characters. The specials hide inside the execute positions: lowercase s in the owner or group triple means that special is set and execute is too; uppercase S means the special is set but execute is not — almost always a misconfiguration, because a special bit without execute on its triple does nothing. The same convention covers t and T in the other triple. Once you can read those ten characters, the octal digits are just addition: rwsr-xr-x is 4(setuid) + 755.

Presets worth memorizing

Four modes cover most of daily life. 644 for files the web server must read but not modify. 755 for directories and for scripts everyone may run. 600 for anything private — keys, credentials, personal notes. 1777 for a scratch directory like /tmp. When a tutorial tells you to “chmod 644 the file and 755 the directory”, you can now decode it instantly instead of pasting it blindly. And when a permission problem appears in a completely different domain — an API answering 403, for instance — the reasoning is the same: something between you and the resource refuses. Decoding dense numeric notation is a transferable skill; HTTP Status Codes Explained is its web counterpart, and How Unix Time Works covers another piece of Unix shorthand that outlived its decade.

Try it yourself

Type any mode — octal like 4755 or symbolic like rwSr--r-- — into the Unix Permissions Calculator and get both spellings back with a per-role breakdown, the special bits named, and a plain-English summary of who can do what.