Chmod calculator

What this tool does

Every file on a Unix system carries a set of permissions that decide who may read it, change it, or run it. The chmod command sets them, and it accepts those permissions in two quite different spellings — a three-digit octal number and a string of letters — that describe the exact same thing. This tool keeps both spellings, and a grid of checkboxes, in sync, so you can start from whichever one you have and copy the one you need.

It runs entirely in your browser and is pure arithmetic: there is no server, and nothing you type is sent anywhere. It is a calculator and a reference, not a way to change permissions on a real machine — for that you copy the chmod command it produces and run it yourself.

Three groups, three permissions

Permissions are organised as three groups of three. The three groups are the file’s owner, the group that owns it, and everyone else — “other”. Within each group there are three permissions: read, write and execute.

• Read (r) — view the file’s contents, or list a directory’s entries.
• Write (w) — change the file, or add and remove entries in a directory.
• Execute (x) — run the file as a program, or enter a directory and reach the files inside it.

Execute means something different for a directory than for a file, and that catches people out: a directory you can read but not execute lets you see the names of what is inside but not open any of it.

How the octal number works

Each group’s three permissions pack into one octal digit by adding up fixed values: read is 4, write is 2, execute is 1. Read-write-execute is 4+2+1 = 7; read-execute is 4+1 = 5; read-write is 4+2 = 6. Three groups give three digits.

755
7 = 4+2+1   # owner: read + write + execute
5 = 4+0+1   # group: read + execute
5 = 4+0+1   # other: read + execute

So 755 is “owner can do everything, everyone else can read and run but not change”, which is the usual mode for a program or a directory. 644 — owner read-write, everyone else read-only — is the usual mode for an ordinary file. Once the pattern is familiar the common modes read at a glance.

The symbolic string

The other spelling is the one ls -l prints: nine characters, three per group, each either its letter or a dash. 755 is rwxr-xr-x; 644 is rw-r--r--. It carries exactly the same information as the octal number, just laid out so you can see each permission rather than add digits in your head.

An ls -l line has a tenth character on the front — a d for a directory, a dash for a regular file, an l for a symbolic link. That leading character is the file’s type, not a permission, and chmod cannot change it. You can paste a whole ls -l permission field here and the type character is simply ignored.

The special bits: setuid, setgid and sticky

Above the nine ordinary bits sit three special ones, written as an optional fourth octal digit on the front — setuid (4), setgid (2) and the sticky bit (1). They do not get a column of their own; instead each one overloads an execute slot in the symbolic string, which is the source of the capital letters people find baffling.

• setuid on an executable makes it run as the file’s owner rather than as the user who launched it. This is how passwd can update a system file you cannot write to directly — and why a setuid program with a bug is a serious hole.
• setgid on an executable runs it as the file’s group. On a directory it does something more useful and safer: new files created inside inherit that directory’s group instead of the creator’s.
• The sticky bit on a directory means only a file’s owner can delete or rename it, even when everyone can write to the directory. This is what keeps /tmp shared but safe. On a plain file it does nothing.

In the symbolic string a set special bit turns its execute slot into a letter: s in the owner slot for setuid, s in the group slot for setgid, t in the other slot for sticky. The case tells you whether execute is also on — lowercase means yes, uppercase means no.

rwsr-xr-x  4755   # setuid, owner executes
rwSr-xr-x  4655   # setuid, owner does NOT execute
rwxrwxrwt  1777   # sticky, other executes
rwxrwxrwT  1776   # sticky, other does NOT execute

A capital S or T is almost always a mistake: it means a special bit was set on a file that is not executable, so the bit has nothing to act on.

Octal or symbolic on the command line

chmod accepts both forms, and this tool writes both. The octal form sets every bit at once: chmod 755 file. The symbolic = form does the same absolutely — chmod u=rwx,g=rx,o=rx file — listing each group so the result does not depend on what the file started as.

There is a third, relative form the calculator does not need but you will meet: chmod +x file adds execute for everyone, chmod g-w file removes group write, chmod o= file clears everything for other. That form changes bits relative to the current mode rather than setting the whole thing, which is handy on the command line but has no single “result” to display.

Modes worth not setting

A permission tool should also say when a mode is a bad idea. Two come up constantly:

• 777 gives every user read, write and execute. It is the reflex fix when something “won’t work”, and it almost always trades a small problem for a real security hole. The right mode is nearly always narrower — usually 755 or 644.
• Any world-writable file (the last digit including 2) lets any account on the machine rewrite its contents. For anything that is run, sourced, or trusted, that is a way in. Grant write to a group instead, or keep it to the owner.

The tool flags these as they occur. It cannot know whether your target is a file or a directory, so it phrases them as things worth a second look rather than as errors — the sticky bit is right on a directory and pointless on a file, and only you know which you have.