Linux File Permissions: chmod 755 Explained

Linux File Permissions - Reading chmod 755 Like a Sysadmin 🔐

Monday, 9:05 AM. Internal audit has scanned the server that builds the nightly risk report and sent your team one finding: "world-writable files detected." Your manager forwards it with a single line: "Which files, and can you fix them today?" To answer, you need to read a string like rwxr-xr-x as fluently as a balance sheet.

What it is: On Linux, macOS and every other Unix-like system, each file carries permissions that answer one question for three kinds of user: who may read it, change it, or run it? They are shown as a 9-character string such as rwxr-xr-x and set with the chmod command (short for change mode), most often with a 3-digit octal code such as 755.

🧠 The mental model: three badges, three doors

Picture the office that holds the file. There are three kinds of badge: the owner (usually whoever created the file), the group (a team, such as risk) and others (every account on the machine that is neither the owner nor in the group). Each badge can open up to three doors: read (see the contents), write (change or wipe them) and execute (run the file as a program). A - means that door stays locked.

Reading ls -l

ls -l lists each file with its permissions first:

-rwxr-xr-x 1 alice risk 2048 Sep 21 06:00 run_report.sh

From letters to digits: r = 4, w = 2, x = 1

Each permission is one on/off bit with a fixed value. Add the values inside one triplet and you get a single digit from 0 to 7:

rwx = 4 + 2 + 1 = 7
rw- = 4 + 2 + 0 = 6
r-x = 4 + 0 + 1 = 5
r-- = 4 + 0 + 0 = 4
--- = 0 + 0 + 0 = 0

So rwxr-xr-x becomes 7, 5, 5: 755. Three bits give exactly eight combinations (0 to 7), which is one digit in base 8, or octal. That is why chmod speaks octal: every digit is one badge, and because 4, 2 and 1 are powers of two, no two combinations ever add up to the same digit.

The codes you will meet every week

Why "world-writable" is the audit finding

Others means everyone else with an account on the server: colleagues in other teams, contractors, and any service account (a web server, say) that an attacker manages to take over. If others hold w, any of them can rewrite the file. A world-writable script that a scheduled job runs every night lets anyone change what that job does, with the job's own rights. A world-writable limits file lets anyone raise a trading limit, so a breach never shows up in the report.

In octal the check is a single bit: others can write when the last digit contains the 2, which means 2, 3, 6 or 7. Python tests one bit with the bitwise AND operator: int(mode[2]) & 2 is non-zero exactly when that write bit is on.

🔑 The rule behind it all: least privilege. Give each badge only the doors its job needs. Scripts can be 755 and reports 644; secrets are 600; no script or data file needs 777.

🔧 Try it for real (a Linux server, or the macOS Terminal)

# see the permission string of every file in the folder
ls -l
# set it with octal: owner rwx, group and others r-x
chmod 755 run_report.sh
# or with letters: take write away from others only
chmod o-w cleanup.sh
# SSH private keys must be owner-only
chmod 600 ~/.ssh/id_ed25519
# the audit query: regular files that others can write to
find /srv/reports -type f -perm -002

SSH enforces that key rule itself: it ignores a private key that group or others can access, with a warning that its permissions are too open.

Your Task

Audit sent you the permission strings of five files on the reporting server. Write the heart of to_octal(): turn each 3-letter triplet into its digit by adding r = 4, w = 2 and x = 1. The loop then flags every file whose others digit holds the write bit and prints the chmod that fixes them. Predict first: what does rw-r--r-- convert to, and how many of the five files will the review flag?