Linux file and directory permissions

What it means

Each permission digit is a sum of bits: read contributes 4, write 2 and execute 1. In 0750, the last three digits represent owner = 7, group = 5 and other = 0. Thus 7 contains all three bits, 5 contains read and execute, and 0 contains none.

The owner, group and other digits are alternatives for the basic check, not permissions to add together. On Linux, first compare the process's filesystem user ID with the file's owner ID: a match selects owner. Otherwise, group applies when the file's group matches the process's filesystem group ID or one of its supplementary groups. If neither match applies, use other. The filesystem IDs normally equal the corresponding effective IDs. Once a class is selected, this basic check does not fall back to a more permissive class.

Here, the Effective class dropdown supplies that choice directly. It does not discover or change process credentials or group membership; the model calculates only the selected class's mode-bit result.

Try it

Simulation: this is a local synthetic bit check, not a filesystem permission change. Start with Effective class = group, Octal mode = 0750 and Operation = read. Change only Octal mode to 0700, then inspect the result and its explanation. Use Compare with baseline to display the baseline and current outcomes.

Initially: Permitted by these mode bits. The group class has octal digit 5; the read operation requires bit 4. Changing the mode to 0700 removes that bit from the selected group digit, so the result becomes denied.

Keep Effective class = group and Operation = read. Only Octal mode changes from 0750 to 0700; no credentials, path or other access policy is evaluated.

Reset restores Effective class = group, Octal mode = 0750 and Operation = read, removes input errors and clears the comparison. It does not change which FAQ answers or the About this model panel you have opened or closed.

How it works

The calculation has two stages: select the digit for the supplied class, then test whether that digit contains the required operation bit. For the baseline, group selects the middle permission digit in 0750: 5. Because 5 = 4 + 1, it contains read and execute but not write. The requested read bit is 4, so this limited check permits the read.

The selected digit matters more than how permissive the mode looks as a whole. In a separate synthetic case, Effective class = other, Octal mode = 0644 and Operation = write selects digit 4. That digit contains read but not the required write bit 2, so the result is denied. The owner's digit 6 is not part of that calculation.

Object type changes the meaning of the operation. For a regular file, read and write concern file contents, while execute concerns execution. For a directory, execute is search permission: path lookup needs it to proceed through the directory to a named entry. Reaching that entry and obtaining access to the final object are separate conditions. This is why a file's matching read bit cannot, by itself, establish that the process can open the file.

Worked example

This is a synthetic baseline, not an observation from a Linux machine.

Permitted by these mode bits. The group class has octal digit 5; the read operation requires bit 4.

The intermediate evidence is the selected digit, 5—not the owner's 7 or the entire number 0750. Since 5 contains bit 4, the requested operation passes this bit test.

What changes when the condition changes

Change only Octal mode from 0750 to 0700. Keep Effective class = group and Operation = read.

Denied by these mode bits. The group class has octal digit 0; the read operation requires bit 4.

The owner still has digit 7, but the selected group digit has changed from 5 to 0. The group no longer has the read bit, and the model does not borrow it from the owner's permissions. Changing this dropdown changes only the synthetic input, not a real file's mode.

In practice

On a Linux system you own or are authorized to inspect, keep the first pass read-only and limited to the failed operation and its exact path. Record whether the target is a regular file or directory, its owner, group and mode, and the credentials of the process that failed. Your interactive shell may not have the same credentials as a web server or background service.

Inspect the required ancestor directories as well as the final object. The useful observation is whether the relevant class has the required bit at each applicable check—not merely whether a familiar-looking mode appears on the final file.

• If the selected class lacks the requested bit, that explains the denial within the basic mode-bit model.
• If that bit is present, do not declare access successful. Path traversal or another access-control condition may still prevent it.
• If you cannot establish the process identity, applicable class or required path permissions, the real access outcome remains unknown from this evidence.

STOP before changing permissions if the path, credentials, ACLs, mount policy or another restriction remains unexplained. Do not use 0777 or a broad recursive permission change to diagnose one denial. This page prescribes no filesystem mutation; any later change needs an authorized, object-specific plan with a recorded before-state, verification of the original operation and a rollback plan.

Limits and unknowns

The result is deliberately phrased “by these mode bits.” The Simulation does not evaluate ACLs, effective IDs, supplementary groups, directory ancestors, capabilities or mount policy. It cannot determine which class a real process should use, whether the path is reachable, or whether a real read, write or execution will succeed.

For valid offered inputs, the model returns a permitted-or-denied bit result; it does not produce a diagnosis of a real system. Missing real-world evidence remains unknown even when the local calculation is definite. If an input is reported as invalid, no calculated outcome applies until you correct it or use Reset; do not rely on an earlier result.

The initial example and explanation remain readable without JavaScript. Interactive controls require JavaScript. No machine, account, filesystem or network service is inspected.

What to carry forward

Treat a mode-bit result as one layer of access evidence. A missing bit explains the limited model's denial; a present bit does not establish successful access on a real machine. Before considering a permission change, connect the failed operation to the process's credentials, the relevant permission class and the required path traversal.