Updated 1 Nov 2026 · 6 min read
On this page
This guide takes you from reading a permission string such as -rwxr-x--- to setting any mode you need with chmod, in octal or symbolic form. You will also be able to change ownership with chown and chgrp, predict what umask does to new files, and recognise the setuid, setgid and sticky bits in ls -l output. Everything here follows the GNU coreutils documentation, the Linux man pages and the POSIX specification of ls.
Read, write and execute on files and directories
Each file has three kinds of permission for three categories of user: the file's owner, other users in the file's group, and everyone else. The same letter means something different on a directory, which is where most mistakes come from. The GNU coreutils manual defines them like this:
| Permission | On a file | On a directory |
|---|---|---|
| r (read) | Read the file | List the contents of the directory |
| w (write) | Change the file | Create and remove files in the directory (together with x, see below) |
| x (execute) | Run it as a program | Access files in the directory (search) |
Two consequences follow. Deleting a file depends on the directory, not on the file's own permissions: unlink(2) fails if the process lacks write access to the directory holding the file, or search permission on a directory in the path. The sticky bit, covered below, adds one more check. And to open a file by path, you need search permission on every directory along the way: path_resolution(7) says the lookup fails with EACCES ("Permission denied") if the process lacks search permission on a directory in the path.
Linux checks one class only. If your effective user ID (strictly, on Linux, the filesystem user ID, which ordinarily equals it) matches the file's owner, the owner bits are used. Otherwise, if the file's group matches your effective or supplementary groups, the group bits are used. Only when neither applies are the "other" bits used. So a file set to ----rwxrwx denies its own owner, even though everyone else has full access.
Octal modes
chmod(1) describes a numeric mode as one to four octal digits, each made by adding 4 (read), 2 (write) and 1 (execute). The last three digits are owner, group and others. If you give four digits, the first one sets the special bits: 4 for set user ID, 2 for set group ID and 1 for the restricted deletion (sticky) bit. Omitted digits are treated as leading zeros.
| Mode | Calculation | ls -l string |
|---|---|---|
| 755 | 4+2+1, 4+1, 4+1 | rwxr-xr-x |
| 644 | 4+2, 4, 4 | rw-r--r-- |
| 640 | 4+2, 4, 0 | rw-r----- |
| 600 | 4+2, 0, 0 | rw------- |
| 750 | 4+2+1, 4+1, 0 | rwxr-x--- |
The same values appear as constants in inode(7): owner read is 00400, write 00200, execute 00100, with the group and other bits following at 00040 and 00004 for read, and so on.
Symbolic modes
Symbolic modes change bits relative to what is already there. The format is [ugoa...][-+=]perms..., and several changes can be joined with commas. u is the owner, g other users in the file's group, o all other users and a all users. + adds permissions, - removes them and = makes them the only permissions for those users. The first three examples below come from the GNU manual:
chmod a=rw filegives everyone read and write, but not execute.chmod go-w fileremoves write for everyone except the owner and leaves everything else alone.chmod go= filegives everyone except the owner no access at all.chmod u=rwx,g=rx,o= scriptsets 750 in one command.
Two details are easy to miss. If you leave out the ugoa part, chmod acts as if you gave a, but bits set in your umask are not affected. And the capital X applies execute or search only if the file is a directory or already has execute permission for some user, which is handy with chmod -R because it makes directories searchable without making every data file executable. chmod does not change the permissions of symbolic links themselves: given a symlink on the command line, it changes the file the link points to.
Changing ownership with chown and chgrp
chown changes the user and, optionally, the group. The forms in chown(1) are:
chown alice file: alice becomes the owner, and the group is unchanged.chown alice:devs file: owner and group both change.chown alice: file: alice becomes the owner and the group changes to alice's login group.chown :devs file: only the group changes, the same aschgrp devs file.
Both commands accept -R to work recursively, as does chmod.
umask: masking, not subtraction
The umask is a process's file mode creation mask. umask(2) says that permissions set in the umask are turned off from the mode requested when a file or directory is created. The exception is a parent directory with a default ACL: then the umask is ignored and the ACL is inherited instead. The typical default is 022. Programs normally request 0666 for a new file, so the result is 0666 & ~022 = 0644, or rw-r--r--. For directories, mkdir(1) describes its default mode as a=rwx - umask, so a new directory gets 0777 with the umask bits removed: 0755 under umask 022.
It is a bitwise mask, so do the sum per bit, not by subtraction. With umask 027, files get 0640 and directories 0750. With umask 033, a new file gets 0644: the 3 turns off write and execute, and since a 6 (read and write) has no execute bit, only write is removed. Straight subtraction would give 0633, which is wrong. Run umask to see the current mask and umask -S for symbolic output.
SUID, SGID and the sticky bit
Three special bits sit above the nine permission bits. inode(7) gives their octal values: 04000 set-user-ID, 02000 set-group-ID and 01000 sticky.
- Set-user-ID (SUID): when the file is executed, the process's effective user ID becomes the file's owner. Linux ignores the set-user-ID and set-group-ID bits on scripts, and also on a filesystem mounted nosuid.
- Set-group-ID (SGID): on an executable, the effective group ID becomes the file's group. On a directory, files created inside inherit the directory's group rather than the creator's, and new subdirectories get the SGID bit too.
- Sticky bit (restricted deletion flag): on a directory, only the file's owner, the directory's owner or a privileged process can rename or delete a file in it. It is commonly set on world-writable directories such as
/tmp.
In ls -l, the special bits replace the execute position of the relevant class. SUID shows in the owner's execute slot and SGID in the group's: lowercase s if execute is also set, uppercase S if it is not. The sticky bit shows in the others' execute slot on a directory: t if others have search permission, T if they do not.
| Command | Result in ls -l |
|---|---|
chmod 4755 prog |
rwsr-xr-x |
chmod 4644 file |
rwSr--r-- |
chmod 2770 shared/ |
rwxrws--- |
chmod 1777 scratch/ |
rwxrwxrwt |
chmod 1770 scratch/ |
rwxrwx--T |
Symbolically, u+s sets SUID, g+s sets SGID, +t sets the sticky bit and a-s removes both SUID and SGID.
How this fits your exam
LPI LPIC-1 101-500. The version 5.0 objectives include 104.5 "Manage file permissions and ownership" (weight 3). Its key knowledge areas are managing access permissions on regular and special files and directories, using suid, sgid and the sticky bit, changing the file creation mask, and using the group field to grant access to group members. The listed utilities are chmod, umask, chown and chgrp. The LPIC-1 101-500 guide covers the other topics.
CompTIA Linux+ XK0-006. CompTIA's objectives summary lists "Control permissions, create links, and manage special files" under Services and User Management (20%), "Apply permissions, configure sudo, and secure remote access" under Security (18%), and "Fix SELinux, permission, and vulnerability issues" under Troubleshooting (22%). See the Linux+ XK0-006 guide.
Red Hat EX200 RHCSA. The exam is based on Red Hat Enterprise Linux 10, and its objectives include "List, set, and change standard ugo/rwx permissions", "Diagnose and correct file permission problems" and "Manage default file permissions". The RHCSA EX200 guide explains the performance-based format.
Frequently asked questions
Why did chmod 755 not clear the setgid bit on my directory?
GNU chmod preserves the set-user-ID and set-group-ID bits on directories unless you explicitly say otherwise. Use a symbolic mode such as g-s, or a numeric mode with an extra leading zero such as 00755.
Does root ignore file permissions?
Mostly. On Linux, the CAP_DAC_OVERRIDE capability overrides all permission checking, but it grants execute permission only when at least one of the file's three execute bits is set. A process with filesystem user ID 0 has this capability.
What is the difference between lowercase x and capital X in chmod?
Lowercase x applies execute (or search on a directory) to every file it touches. Capital X applies it only if the file is a directory or already has execute permission for some user, so it is the safer choice for recursive changes.
Sources
- chmod(1) - Linux manual page
- umask(2) - Linux manual page
- inode(7) - Linux manual page
- Mode Structure (GNU Coreutils 9.12)
- LPIC-1 Exam 101 and 102 Objectives
- Red Hat Certified System Administrator exam | EX200
Practise permission questions with the free LPIC-1 101-500 practice questions, then read the LPIC-1 exam guide.