In plain words
On Linux and macOS, each file has three locks: one for its owner, one for its group, one for everyone else. Each lock opens or not three doors: read, write, execute. chmod 640 is the coded way of saying "the owner reads and writes, the group reads, the others nothing". The calculator translates both ways.
Reading octal notation
Each digit is the sum of the rights granted: 4 to read, 2 to write, 1 to execute. The three digits apply, in order, to the owner, the group and the others.
| Digit | Rights | Symbolic |
|---|---|---|
| 7 | read, write, execute (4+2+1) | rwx |
| 6 | read, write (4+2) | rw- |
| 5 | read, execute (4+1) | r-x |
| 4 | read only | r-- |
| 0 | no rights | --- |
A fourth digit, in front, carries the special bits: 4 for setuid, 2 for setgid, 1 for the sticky bit. So 2775 is a 775 folder with setgid.
File or folder: the rights do not mean the same thing
| Right | On a file | On a folder |
|---|---|---|
r |
Read the contents | List the file names |
w |
Modify the contents | Create, rename, delete files (with x) |
x |
Run as a program | Enter the folder and open its files |
The right to delete a file
Deleting a file depends on the rights on the folder that contains it, not on the file itself. That is why /tmp has the sticky bit (1777): everyone can write to it, but each user can only delete their own files.
The umask
The umask removes rights from files and folders when they are created. You start from 666 for a file and 777 for a folder, then take away the umask's rights: with 022, you get 644 and 755. A umask of 027 also removes all access for others (640 and 750): a good setting for a server.
umask # show the current umask
umask 027 # change it for the current session
To make it permanent, add the line umask 027 to ~/.profile, or set UMASK in /etc/login.defs for all users.
To go further with running a Linux server, see Securing SSH access and Essential Linux commands for beginners.