How the octal digits map to permissions

Each of the three main digits in a mode like 755 represents one entity — owner, group, other, in that order — and each digit is a sum of read (4), write (2), and execute (1). A digit of 7 (4+2+1) grants all three; 5 (4+0+1) grants read and execute but not write; 0 grants nothing. This is exactly what the checkbox grid above is doing in the other direction: ticking read+write+execute for a row sets that row's bit values to 4+2+1=7. A 4-digit mode like 4750 adds a leading digit for the special bits (setuid=4, setgid=2, sticky=1) — a plain 3-digit mode like 750 is shorthand for a leading 0, meaning none of the special bits are set.

What the special bits actually do

• setuid (4000) — when set on an executable, the program runs with the file owner's privileges rather than the invoking user's. Rare and security-sensitive; classic example is /usr/bin/passwd needing root to edit /etc/shadow on behalf of a regular user.
• setgid (2000) — on an executable, similar to setuid but for group privileges. On a directory, it makes new files created inside inherit the directory's group instead of the creating user's primary group — commonly used on shared team directories.
• sticky (1000) — on a directory, restricts deletion/renaming of files inside it to their owner (or root), even if others have write access to the directory. /tmp is the textbook example: everyone can create files there, but can't delete each other's.

Reading symbolic notation

The 10-character symbolic form (e.g. -rwxr-xr--) breaks down as: 1 character for file type (- for regular file, d for directory, l for symlink), then three groups of rwx for owner/group/other. A special bit shows as a lowercase letter (s or t) in the execute position when the corresponding execute bit is also set, or uppercase (S or T) when it isn't — an uppercase S or T is a signal worth noticing, since it usually means someone set a special bit without also granting execute, which is unusual and often unintentional.