chmod calculator

How to use the chmod calculator

Tick the boxes for what the owner, the group and everyone else may do, or type a mode straight into the octal box (755, 0644, 2775) or the symbolic box (rwxr-xr-x). You can also paste the first column of ls -l output, such as -rw-r--r-- or drwxrwsr-x. The calculator gives you two equivalent commands. The numeric one sets the exact mode. The symbolic one (u=rwx,g=rx,o=rx) does the same thing and is easier to read in scripts.

Check the result on the real file afterwards:

chmod 755 deploy.sh
ls -l deploy.sh
stat -c '%a %A %n' deploy.sh

Example output:

-rwxr-xr-x 1 alice alice 812 Oct 16 09:12 deploy.sh
755 -rwxr-xr-x deploy.sh

What chmod 755, 644 and the other numbers mean

Each octal digit is the sum of read (4), write (2) and execute (1). The first digit is the owner, the second is the group and the third is everyone else. So chmod 755 means the owner gets 4+2+1 = 7 (read, write, execute) and the group and others get 4+1 = 5 (read and execute). A fourth, leading digit sets the special bits: setuid (4), setgid (2) and sticky (1).

Read, write and execute mean different things on a directory. Read lets you list names, write lets you create, rename and delete entries, and execute lets you enter the directory and reach files inside it. This is why directories almost always have x wherever they have r.

Symbolic mode: u, g, o, a and + - =

Symbolic mode changes bits relative to what is already there, so you do not have to know the current number:

# add execute for the owner only
chmod u+x script.sh
# remove all access for others
chmod o-rwx secrets.txt
# set exact permissions for group and others
chmod g=rx,o= app/
# set the setgid bit on a shared directory
chmod g+s /srv/project

u is the owner, g the group, o others and a all three. + adds, - removes and = sets exactly. In ls -l output, a lowercase s or t means the special bit and execute are both set. An uppercase S or T means the special bit is set without execute, which is usually a mistake.

Worked examples

Fix "Permission denied" when running a script

A new script is usually created as 644, which has no execute bit. Use chmod +x script.sh or chmod 755 script.sh, then run it with ./script.sh. The bash: Permission denied fix also covers noexec mounts and missing shebangs.

Lock down SSH keys

OpenSSH refuses private keys that other users can read. Set chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_ed25519. The public key and authorized_keys can be 644. The SSH keys guide and the Permission denied (publickey) fix go further.

Web root: different modes for files and directories

Never run chmod -R 755 across a whole tree, because it marks every file as executable. Use find to treat files and directories separately:

sudo find /var/www/site -type d -exec chmod 755 {} +
sudo find /var/www/site -type f -exec chmod 644 {} +

Or use the capital-X trick, which adds execute only to directories and to files that are already executable for someone: chmod -R u=rwX,g=rX,o=rX /var/www/site.

Common chmod mistakes

• Using 777 to make an error go away. It lets every local user and every compromised service rewrite the file. Fix ownership with chown, or add the user to the right group (see user and group management), and keep 755 or 775.
• chmod on a file whose directory blocks you. To reach /a/b/file you need execute on /a and /a/b. Check the whole path with namei -l /a/b/file.
• Expecting 755 to clear setgid on a directory. GNU chmod keeps the setuid and setgid bits on directories when you give a 3- or 4-digit mode. Clear them with chmod g-s dir or a 5-digit mode such as chmod 00755 dir.
• setuid on scripts. Linux ignores setuid on interpreted scripts. Use sudo rules instead.
• Fighting the umask. New files get 666 minus your umask, and new directories get 777 minus it. With the usual umask 022 that gives 644 and 755. If every new file comes out wrong, change the umask rather than running chmod again and again.
• Permissions look right but access is still denied. ACLs (a + after the mode in ls -l, read with getfacl), SELinux on Fedora and openSUSE Leap 16 (ls -Z, restorecon) or AppArmor on Ubuntu can still block access. On mounted Windows filesystems (NTFS, exFAT), the mount options set the permissions and chmod has no effect.

chmod, chown and umask behave the same on Ubuntu, Debian, Fedora, Arch and openSUSE because they all use GNU coreutils. For the full model, including ACLs and ownership, read Linux file permissions explained or the chmod(1) man page.

Frequently asked questions