chmod Calculator

How to use

1. Tick the read, write and execute boxes you want, or type an octal mode such as 755.
2. Paste a line from ls -l into the symbolic field to read an existing file's permissions.
3. Add a path to get the chmod command ready to run.
4. Check the umask panel to see what new files and directories will be created with.

Features

• All three notations stay in step: tick a box and the octal and symbolic forms both follow.
• Handles the special bits properly, including the capital S and T that mean the bit is set with no execute bit under it — almost always a mistake.
• Reads a line straight from ls -l, leading file-type character and all.
• Shows what a umask actually produces, which is a subtraction and not the permissions themselves.
• Warns when a special bit is set, because setuid on the wrong file is a privilege escalation waiting to happen.

Frequently asked questions

What does 755 actually mean?

Each digit is a sum: 4 for read, 2 for write, 1 for execute, one digit each for the owner, the group and everyone else. So 7 is 4+2+1, all three for the owner, and 5 is 4+1, read and execute for the group and for others. It is the normal mode for a directory or a program: the owner can change it, everybody else can use it.

Why does my mode have four digits?

The leading digit holds the three special bits: 4 is setuid, 2 is setgid and 1 is the sticky bit. chmod 755 and chmod 0755 are the same thing, but chmod 4755 is not — it makes the program run with its owner's privileges rather than those of whoever ran it. That is exactly how a handful of system tools work, and also how a great many privilege escalations start.

What is the difference between s and S in the symbolic form?

Lower case s means the special bit is set and there is an execute bit underneath it, which is the working combination. Capital S means the special bit is set with no execute bit to act on, so it does nothing at all. Seeing a capital S or T in ls -l almost always means somebody meant 4755 and typed 4644.

Why does umask 022 produce 644 rather than 755?

Because a umask says what to remove, and because new files do not start from 777. The shell asks for 666 for a file and 777 for a directory — never execute on a plain file, since a text file should not be runnable — and the umask is subtracted from that. Take 022 off 666 and you get 644; take it off 777 and you get 755.

Related tools