Permission Bits and the Number chmod Wants
A Unix file mode is nine switches: read, write and execute, repeated for the owner, the group and everyone else. Documentation draws them as rwxr-xr-x, the kernel stores them as bits, and chmod takes them as a three-digit number. When you have worked out the switches and need the number, this page does the middle step for you.
111101101 becomes 111 101 101 = 755, the mode of a typical executable script.Where Nine Bits Turn Up
Teaching the Permission Model
Hardening a Deployment
The same three-bit grouping explains why octal survives at all: base-8 was designed for machines whose words divided neatly into groups of three, and file permissions inherited the habit.
Grouping Your Bits in Threes
Write the switches as bits
Turn each letter into a 1 and each dash into a 0, left to right, owner first. rw-r--r-- becomes 110100100.
Take the three digits below
Nine bits always produce a three-digit mode. If you see only two digits, the owner group started with a zero and you can add it back yourself.
Use it on the command line
The copy button on the octal field adds the 0o marker used by Python and modern JavaScript. Strip it when you type a plain chmod 644 file.
640 into the lower field and its nine bits appear above, ready to read off as letters. Swap moves you to the octal-first page with the value carried across.From rwx Bits to a chmod Number
Each three-bit group is independent, so you only ever need to know eight combinations. Learn this table and you can read any mode string at a glance, in either direction.
| Switches | Bits | Digit | What the holder may do |
|---|---|---|---|
rwx | 111 | 7 | Read, change and run it |
rw- | 110 | 6 | Read and change, but not execute |
r-x | 101 | 5 | Read and run, no edits — the usual script setting |
r-- | 100 | 4 | Read only |
-wx | 011 | 3 | Write and run without reading — a rare drop box |
--x | 001 | 1 | Enter a directory without listing it |
Digits Spaced in Threes
Longer octal results are shown in groups of three, which keeps a twelve-bit mode with its special-bit digit readable.
Letters Never Reach the Field
Typing r, w or x by mistake changes nothing — the input keeps only 0 and 1, so a half-translated string cannot be converted by accident.
Bookmark a Worked Example
A ?v= value in the address opens the page already filled in, which is useful for a runbook that documents one exact mode.
Permission Bit Questions
What if my bit count is not a multiple of three?
Grouping starts at the right, so the leftmost group is simply short — the value is still correct. For permission work, type all nine positions including the zeros so the digit count matches what chmod expects.
Where do setuid and the sticky bit fit in?
They live in a fourth group in front of the other nine. Type twelve bits instead: 100111101101 gives 4755, a setuid executable. The values are 4 for setuid, 2 for setgid and 1 for the sticky bit.
Why does a directory need the execute bit?
On a directory that bit means "may traverse". Without it you cannot reach anything inside, even with the read bit set, which is why 755 rather than 644 is the normal directory mode.
Can I convert a umask this way?
Yes, but remember a umask lists the bits to remove. Convert its nine bits as usual and read the answer as a subtraction: 000010010 gives 022, which strips group and other write access.
Does the result work as an argument in Ansible or Terraform?
Both want the digits quoted, as in mode: "0644", because an unquoted number would be read as decimal by the YAML parser. Paste the digits and add the leading zero and the quotes yourself.
No comments yet. Be the first to comment!