Chmod Permissions Calculator

Understanding Linux file permissions and chmod

In Unix and Linux operating systems, file permissions dictate who can read, modify, or execute files and directories. Every file and directory is assigned to an Owner (User), a Group, and Others (everyone else). The chmod (change mode) command modifies these permissions using either octal notation (such as 755 or 644) or symbolic notation (such as u=rwx,go=rx).

How the octal calculation works

Each role's permission is represented by a single digit from 0 to 7, formed by adding the binary weights of the permissions granted:

• Read (r) = 4 — permits opening and viewing file contents or listing directory entries.
• Write (w) = 2 — permits modifying or deleting file contents, or creating/removing files within a directory.
• Execute (x) = 1 — permits running a file as an executable binary or script, or traversing/entering a directory (cd).

For example, to grant Read (4), Write (2), and Execute (1) to the owner, the first digit is 4 + 2 + 1 = 7. To grant Read (4) and Execute (1) to group members and public visitors, their digits are 4 + 1 = 5. Combined, this yields the classic mode 755 (symbolic: -rwxr-xr-x).

What are SUID, SGID, and the Sticky Bit?

In addition to basic read, write, and execute permissions, Linux supports three special permission bits:

• SetUID (4000) — when set on an executable binary, any user running the program executes it with the privileges of the file owner (commonly used by system utilities like passwd).
• SetGID (2000) — on directories, newly created files automatically inherit the directory's group ownership rather than the primary group of the creating user. This is ideal for shared team folders.
• Sticky Bit (1000) — on directories like /tmp (often set to 1777 or drwxrwxrwt), only the file's owner or the root user can delete or rename files, preventing users from deleting each other's temporary data.

Recommended security best practices

• Avoid chmod 777 — never set 777 on production servers or web directories. A 777 folder allows any local user or compromised background process to write malicious scripts or overwrite critical files.
• Standard web application files: Set files to 644 (rw-r--r--) and directories to 755 (rwxr-xr-x). This allows web servers (like Nginx, Apache, or PHP-FPM) to read files while ensuring only the owner can modify them.
• SSH keys and credentials: Private SSH keys (such as id_rsa or .pem files) must have restrictive permissions like 600 (rw-------). OpenSSH refuses to use private keys that are accessible to group or public users.