The Octal Encoding

Each rwx triplet is encoded as a single octal digit:

• r = 4
• w = 2
• x = 1

Sum the bits to obtain a digit 0–7. A full mode is three digits for owner, group and others (with an optional fourth digit at the front for special bits).

Conversion Table

Common Modes

Special Bits (Optional 4th Digit)

• 4 = setuid
• 2 = setgid
• 1 = sticky

chmod 4755 prog = setuid + 755 = -rwsr-xr-x. chmod 1777 /tmp = sticky + 777 = drwxrwxrwt.

Worked Examples

Example 1 — Make a script private and executable:

• Want owner rwx (7), group nothing (0), others nothing (0).
• chmod 700 secret.sh.

Example 2 — Public read-only document:

• Owner rw (6), group r (4), others r (4).
• chmod 644 readme.txt.

Example 3 — Setgid directory so new files inherit the group:

• Want directory mode rwxrwsr-x = setgid + 775 = octal 2775.
• chmod 2775 /shared.

Example 4 — Repair an SSH private key that GitHub complains about:

• Required: 600.
• chmod 600 ~/.ssh/id_ed25519.

Default Mode and umask Recap

• Files are created with mode (0666 & ~umask); directories with (0777 & ~umask).
• umask 022 → files 644, dirs 755.
• umask 077 → files 600, dirs 700 (private).

When Numeric Beats Symbolic

• Setting an exact mode regardless of previous state — chmod 600 ~/.ssh/id_rsa is unambiguous.
• Scripts that must reset known-good permissions.
• Documentation — three digits is universally understood.

Common Pitfalls

• Forgetting the leading 0 in shell scripts (chmod 0755 vs chmod 755 — both work but the 4-digit form makes the special-bits slot explicit).
• Using chmod 777 to "fix" permission errors — almost always indicates the wrong owner/group is the real problem.
• Setting an SSH key world-readable, then SSH refuses to use it. Always 600.

Quick Conversion Drill

Summary

• Each digit is a sum of 4 (r) + 2 (w) + 1 (x).
• Three-digit modes cover owner/group/other; an optional 4th covers setuid/setgid/sticky.
• Use numeric mode when you want absolute, idempotent permission settings.