Symbolic chmod Notation: u, g, o, a With Plus, Minus and Equals
Symbolic notation names a class (u, g, o or a), an operator (+, - or =) and a set of permissions. Plus and minus adjust what is already there; equals replaces a class outright, which is what makes an equals form safe to apply repeatedly.
At a glance
- Classes
- u owner, g group, o others, a all three. Omitting the class means all three, masked by the umask
- Operators
- + adds, - removes, = sets the class to exactly this and clears the rest
- Permissions
- r read, w write, x execute, X conditional execute, s setuid or setgid, t sticky
- Capital X
- Sets execute only on directories and on files that already have execute for some class
- Clearing a class
- o= with nothing after it removes every permission from others
- What the calculator emits
- The absolute clause form, for example chmod u=rwx,g=rx,o=rx file
- What its symbolic box accepts
- A 9 character string such as rwxr-xr-x, optionally with a leading type character such as the d from an ls -l line
In detail
Octal sets all nine bits at once, which is precise and destructive: you have to know and restate every permission even if you only wanted to change one. Symbolic notation changes a class at a time, so chmod g+w adds group write and leaves everything else exactly as it was. For an incremental change on a file whose current mode you have not checked, that is the safer instrument.
The operators are not interchangeable. Plus and minus are relative, so the result depends on what was already set, which makes them unpredictable in a script run against files in unknown states. Equals is absolute for the class it names: chmod g=rx sets group to read and execute and clears group write whatever was there before. Scripts should prefer equals or octal for that reason.
Capital X is the piece most people never learn and the one that solves the recursive chmod problem. It sets the execute bit only on directories and on files that already have execute set for at least one class, so chmod -R a+rX makes a whole tree readable and traversable without marking every text file as a program.
Omitting the class has a subtlety: chmod +x is equivalent to a+x with the umask applied, so under a umask of 077 it adds execute for the owner only. Writing chmod a+x or chmod u+x says exactly what you mean and removes the dependency on an ambiguous environment value.
The calculator works in both directions and it is worth knowing which form each box takes. Its symbolic input accepts the nine character rendering you would copy out of an ls -l line, with or without the leading type character, and its output includes the clause form you would paste into a terminal. Octal accepts three or four digits and converts either way.
Examples
chmod u+x script.sh # add execute for the owner
chmod go-w shared.conf # remove write from group and others
chmod a+r public.txt # everyone can read
chmod o= private.txt # others get nothing at allchmod u=rwx,g=rx,o=rx deploy.sh # same as 755
chmod u=rw,g=r,o= .env # same as 640
chmod u=rwx,g=rwx,o=rwxt /srv/tmp # same as 1777chmod -R a+x ./src # every .ts file becomes executable
chmod -R a+X ./src # only directories, and files that
# already had an execute bit
# the usual safe recursive form
chmod -R a=rX,u+w ./srcThings that catch people out
- chmod +x without a class is masked by the umask, so it does not always mean a+x. Write the class explicitly.
- Plus and minus depend on the current mode, so running the same command against two files in different states produces two different results. Use equals or octal when the outcome must be deterministic.
- Lowercase x in a recursive chmod marks every regular file executable. Capital X is what you almost always meant.
- A symbolic clause with s or t needs the matching execute bit to do anything. u=rws without an execute bit renders as capital S and has no effect.
Try it: Chmod Calculator
Tick the nine permission boxes, or type an octal or symbolic value, and get the three digit and four digit octal, the ls -l rendering and the exact chmod command back.
Chmod Calculator
LOCAL · Browser-OnlyCalculate Unix file permissions with an interactive chmod builder
Permission Matrix
| Entity | Read (4) | Write (2) | Execute (1) | Octal | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | rwx | |||
| Group (g) | 5 | r-x | |||
| Others (o) | 5 | r-x |
Special Bits
Advanced permission flags for executables and directories
Generated Permissions
755rwxr-xr-x-rwxr-xr-xchmod 755 filenamechmod u=rwx,g=rx,o=rx filenamePermission Breakdown
Owner (u)
7rwx- - Read files / list directory contents
- - Write / modify / delete
- - Execute / traverse directory
Group (g)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Others (o)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Common Permissions Reference
| Octal | Symbolic | Meaning |
|---|---|---|
777 | rwxrwxrwx | Full access for everyone |
755 | rwxr-xr-x | Owner full, others read and execute |
750 | rwxr-x--- | Owner full, group read and execute |
700 | rwx------ | Owner full access only |
666 | rw-rw-rw- | Read and write for everyone |
644 | rw-r--r-- | Owner read/write, others read only |
600 | rw------- | Owner read/write only |
555 | r-xr-xr-x | Read and execute for everyone |
444 | r--r--r-- | Read only for everyone |
400 | r-------- | Owner read only |
Related File permissions
All file permissions →Four Digit Octal Modes Against Three Digit Ones
The leading digit of a four digit mode carries setuid, setgid and the sticky bit. When 0755 and 755 differ, and what GNU chmod does to directories.
Recursive chmod and Why 755 Across a Source Tree Is Wrong
chmod -R applies one mode to files and directories alike, which is almost never what you want. The find and capital X patterns that do the job properly.
chmod +x: Making a File Executable and the umask Catch
chmod +x adds the execute bit, but without a class it is masked by the umask. Why scripts also need read, and how to record the bit in version control.
How to Read an ls -l Permission String Such as rwxr-xr-x
The ten characters at the start of an ls -l line decode to a file type and three permission classes. What s, S, t, T and a trailing plus mean.
chmod 777: Everyone Gets Everything
777 gives read, write and execute to the owner, the group and everyone else. What it actually allows, why it is never the real fix, and what to use instead.
chmod 775: Owner and Group Write, Everyone Else Reads
775 gives the owner and group full access and leaves others with read and execute. The correct mode for shared directories, and why it needs setgid.
Tools for this
- Chmod Calculator Free online chmod calculator - calculate Unix file permissions with an interactive chmod builder