Rights not altered by the addition or subtraction in such a command remain unmodified. The
letter a, for all, covers all three categories of users, so that a=rx grants all three categories the
same rights (read and execute, but not write).
The (octal) numeric representation associates each right with a value: 4 for read, 2 for write, and
1 for execute. We associate each combination of rights with the sum of the three figures, and a
value is assigned to each category of users, in the usual order (owner, group, others).
For instance, the
chmod 754
file
command will set the following rights: read, write and execute
for the owner (since 7 = 4 + 2 + 1); read and execute for the group (since 5 = 4 + 1); read-only for
others. The 0 means no rights; thus
chmod 600
file
allows for read and write permissions for the
owner, and no rights for anyone else. The most frequent right combinations are 755 for executable
files and directories, and 644 for data files.
To represent special rights, you can prefix a fourth digit to this number according to the same
principle, where the setuid, setgid, and sticky bits are 4, 2, and 1, respectively. The command
chmod 4754
will associate the setuid bit with the previously described rights.
Note that the use of octal notation only allows you to set all the rights at once on a file; you cannot
use it to add a new right, such as read access for the group owner, since you must take into account
the existing rights and compute the new corresponding numerical value.
The octal representation is also used with the
umask
command, which is used to restrict permis-
sions on newly created files. When an application creates a file, it assigns indicative permissions,
knowing that the system automatically removes the rights defined with
umask
. Enter
umask
in a
shell; you will see a mask such as
0022
. This is simply an octal representation of the rights to be
systematically removed (in this case, the write rights for the group and other users).
If you give it a new octal value, the
umask
command modifies the mask. Used in a shell initial-
ization file (for example,
~/.bash_profile
), it will effectively change the default mask for your
work sessions.
TIP
