chmod: octal and symbolic

Two notations for one job

chmod changes the nine bits. It takes the mode either as octal or as a mode control word, and the two forms are not interchangeable in style — they answer different questions:

chmod [options] octal-mode    file-list
chmod [options] symbolic-mode file-list

The octal form is absolute: it states all nine bits at once and overwrites whatever was there. The symbolic form is relative: it names a class, an operation and a privilege, and touches nothing it does not mention. Two options matter — -R descends recursively through any directory in the list, and -f forces, suppressing the error messages.

The mode control word

A symbolic mode is <who><operator><privilege>, and several may be joined with commas (no spaces):

• who — u owner, g group, o other, a all three. Several may be run together, as in go. Omit it and a is assumed.
• operator — + add, - remove, = set exactly (which clears everything the clause does not name).
• privilege — r, w, x; s for the set-ID bits and t for the sticky bit; or u, g or o meaning copy that class's current privileges.

That last one carries a constraint worth memorising: u, g and o may be used as a privilege only with =. chmod g=u file makes the group triple match the owner triple. chmod g+u file is not a thing.

Worked example — one change at a time, listed after every command

The discipline here is the lesson: run ls -ld after every single command, so each bit flip is visible before the next change is made.

$ ls -ld courses
drwx------  2 ada  dev  4096 Sep  1 09:02 courses
$ chmod 751 courses
$ ls -ld courses
drwxr-x--x  2 ada  dev  4096 Sep  1 09:02 courses

751 set all nine bits absolutely: owner 7 = rwx, group 5 = r-x, other 1 = --x. The same mode with a control word takes three clauses:

$ chmod u=rwx,g=rx,o=x courses
$ ls -ld courses
drwxr-x--x  2 ada  dev  4096 Sep  1 09:02 courses

Identical result, because = in each clause set that triple exactly. Now copy one class onto another:

$ chmod g=u courses
$ ls -ld courses
drwxrwx--x  2 ada  dev  4096 Sep  1 09:02 courses

The group triple became rwx because the owner triple is rwx. Note what did not change: other was never mentioned, so it kept its --x.

The short-octal trap

Finally, the mistake that is worth more exam marks than any other line in this chapter:

$ chmod 7 courses
$ ls -ld courses
d------rwx  2 ada  dev  4096 Sep  1 09:02 courses

chmod did not read 7 as owner gets 7. Fewer than three digits are right-aligned and zero-filled on the left, so 7 became 007: owner nothing, group nothing, other everything. You have not partially granted yourself access; you have locked yourself out and opened the directory to the world. chmod 70 personal is the same trap one column over — it becomes 070, d---rwx---, which locks out the owner and hands the directory to the group.

The shell expands the file list, not chmod

Every chmod in the assignments takes a glob, and the glob is expanded by the shell before chmod ever runs. chmod 611 *.java receives an already-expanded argument list of the .java files in the working directory — it never sees the *, it does not recurse, and if nothing matches, chmod is handed the literal pattern and complains about a file of that name. Get the expansion right first, then apply the mode to each name in it.