Chmod Calculator

Each digit is one class: owner, then group, then others. Within a digit, read is worth 4, write 2, and execute 1, so 7 is 4+2+1 (read, write, execute), 5 is 4+1 (read and execute) and 0 is nothing. 755 therefore lets the owner do everything, while the group and everyone else may read and execute but not modify. It is the usual mode for a program and for almost every directory on a system.

Only the execute bit. 644 grants the owner read and write and gives everyone else read; 755 adds execute for all three classes. Data files want 644; an executable bit on a PDF or a photo does nothing but confuse. Programs, shell scripts, and every directory want 755, because a directory without execute cannot be entered even by someone who can list it.

It grants write to every account on the machine, which includes the service accounts an attacker reaches first. A web server running as www-data that can rewrite the application it serves turns a small file-upload flaw into arbitrary code execution. Reaching for 777 also means the real cause (usually the wrong owner or group) is never found, so the exposure stays long after the original error is forgotten. Fix ownership with chown and grant the narrowest mode that works.

Only when you are setting setuid (4000), setgid (2000), or the sticky bit (1000). Writing 755 and 0755 does the same thing, because a missing leading digit is read as zero. Clearing those bits again is where the surprise is: GNU chmod deliberately leaves a directory's setuid and setgid alone unless you name them, so on Linux neither chmod 755 nor chmod 0755 takes setgid off a directory; that needs chmod g-s, chmod =755, or the five-digit chmod 00755. BSD chmod, macOS included, clears them from a plain three-digit mode instead. On a regular file every version clears them.

It means the special bit is set but the matching execute bit is not, so the special bit cannot fire. rwSr--r-- is a setuid file the owner cannot execute; drwxrwxrwT is a sticky directory with no execute for others. A lowercase s or t means both bits are set and the behaviour is live. A capital letter usually means the execute bit was cleared after the special bit was set, or that a four-digit mode was typed without the matching x; either way the mode does not do what it looks like it does.

Because deleting is not an operation on the file, it is an operation on the directory that holds the name. Write plus execute on the directory is enough to unlink any entry inside it, whatever the file itself says. That is precisely the hole the sticky bit closes: on a 1777 directory such as /tmp, only the owner of an entry, the owner of the directory, or root may remove it.

It grants traversal: the right to resolve a name inside it and reach anything deeper. Read and execute are independent: read without execute lets you list the names but not use them, so ls works and opening any of the results fails. Execute without read is the reverse, and is a real technique: mode 711 on a home directory lets a web server reach public_html without letting anyone list what else is in there. Every directory along a path needs execute, or the lookup fails at that level.

chmod sets a mode outright; umask only ever takes bits away, and only at the moment something is created. The kernel offers 666 for a new file and 777 for a new directory, then clears every bit the mask names, which is why the common umask of 022 produces 644 files and 755 directories, and why new files are never executable. It is a per-process setting, so changing it in a shell affects that shell and its children, and nothing that already exists.