Unix File Permissions Quiz

Practice status

Build a practice round

Practice symbolic ↔ octal conversion and file-versus-directory scenarios. Choose basic or special bits and when to see corrections. This curated 56-question bank follows GNU Coreutils 9.11; it does not simulate ACLs, privileged access or every Unix platform.

Practice set:

Feedback:

Question count:

Replay seed:

Optional. Leave blank for the default round, or enter a seed to reproduce question and option order.

{{ answeredCount }} of {{ questionCount }} answered · {{ progressLabel }}%

Question {{ quizCursor + 1 }} of {{ questionCount }}

Answer recorded. Corrections appear in the final review.

Source: {{ currentResultRow.source.reference }} · {{ currentResultRow.source.version }} · {{ currentResultRow.source.license }}

Review what to practice next

A practice score covers only the questions answered. Check exact conversions with the chmod Calculator; test real permission changes in a disposable environment.

Missed answer review

{{ item.prompt }}

Your answer: {{ item.selected_answer_label }}

Correct answer: {{ item.correct_answer_label }}

{{ item.explanation }}

Source: {{ item.source.label }} · {{ item.source.version }} · {{ item.source.license }}

Topic performance

Which permission concepts need another pass? Compare correct and missed answers in this round.

Loading topic-performance chart…

Answer ledger

Question ID	Prompt	Topic	Your answer	Correct answer	Outcome	Explanation	Source	Copy
{{ row.question_id }}	{{ row.prompt }}	{{ row.category_label }}	{{ row.selected_answer_label }}	{{ row.correct_answer_label }}	{{ row.outcome_label }}	{{ row.explanation }}	{{ row.source ? `${row.source.label} · ${row.source.version} · ${row.source.license}` : '—' }}

Making a file read-only does not necessarily stop someone from removing its name from a directory. Permission to change the file's contents and permission to remove its directory entry are different checks. A person with write and search permission on the containing directory may be able to remove that entry even when the file itself is not writable, provided no sticky-bit rule or other restriction prevents it.

Unix file permissions distinguish the file's owner, other users in the file's group, and everyone else. Each class has three ordinary permission bits, meaning on-or-off settings for read, write, and execute or search. Their order is owner, group, then other. These settings matter when sharing a project directory, making a program executable, or investigating why an account cannot open a file.

The same permission letter has a different practical meaning on a regular file and on a directory. A directory organizes names, so its permissions govern listing and looking up those names rather than reading every file below it.

Meaning of ordinary permission bits for regular files and directories
Permission	Regular file	Directory
Read, `r`	Read the file's contents.	List the names of entries.
Write, `w`	Change the file's contents.	Create or remove entries, normally together with search permission.
Execute or search, `x`	Permit execution as a program, subject to other execution requirements.	Traverse the directory and look up a known child name.

Seeing a filename does not prove that its contents can be opened. Access through a path also needs search permission on the directories along that path and the relevant permission on the final file. Conversely, search permission without directory read permission can allow access to a known name without allowing a listing of all names.

A permission string such as rw-r----- and an octal mode such as 0640 describe the same stored settings. Octal is base eight, with digits from 0 to 7. A symbolic change such as u+x instead describes an operation on existing settings. This distinction matters because adding one permission should not accidentally replace permissions that other people still need.

Special mode bits add behavior beyond ordinary access. Set-user-ID, usually called setuid, and set-group-ID, or setgid, can change the identity used by an executable program when the system honors them. On supporting systems, setgid on a directory makes newly created files inherit that directory's group. The sticky bit restricts who may remove or rename entries in a shared directory. None of these bits automatically makes file contents private.

Giving everyone all permissions is not a general repair for access problems. It can grant unwanted changes while leaving the actual cause unresolved. Access control lists (ACLs), additional privileges, filesystem attributes, and read-only mounts can change what happens beyond the ordinary bits. Reading a mode correctly is useful preparation, not a complete assessment of a real system's security.

How to Use This Tool:

The default round has six Basic · conversion questions with feedback After each answer. The curated bank contains 56 original text questions based on GNU Coreutils 9.11, with source notes dated September 11, 2026.

Choose a Practice set. Basic · conversion translates ordinary symbolic and octal modes. Basic · interpretation covers file and directory access, symbolic changes, and the permissions mask. Special · conversion adds special-bit notation, while Special · interpretation covers its effects and GNU directory behavior.
Select a Question count. Basic conversion offers 6, 12, or 24 questions from 24 items. Basic interpretation and special conversion each offer 6 or 12 from 12 items. Special interpretation offers 4, 6, or 8 from 8 items. There is no combined 56-question round.
Choose Feedback. After each answer reveals correctness and an explanation before you move on. At the end records each answer without revealing correctness until the completed review.
Enter an optional Replay seed under Advanced to reproduce a round with the same setup and unchanged question bank. Surrounding spaces are ignored, and the limit is 128 characters. Leaving it blank uses a fixed, repeatable default round rather than a fresh random draw.
A seed-length notice means the default round will be used. Shorten the seed to keep your intended replay value.
Select Start practice to open the first question. If it is disabled, choose an available practice set, feedback setting, and question count.
Choose one of the four text answers. Selecting an answer records and locks it for that attempt; there is no separate submission step and no editing after selection.
Continue with Next question after each recorded answer. After the last question, select View results to see the score and review. Every question needs an answer before a final result is available.

Interpreting Results:

During a round, Practice status and the progress percentage show how many questions you have answered, not how many you got right. At completion, the main fraction changes to correct answers out of the round's question count. The Answer ledger gives your choice, the correct choice, an explanation, and its source for each question.

Start with Missed answer review, then compare the correct and missed counts in Topic performance. Short rounds need not balance topics, and untested topics are not rated. Review focus identifies a category with the most misses in that round; it is not an overall proficiency rating.

Retry missed starts a new attempt containing only the questions answered incorrectly in the completed round. Its smaller question count becomes the new score denominator. A perfect retry describes that smaller selection, not a revised score for the original full round.
Replay same seed repeats the questions and option order for that round. Try a new seed changes the seed and draws from the available pool again. Questions can recur because that pool is finite. A perfect round has no missed-question retry.
For meaningful comparisons, keep the practice set, question count, and feedback timing consistent, and remember that repeated exposure can help you recognize answers.

A Perfect round means no mistakes on that attempt, not mastery of Unix permissions. This is independent practice, not an official GNU assessment, certification exam, or proof of administrative competence. The quiz does not run chmod, inspect files, or simulate ACLs, Linux capabilities (specific process privileges), privileged bypass, mount policy, or every Unix platform. Verify a real change against the target system's documentation and test it in a disposable environment.

Technical Details:

Ordinary permissions are three independent bits per user class. Converting their notation describes a stored pattern exactly. Predicting access also needs the applicable user class, the file type, and any restrictions stated in the scenario.

Converting an ordinary permission triplet

For one owner, group, or other triplet, add the weights of the bits that are present.

d = 4 \times r + 2 \times w + x

Here d is the octal digit, and r, w, and x are each 1 when the corresponding permission is set and 0 when it is absent. Execute on a file and search on a directory have the same numeric weight. The indicators are dimensionless binary values; d is a dimensionless integer from 0 through 7. No rounding is involved.

Complete mapping between one octal permission digit and its ordinary symbolic triplet
Octal digit	Triplet	Permissions present
0	`---`	None
1	`--x`	Execute or search
2	`-w-`	Write
3	`-wx`	Write and execute or search
4	`r--`	Read
5	`r-x`	Read and execute or search
6	`rw-`	Read and write
7	`rwx`	Read, write, and execute or search

The four-digit form orders the digits as special, owner, group, and other. For rwxr-x---, the owner has all three weights, the group has read and execute, and other has none. Those triplets give 7, 5, and 0; with no special bits, the result is 0750. The nine permission characters exclude the leading file-type character, such as - for a regular file or d for a directory, and any following ACL or access-method marker.

Which user class applies

In the ordinary owner/group/other check, the owner's permissions apply when the accessing identity matches the file owner. Otherwise, the group permissions apply when a group identity matches the file's group, including supplementary group membership. Other permissions apply only when neither match applies. These classes are not added together, so an owner does not fall back to more generous group or other permissions. ACLs and privileged access require additional rules outside this basic check.

Special bits and the execute position

The leading octal digit encodes three additional flags, using a separate set of weights.

s = 4 \times U + 2 \times G + T

Here s is the special digit. U, G, and T are 1 when setuid, setgid, and sticky are present, respectively, and 0 otherwise. These flags are dimensionless binary values, and s is a dimensionless integer from 0 through 7. In a permission listing, each special flag shares a character position with an ordinary execute or search bit.

Special-bit octal values and their combined display with execute or search permission
Special bit	Octal value	Character position	Execute/search present	Execute/search absent
Setuid	`4000`	Owner's third character	`s`	`S`
Setgid	`2000`	Group's third character	`s`	`S`
Sticky	`1000`	Other's third character	`t`	`T`

Lowercase s or t therefore represents two set bits. Uppercase S or T means the special flag is set but the corresponding execute/search bit is clear. An uppercase character does not mean that the special flag is disabled.

When honored on an executable binary, setuid sets the running process's effective user ID to the file owner's user ID. Setgid similarly sets its effective group ID to the file's group ID. Neither inherently means root or changes file ownership, and execution policy can suppress these effects.

On supporting systems, directory setgid makes new files receive the directory's group and new subdirectories also inherit setgid. It does not automatically grant group write or execute permission.

Sticky adds a restriction to directory-entry removal and renaming. An unprivileged caller who owns neither the file nor the containing directory is blocked even when ordinary directory permissions would otherwise allow the operation. Ownership exceptions do not themselves grant missing directory permissions, and sticky alone does not restrict reading or editing file contents.

Changing selected permission bits

A symbolic change names the affected class, an operation, and the permissions to change. u selects the owner, g the group, o other, and a all three. The operator determines whether existing bits are preserved, removed, or replaced.

Effects of the three basic symbolic chmod operators
Change	Effect	Example
`+`	Set the named bits without clearing other bits.	`u+x` enables owner execute/search.
`-`	Clear the named bits without changing unrelated bits.	`g-w` removes group write.
`=`	Set the named permissions and clear the class's other permissions. Directory special bits have the exception below.	`o=r` leaves other with read only.

These are bit operations, not ordinary addition and subtraction. Repeating u+x leaves an already-set owner execute bit set; it does not keep increasing the numeric mode.

Capital X is conditional. Execute/search is affected only for a directory or a file that already has at least one execute bit. Consequently, a+X can add search permission to a directory without making a nonexecutable regular file executable. Lowercase x has no such condition.

The umask is a permissions mask. When a GNU symbolic change omits the user classes, permissions marked in that mask are left unchanged. Naming a explicitly removes this omitted-class filtering. The mask does not automatically remove existing permissions, and explicit classes do not override filesystem or security restrictions.

GNU directory modes are not always full replacement

GNU interprets numeric chmod modes as octal even without a leading zero. Stored mode bits and a requested mode must still be distinguished. GNU preserves existing directory setuid and setgid unless the request explicitly changes them. A short numeric mode, including one with a single leading zero, does not necessarily clear those flags. Each comparison below independently starts with a directory at 2775 and assumes the command succeeds.

GNU chmod results for a directory initially at mode 2775
Command	Mode	Reason
`chmod 755 DIR`	`2755`	Ordinary permissions change; existing directory setgid remains.
`chmod 0755 DIR`	`2755`	Four digits still preserve this existing directory setgid bit.
`chmod g-s DIR`	`0775`	Only setgid is explicitly cleared.
`chmod 00755 DIR`	`0755`	The five-digit numeric request explicitly clears directory setuid and setgid.

This is GNU-specific behavior, not a promise about every Unix system. Directory special-bit handling also depends on the underlying system. A requested mode should not be treated as proof of the resulting stored mode without checking the actual object.

Counting correct answers and completion

Each correct answer earns one point and each wrong answer earns zero. There are no weights, deductions, partial-credit rules, pass marks, or score bands. Let N be the selected question count, A the number answered, and C the number correct. The question counts are integers satisfying 0 ≤ C ≤ A ≤ N, with N ≥ 1. Score has point units; accuracy and progress have percent units. Accuracy uses the full round size, while progress measures completion.

\begin{array}{l} Score points = C out of N \\ Accuracy (%) = 100 \times \frac{C}{N} \\ Progress (%) = 100 \times \frac{A}{N} \end{array}

Counts and points are exact integers. Accuracy and progress retain their fractional values for calculation. Only the visible progress label rounds to the nearest whole percent, with half-percent ties upward. The completed headline uses the exact correct-count fraction. Unanswered questions stay in the selected total but do not count as wrong answers or enter a missed-question retry. Completion requires an answer to every selected question.

After one correct answer in a six-question round, both calculated percentages are about 16.67%, and the visible progress label rounds to 17%. There are still no wrong answers, but the round is incomplete. Finishing with five correct answers gives a headline of 5/6, an equivalent accuracy of about 83.33%, and progress of 100%.

Questions are selected without replacement within the chosen pool, so an item does not repeat inside a round. Selection and answer-option order are reproducible for an unchanged bank and matching setup and seed.

Privacy Notes:

Answers are scored in your browser, but the page can still make network requests, including for the topic-performance chart. Browser scoring is not a guarantee of offline operation, zero transmission, or a particular site-wide logging or retention policy.

The page address carries the practice setup, seed, recorded answers, and current position, including unfinished attempts. Someone with a compatible saved link can restore those choices. Saved attempt data in the URL is not encrypted or private progress storage. That address may remain in browser history and may be transmitted when opened or shared, so do not put personal details or secrets in a replay seed.

Change setup clears the current attempt and its saved address state. It does not erase earlier history or copies already shared. Saved links are not an account-based progress record. If Saved attempt unavailable appears, the link is invalid or incompatible; choose valid settings and select Start practice for a clean round. Older links are not guaranteed to survive question-bank changes.

Worked Examples:

Setgid without group execute

For a special-conversion question showing rw-r-S---, split the ordinary permissions into owner read/write, group read only, and no other access. The uppercase S adds setgid but no group execute bit. The digits are therefore special 2, owner 6, group 4, and other 0, so select 2640. Choosing 2650 would add a group execute bit that is not present; the explanation helps distinguish a special flag from the execute position it shares.

The same conditional change on a file and a directory

In basic interpretation, compare a regular file and a directory, each initially at 0644 with no special bits. A successful chmod a+X leaves the regular file at 0644 because nobody had execute permission. The directory instead becomes 0755, because all three classes gain search permission. The object type, not a different starting number, changes the correct answer.

A named class changes the effect of the mask

Start with a regular file at 0444 and a umask of 0022. For a successful GNU chmod +w, select 0644: the omitted classes let the mask protect group and other write, so only owner write is added. Starting again from 0444, chmod a+w produces 0666 because all classes are explicit. When reviewing a miss, check for the missing or present a rather than assuming that every write request has the same effect.

References:

GNU Coreutils 9.11 manual — File permissions, GNU Project.
GNU Coreutils 9.11 manual — File listings and changing access permissions, GNU Project.
Path resolution — Permissions, Linux man-pages project.
How to change file and folder permissions in Linux, Simplified Guide, for hands-on follow-on learning.
How to set default file permissions with umask in Linux, Simplified Guide, for creation-mask follow-on learning.