LFCS 36 🐧 File Permissions — rwx and Octal - KandZ

⏱️ Estimated read: 15 min | |

Every file on a Linux system carries a set of permission bits. The bits decide who can read the file, who can write to it, and who can execute it. The permissions apply to three classes of user: the owner of the file, the members of the file’s group, and everyone else. The combination of three classes and three bits produces the nine-character string that ls -l prints, and the same combination can be written as a three-digit octal number. The two representations carry the same information, and the LFCS exam expects fluency in both.

Key point: The permission bits are not advisory. They are enforced by the kernel on every read, write, and execute. A process that does not have the required bit is denied the operation, regardless of what the application intends.

Why permissions exist

The multi-user problem. A Linux system serves many users. Each user has files that the others should not read: private documents, credentials, work in progress. Without permissions, every file would be readable by every user, and the system would have no privacy.

The shared-resource problem. Some files must be shared. A project directory is read by every member of the team. A web server’s document root is readable by the web server process. Permissions express which class of user may access which resource.

The execute problem. A file that contains a program must be executable to run. A file that contains data must not be executable, because executing it is meaningless and potentially dangerous. The execute bit distinguishes the two.

The accident problem. A user can overwrite the wrong file, delete the wrong directory, or run the wrong script. The permission bits are the first line of defense. A file that is read-only cannot be overwritten by accident.

The service-account problem. A daemon runs as a specific user, and the files it needs are owned by that user or its group. The permissions determine what the daemon can read, write, and execute. A misconfigured permission is a service that fails or a system that is exposed.

The script problem. A shell script with the execute bit runs as a program. The same script without the bit must be passed to the interpreter explicitly. The bit is what makes the file a command rather than a data file.

The audit problem. A review of the permission bits reveals what is shared, what is private, and what is exposed. The bits are the summary of the access policy, and they are the first thing an administrator checks.

a. The rwx bits

The nine permission bits are grouped into three sets of three. Each set applies to one class: the owner (user), the group, and the others. Within each set, the three bits are read, write, and execute.

The three classes

Class	Symbol	Applies to
User	`u`	The owner of the file
Group	`g`	The members of the file’s group
Others	`o`	Everyone else
All	`a`	All three classes

The three bits

Bit	Symbol	Octal	Meaning for a file	Meaning for a directory
Read	`r`	4	Read the file’s contents	List the directory’s entries
Write	`w`	2	Modify the file’s contents	Create, delete, or rename entries
Execute	`x`	1	Execute the file as a program	Enter the directory (cd, access a file by path)

The ls -l output

The ls -l command prints the permission string as the first column.

ls -l file.txt
# -rw-r--r-- 1 alice developers 1234 Jan 15 10:30 file.txt

The string is -rw-r--r--. The first character is the file type: - for a regular file, d for a directory, l for a symbolic link. The next nine characters are the permissions, in three groups of three: rw- for the owner, r-- for the group, r-- for the others.

The directory permissions

The directory permissions have a different meaning than the file permissions.

r on a directory means the entries can be listed with ls.
w on a directory means entries can be created, deleted, or renamed.
x on a directory means the directory can be entered with cd, and a file can be accessed by its path.

The x bit on a directory is required for any access to the files inside it. A directory with r but no x shows the names but does not allow access. A directory with x but no r allows access to known names but not listing.

The missing bit

When a bit is not set, ls -l prints a dash.

# Owner: read and write. Group: read. Others: nothing.
-rw-r-----

The last three characters are ---, which means no permissions for the others.

The two dashes

The permission string has ten characters. The first is the file type. The next nine are the permissions. The - in a permission position means the bit is not set.

The special bits

Three additional bits appear in the permission string when they are set.

Bit	Symbol	Position	Meaning
setuid	`s` in user execute	4th character	Execute as the file’s owner
setgid	`s` in group execute	7th character	Execute as the file’s group
sticky	`t` in others execute	10th character	Only the owner can delete

The setuid and setgid bits are represented by a lowercase s when the execute bit is set, and an uppercase S when the execute bit is not set. The sticky bit follows the same rule with t and T.

# setuid set, execute set:
-rwsr-xr-x

# setuid set, execute not set:
-rwSr-xr-x

# sticky set on a directory:
drwxrwxrwt

b. The octal notation

The permission bits are also written as a three-digit octal number. Each digit represents one class, and the value is the sum of the bits.

The octal values

Bit	Value
Read	4
Write	2
Execute	1

The sum of the bits in a class is the digit for that class.

The common combinations

Octal	String	Meaning
777	`rwxrwxrwx`	Everyone can do everything
755	`rwxr-xr-x`	Owner all, group and others read and execute
750	`rwxr-x---`	Owner all, group read and execute, others nothing
700	`rwx------`	Owner all, no one else
644	`rw-r--r--`	Owner read and write, everyone else read
640	`rw-r-----`	Owner read and write, group read
600	`rw-------`	Owner read and write, no one else
444	`r--r--r--`	Everyone read only
400	`r--------`	Owner read only

The digit arithmetic

Each digit is the sum of the bits for its class.

7 = 4 + 2 + 1 = rwx
6 = 4 + 2     = rw-
5 = 4 + 1     = r-x
4 = 4         = r--
3 = 2 + 1     = -wx
2 = 2         = -w-
1 = 1         = --x
0 = 0         = ---

The four-digit form

A four-digit octal number includes the special bits. The first digit is the sum of the setuid (4), setgid (2), and sticky (1) bits.

Octal	Special bits	String
4755	setuid	`rwsr-xr-x`
2755	setgid	`rwxr-sr-x`
1777	sticky	`rwxrwxrwt`
6755	setuid + setgid	`rwsr-sr-x`
7777	all three	`rwsrwsrwt`

The chmod octal

The chmod command accepts the octal form.

chmod 644 file.txt
chmod 755 script.sh
chmod 700 private/

The command sets all nine bits at once, replacing the previous permissions.

The chmod symbolic

The chmod command also accepts the symbolic form.

chmod u+x script.sh
chmod g-w file.txt
chmod o=r file.txt
chmod a+r file.txt

The symbolic form adds (+), removes (-), or sets (=) the bits for the specified classes.

The umask

The umask command shows or sets the default permissions mask. The mask is subtracted from the default permissions for new files and directories.

umask
# 0022

The mask 0022 means the group and others write bits are removed from new files. A new file has 666 - 022 = 644. A new directory has 777 - 022 = 755.

The default permissions

Type	Default	With umask 022
File	666	644
Directory	777	755

The default file permissions never include the execute bit. The chmod +x is required to make a file executable.

c. The practical scenarios

The permission bits are used in specific scenarios. The scenarios are the common tasks that the LFCS exam tests.

The executable script

A shell script must have the execute bit for the user or the group that runs it.

chmod 755 deploy.sh
./deploy.sh

The 755 gives the owner full permissions, and the group and others read and execute.

The private key

An SSH private key must be readable only by the owner. The SSH client refuses to use a key with broader permissions.

chmod 600 ~/.ssh/id_rsa

The 600 gives the owner read and write, and no one else any access.

The shared directory

A shared directory for a team is writable by the group.

mkdir /srv/project
chgrp developers /srv/project
chmod 2775 /srv/project

The 2775 sets the setgid bit, so new files created in the directory inherit the developers group. The group has write access.

The public web directory

A web server’s document root is readable and executable by everyone, and writable by the owner.

chmod 755 /var/www/html
chmod 644 /var/www/html/index.html

The directory is 755 so the server can enter it and read the entries. The file is 644 so the server can read it.

The /tmp directory

The /tmp directory is world-writable, but the sticky bit prevents users from deleting each other’s files.

ls -ld /tmp
# drwxrwxrwt 1 root root ... /tmp

The t is the sticky bit. Only the owner of a file, the owner of the directory, or root can delete it.

The read-only file

A file that must not be changed is set to read-only.

chmod 444 report.txt

The owner cannot write to the file either. To change it, the owner must first change the permissions.

The append-only log

A log file that only grows is writable by the process that appends to it, and readable by the administrators.

chmod 640 /var/log/app.log

The owner can read and write, the group can read, and the others have no access.

The no-access directory

A directory that must be completely private is set to 700.

chmod 700 ~/private

The owner has full access, and no one else has any.

The temporary file with the sticky bit

A shared temporary directory for a group uses the sticky bit.

mkdir /srv/shared-tmp
chgrp developers /srv/shared-tmp
chmod 1770 /srv/shared-tmp

The 1770 gives the owner full access, the group full access, and the others nothing. The sticky bit prevents group members from deleting each other’s files.

Complete Example Session

# ============================================
# PART 1: THE BASIC PERMISSIONS
# ============================================

touch file.txt
ls -l file.txt
# -rw-r--r-- 1 alice alice 0 ... file.txt

# ============================================
# PART 2: THE OCTAL FORM
# ============================================

chmod 600 file.txt
ls -l file.txt
# -rw------- 1 alice alice 0 ... file.txt

chmod 644 file.txt
ls -l file.txt
# -rw-r--r-- 1 alice alice 0 ... file.txt

# ============================================
# PART 3: THE SYMBOLIC FORM
# ============================================

chmod u+x script.sh
chmod g-w file.txt
chmod o=r file.txt
chmod a+r file.txt

# ============================================
# PART 4: THE DIRECTORY
# ============================================

mkdir project
chmod 755 project
ls -ld project
# drwxr-xr-x 2 alice alice 4096 ... project

# ============================================
# PART 5: THE EXECUTABLE SCRIPT
# ============================================

cat > hello.sh << 'EOF'
#!/bin/bash
echo "Hello, world!"
EOF

chmod 755 hello.sh
./hello.sh
# Hello, world!

# ============================================
# PART 6: THE PRIVATE KEY
# ============================================

chmod 600 ~/.ssh/id_rsa
ls -l ~/.ssh/id_rsa
# -rw------- 1 alice alice 1675 ... id_rsa

# ============================================
# PART 7: THE SHARED DIRECTORY
# ============================================

sudo mkdir /srv/project
sudo chgrp developers /srv/project
sudo chmod 2775 /srv/project
ls -ld /srv/project
# drwxrwsr-x 2 root developers 4096 ... /srv/project

# ============================================
# PART 8: THE STICKY BIT
# ============================================

ls -ld /tmp
# drwxrwxrwt 1 root root 4096 ... /tmp

# ============================================
# PART 9: THE UMASK
# ============================================

umask
# 0022

umask 0077
umask
# 0077

# New files have 600, new directories have 700.

# ============================================
# PART 10: THE SPECIAL BITS
# ============================================

# setuid
chmod 4755 /usr/local/bin/program
ls -l /usr/local/bin/program
# -rwsr-xr-x 1 root root ... program

# setgid
chmod 2755 /srv/project
ls -ld /srv/project
# drwxr-sr-x 2 root developers ... /srv/project

# sticky
chmod 1777 /tmp
ls -ld /tmp
# drwxrwxrwt 1 root root ... /tmp

The ten parts showed the basic permissions, the octal form, the symbolic form, the directory, the executable script, the private key, the shared directory, the sticky bit, the umask, and the special bits.

Quick Reference

The Permission Bits

Bit	Symbol	Octal	File	Directory
Read	`r`	4	Read contents	List entries
Write	`w`	2	Modify contents	Create, delete entries
Execute	`x`	1	Execute	Enter, access by path

The Octal Values

Octal	String
7	`rwx`
6	`rw-`
5	`r-x`
4	`r--`
3	`-wx`
2	`-w-`
1	`--x`
0	`---`

The Common Modes

Octal	String	Use Case
755	`rwxr-xr-x`	Executables, directories
644	`rw-r--r--`	Regular files
700	`rwx------`	Private directories
600	`rw-------`	Private files, keys
640	`rw-r-----`	Group-readable files
444	`r--r--r--`	Read-only files
777	`rwxrwxrwx`	World-writable (avoid)

The Special Bits

Bit	Octal	Symbol	Meaning
setuid	4	`s`	Run as the file’s owner
setgid	2	`s`	Run as the file’s group
sticky	1	`t`	Only the owner can delete

The chmod Forms

Form	Example
Octal	`chmod 644 file`
Symbolic add	`chmod u+x file`
Symbolic remove	`chmod g-w file`
Symbolic set	`chmod o=r file`
Symbolic all	`chmod a+r file`

The umask

umask	Files	Directories
022	644	755
027	640	750
077	600	700
002	664	775

Best Practices

✅ Do This:

# Use 755 for executables and directories.
chmod 755 script.sh  # ✅

# Use 644 for regular files.
chmod 644 index.html  # ✅

# Use 600 for private keys.
chmod 600 ~/.ssh/id_rsa  # ✅

# Use 700 for private directories.
chmod 700 ~/private  # ✅

# Use 2775 for shared group directories.
chmod 2775 /srv/project  # ✅

# Use the sticky bit for shared world-writable directories.
chmod 1777 /tmp  # ✅

# Set the umask before creating files.
umask 022  # ✅

# Verify with ls -l.
ls -l file.txt  # ✅

❌ Don’t Do This:

# Don't use 777 for anything.
chmod 777 /var/www/html  # ❌ World-writable

# Don't use 777 for directories.
chmod 777 uploads/  # ❌ Any user can delete files

# Don't forget the execute bit on a script.
chmod 644 script.sh  # ❌ ./script.sh fails

# Don't forget the read bit on a directory.
chmod 300 dir/  # ❌ ls fails

# Don't give the others write access.
chmod o+w file  # ❌ Anyone can modify

# Don't set setuid on a script.
chmod 4755 script.sh  # ❌ setuid is ignored on scripts

# Don't rely on the umask for security.
# Set the permissions explicitly.  # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Script not executable	Missing `x` bit	`chmod +x script.sh`
Directory not listable	Missing `r` bit	`chmod +r dir/`
Directory not enterable	Missing `x` bit	`chmod +x dir/`
Key rejected	Too broad	`chmod 600 key`
File world-writable	`777`	Use `755` or `644`
setuid ignored	Applied to a script	Use a binary
Group not inherited	No setgid on the directory	`chmod g+s dir/`
Cannot delete a file	Sticky bit on the directory	Only the owner can delete

Real-World Examples

1. Executable Script

chmod 755 deploy.sh

2. Private Key

chmod 600 ~/.ssh/id_rsa

3. Shared Directory

chmod 2775 /srv/project

4. Public File

chmod 644 /var/www/html/index.html

5. Private Directory

chmod 700 ~/private

6. Sticky Bit

chmod 1777 /tmp

7. Read-Only

chmod 444 report.txt

8. Group-Readable

chmod 640 /var/log/app.log

9. The umask

umask 077

10. The setgid Directory

chmod 2770 /srv/shared-tmp

Visual

The Permission String

┌────────────────────────────────────────────────────────────┐
│  THE PERMISSION STRING                                     │
│                                                            │
│  -rwxr-xr-x                                                │
│  │└┬┘└┬┘└┬┘                                                │
│  │ │  │  └── Others: r-x (5)                               │
│  │ │  └───── Group:  r-x (5)                               │
│  │ └──────── User:   rwx (7)                               │
│  └────────── Type:   - (regular file)                      │
│                                                            │
│  The nine bits are grouped into three classes.             │
│  Each class has three bits: r, w, x.                       │
│  Each bit has a value: 4, 2, 1.                            │
└────────────────────────────────────────────────────────────┘

The Octal Arithmetic

┌────────────────────────────────────────────────────────────┐
│  THE OCTAL ARITHMETIC                                      │
│                                                            │
│  rwx = 4 + 2 + 1 = 7                                       │
│  rw- = 4 + 2     = 6                                       │
│  r-x = 4     + 1 = 5                                       │
│  r-- = 4         = 4                                       │
│  -wx =     2 + 1 = 3                                       │
│  -w- =     2     = 2                                       │
│  --x =         1 = 1                                       │
│  --- =           = 0                                       │
│                                                            │
│  Example: 755                                              │
│  User:  7 = rwx                                            │
│  Group: 5 = r-x                                            │
│  Other: 5 = r-x                                            │
└────────────────────────────────────────────────────────────┘

The Directory Permissions

┌────────────────────────────────────────────────────────────┐
│  DIRECTORY PERMISSIONS                                     │
│                                                            │
│  r (read)   → list the entries with ls                     │
│  w (write)  → create, delete, rename entries               │
│  x (execute)→ enter the directory, access files by path    │
│                                                            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  drwxr-xr-x  /var/www/html                        │     │
│  │                                                   │     │
│  │  The web server can:                              │     │
│  │    - List the directory (r)                       │     │
│  │    - Enter the directory (x)                      │     │
│  │    - Read the files inside (x on the directory)   │     │
│  │                                                   │     │
│  │  The web server cannot:                           │     │
│  │    - Create or delete files (no w)                │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

The Special Bits

┌────────────────────────────────────────────────────────────┐
│  THE SPECIAL BITS                                          │
│                                                            │
│  SETUID (4)                                                │
│  ┌──────────────────────────────────────────────────┐     │
│  │  -rwsr-xr-x                                       │     │
│  │  A program that runs as the file's owner.         │     │
│  │  Used by passwd, sudo, mount.                     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  SETGID (2)                                                │
│  ┌──────────────────────────────────────────────────┐     │
│  │  -rwxr-sr-x                                       │     │
│  │  On a file: run as the file's group.              │     │
│  │  On a directory: new files inherit the group.     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  STICKY (1)                                                │
│  ┌──────────────────────────────────────────────────┐     │
│  │  drwxrwxrwt                                       │     │
│  │  On a directory: only the owner can delete.       │     │
│  │  Used by /tmp.                                    │     │
│  └──────────────────────────────────────────────────┘     │
└────────────────────────────────────────────────────────────┘

The umask

┌────────────────────────────────────────────────────────────┐
│  THE umask                                                 │
│                                                            │
│  New file default: 666                                     │
│  New directory default: 777                                │
│                                                            │
│  umask 022                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  File:      666 - 022 = 644                       │     │
│  │  Directory: 777 - 022 = 755                       │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  umask 077                                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  File:      666 - 077 = 600                       │     │
│  │  Directory: 777 - 077 = 700                       │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The umask is subtracted from the default.                 │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
`r`	Read: 4
`w`	Write: 2
`x`	Execute: 1
User	The owner of the file
Group	The members of the file’s group
Others	Everyone else
Octal	The sum of the bits per class
setuid	4, run as the owner
setgid	2, run as the group
sticky	1, only the owner can delete
`chmod`	Change the permissions
`umask`	The default permission mask

Key takeaways:

The permission bits are grouped into three classes and three bits. The classes are user, group, and others. The bits are read, write, and execute. The nine bits are the entire access policy for the file.
The octal form is the sum of the bits per class. Each digit is 4 for read, 2 for write, and 1 for execute. The three digits represent the user, the group, and the others, in that order.
The directory permissions have different meanings. The r bit lists the entries, the w bit creates and deletes them, and the x bit enters the directory and accesses the files by path.
The execute bit is required for a script to run. A shell script with the execute bit runs as ./script.sh. Without the bit, it must be passed to the interpreter explicitly.
The setuid bit runs a program as the file’s owner. The bit is used by passwd, sudo, and mount. It is ignored on scripts for security reasons.
The setgid bit runs a program as the file’s group, or makes a directory inherit the group. On a directory, the setgid bit makes new files inherit the directory’s group, which is the standard pattern for shared team directories.
The sticky bit restricts deletion in a shared directory. Only the owner of the file, the owner of the directory, or root can delete the file. The /tmp directory uses the sticky bit.
The umask sets the default permissions. The mask is subtracted from the default permissions for new files and directories. A umask of 022 produces 644 for files and 755 for directories.
The chmod command changes the permissions. The octal form sets all nine bits at once. The symbolic form adds, removes, or sets the bits for the specified classes.

Remember: The permission bits are the kernel’s access control for every file on the system. The nine bits are grouped into three classes and three operations, and the octal form is the same information as a three-digit number. The directory permissions have different meanings than the file permissions, and the special bits add the setuid, setgid, and sticky behaviors. The chmod command changes the bits, and the umask sets the default. The result is a system where every file has an owner, a group, and a set of permissions, and where the access policy is enforced by the kernel on every operation.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!