Understanding Unix file permissions

Unix/Linux file permissions are controlled with a 9-bit octal system. Each file and directory has three permission groups: Owner, Group, and Others. Each group has three bits: read (r), write (w), and execute (x).

Octal notation

Octal	Binary	Permissions
0	000	--- (none)
1	001	--x (execute)
2	010	-w- (write)
3	011	-wx (write + execute)
4	100	r-- (read)
5	101	r-x (read + execute)
6	110	rw- (read + write)
7	111	rwx (all)

Common permission patterns

644 - owner: rw-, group: r--, others: r-- (typical file)
755 - owner: rwx, group: r-x, others: r-x (typical script/directory)
600 - owner: rw-, group: ---, others: --- (private key, SSH config)
777 - all users: rwx (avoid - insecure)

Special permission bits

Bit	Octal	Effect on files	Effect on directories
Setuid (SUID)	4xxx (e.g., 4755)	Process runs as file owner, not caller (e.g., `/usr/bin/passwd`)	No standard effect (ignored on most Linux systems)
Setgid (SGID)	2xxx (e.g., 2755)	Process runs with file's group	New files inherit directory's group; useful for shared project directories
Sticky bit	1xxx (e.g., 1777)	Historically prevented swapping; largely obsolete for files	Only the owner can delete their own files (used on `/tmp`)

Symbolic chmod notation

Octal notation sets all nine bits at once. Symbolic notation allows incremental changes without knowing the current permissions:

chmod +x file: add execute permission for all (user, group, other)
chmod u+x file: add execute for owner only
chmod go-w file: remove write from group and other
chmod u=rwx,g=rx,o=r file: set exact permissions symbolically (equivalent to chmod 754)
chmod a+r file: add read for all; a means all (same as ugo)

umask: default file creation permissions

The umask is a bitmask that is subtracted from the maximum permissions when creating new files and directories. The default umask is typically 022:

New files: 666 (max for files) − 022 = 644 (rw-r--r--)
New directories: 777 (max for directories) − 022 = 755 (rwxr-xr-x)

A more restrictive umask of 027 gives 640 for files and 750 for directories, preventing "others" from reading anything by default.