Questions & answers
What 644, 755 and 777 actually mean, why some modes are dangerous, and how the special bits and umask fit together.
Every file and directory on a Linux or Unix system carries a permission mode that controls who may read, write and execute it. The mode is split across three classes of user — the owner, the group and others (everyone else) — and each class gets its own three bits: read (4), write (2) and execute (1).
Add those values within a class and you get one octal digit: read plus write plus execute is 7, read plus execute is 5, read plus write is 6. Three classes give the familiar three-digit modes you pass to chmod, such as 644 or 755. The same permissions can be written symbolically — the -rwxr-xr-x string that ls -l prints — where each letter is one bit and a dash is a bit that is off.
On a directory the bits mean something slightly different: read lists the entries, write creates or deletes them, and execute lets you enter the directory and reach what is inside. That is why a directory almost always needs its execute bit set even when a plain file would not.
Three special bits sit above the usual nine: setuid, setgid and the sticky bit. They add a fourth leading octal digit and change how a program runs or how a shared directory behaves. Toggle any of them in the calculator to see the effect spelled out for a file and for a directory.
chmod 644 sets a file to -rw-r--r--. The owner can read and write the file; the group and all other users can only read it. It is the standard mode for regular files that are not meant to be executed, such as documents, configuration files and web page assets.
755 (-rwxr-xr-x) adds the execute bit for everyone, while 644 (-rw-r--r--) does not. Use 755 for programs, scripts and directories, because a directory needs the execute bit before anyone can enter it. Use 644 for ordinary files that should never be run as a program.
777 grants read, write and execute permission to every user account on the system. Any local user or compromised process can then modify or replace the file, including scripts that later run with higher privileges. Grant the narrowest permission that works instead, and fix ownership with chown rather than widening the mode.
setuid (4000) makes an executable run with the privileges of its owner rather than the calling user. setgid (2000) does the same for the group, and on a directory it makes new entries inherit that directory's group. The sticky bit (1000) on a directory means only the owner of an entry, or root, may delete or rename it, which is how /tmp stays safe at mode 1777.
umask masks bits out of the maximum default mode. New files start from 666 and new directories from 777, then the umask bits are removed. With the common umask 022, new files become 644 and new directories become 755. umask never adds permission, it only takes it away.
Add the execute bit with a symbolic command such as chmod +x script.sh, or chmod u+x to grant it to the owner only. In octal, a script is usually set to 755 (-rwxr-xr-x) so the owner can edit it and everyone can run it, or 700 (-rwx------) to keep it private to the owner.
Octal notation (644, 755) sets the whole mode at once as a number. Symbolic notation (u+x, go-w, a=r) changes individual bits relative to the current mode without disturbing the rest. Use octal when you know exactly what the final permissions should be, and symbolic when you want to add or remove one permission and leave the others alone.
Want to try a mode yourself? Open the calculator · need a quick lookup? See the cheat sheet.