Unix Permissions Reference: Numeric, Symbolic, and ACL Formats

Permission Format Overview

Unix systems represent file permissions in several formats. The two most common are numeric (octal) and symbolic notation. Access Control Lists (ACLs) provide a finer-grained extension when the basic owner-group-others model is not enough.

Knowing how to convert between these formats saves time and prevents mistakes when configuring servers, writing deployment scripts, or auditing file security.

Numeric to Symbolic Conversion

Each octal digit maps directly to three permission bits. The digit is the sum of read (4), write (2), and execute (1).

To convert a three-digit mode like 755, map each digit independently:

• 7 = rwx (owner)
• 5 = r-x (group)
• 5 = r-x (others)

Result: rwxr-xr-x

Symbolic to Numeric Conversion

Read each triplet and add the values for permissions that are present:

• rwx = 4 + 2 + 1 = 7
• r-x = 4 + 0 + 1 = 5
• rw- = 4 + 2 + 0 = 6
• r-- = 4 + 0 + 0 = 4

Example: rw-r----- becomes 640.

Complete Permission Mode Reference

Special Permission Modes

Include a leading digit for setuid (4), setgid (2), or sticky bit (1). Combine by adding: setuid + setgid = 6, setgid + sticky = 3, all three = 7.

Access Control Lists (ACLs)

Traditional Unix permissions limit you to one owner, one group, and one set of "other" permissions. ACLs break through this limitation by letting you grant specific users or groups access without changing the file's ownership.

When to Use ACLs

• Multiple teams need different access levels to the same directory
• A single user outside the file's group needs read access
• You want to avoid creating extra groups for simple access rules

Viewing ACLs

getfacl project.conf
# file: project.conf
# owner: alice
# group: developers
# user::rw-
# user:bob:r--
# group::rw-
# mask::rw-
# other::r--

The user:bob:r-- entry grants user Bob read access, regardless of group membership.

Setting ACLs

# Give Bob read access
setfacl -m u:bob:r project.conf

# Give the qa group read-write access
setfacl -m g:qa:rw project.conf

# Remove Bob's entry
setfacl -x u:bob project.conf

# Remove all ACLs, revert to standard permissions
setfacl -b project.conf

ACL Mask

The mask limits the maximum permissions ACL entries can grant. It acts as a ceiling, not an additional restriction. When you set an ACL, the system automatically recalculates the mask.

# Set mask to read-only — all ACL entries are capped at r--
setfacl -m m::r project.conf

Without understanding the mask, ACL changes can appear to "not take effect."

Web Server Permission Best Practices

Web servers are a frequent target. Misconfigured permissions are one of the most common ways attackers escalate access.

Recommended Permissions

Key Rules

• The web server should never write to the document root. If it must accept uploads, isolate them in a separate directory.
• Never run the web server as root. Use a dedicated low-privilege account.
• Set the sticky bit on upload directories so users cannot delete each other's files.
• Avoid 777 under all circumstances. If a process needs write access, grant it specifically via ownership or ACLs.

Deployment Script Example

#!/bin/bash
WEBROOT="/var/www/html"

# Set safe ownership
sudo chown -R root:root "$WEBROOT"

# Directories: 755
find "$WEBROOT" -type d -exec chmod 755 {} +

# Files: 644
find "$WEBROOT" -type f -exec chmod 644 {} +

# Upload directory: owned by web server, group writable
sudo chown -R www-data:www-data "$WEBROOT/uploads"
sudo chmod 1770 "$WEBROOT/uploads"

# Config with database credentials: root-owned, group-readable
sudo chmod 640 "$WEBROOT/config.php"
sudo chgrp www-data "$WEBROOT/config.php"

Security Considerations

• Minimize write access: Every writable path is an attack surface. If your web app does not need to write to a directory, make it read-only.
• Audit setuid/setgid binaries: Run find / -perm -4000 -type f regularly. Unexpected setuid binaries are a sign of compromise.
• Check world-writable files: find / -perm -o+w -type f lists files anyone can modify. Review each one.
• Use ACLs for precision: When you need to grant access to one extra user, an ACL is safer than widening group or other permissions.
• Restrict SSH key permissions: SSH ignores keys that are readable by others. Use mode 600 for private keys and 644 for public keys.
• Log permission changes: For compliance, log all chmod, chown, and setfacl commands via audit rules.

Format Conversion Quick Reference

Key Takeaways

• Numeric and symbolic formats are interchangeable — each digit maps to an rwx triplet
• Special bits (setuid, setgid, sticky) use a leading octal digit: 4, 2, 1
• ACLs extend the traditional model with per-user and per-group entries
• The ACL mask limits the maximum effective permissions — understand it before using ACLs
• Web server permissions should follow the principle of least privilege: 755/644 defaults, isolated upload directories, owned by root where possible
• Audit world-writable and setuid files regularly

Try It Yourself

Use our chmod calculator to convert between numeric and symbolic formats, toggle special bits, and preview the exact chmod command before running it.

Related Guides

• Chmod Guide — detailed walkthrough of chmod command syntax and usage
• Linux File Permissions — owner/group/others model, special bits, and umask explained