There are two parts in deciphering what the "raw mode in hex" means; the first is that it's in hex, but access modes are generally described in octal:
41ed16 = 407758
81a416 = 1006448
If you were to look at /tmp
, which typically has the restricted deletion flag ('sticky bit') set:
$ ls -ld /tmp
drwxrwxrwt 17 root root 4096 2012-05-31 13:45 /tmp
$ stat --format '%f %a' /tmp
43ff 1777
and converting:
43ff16 = 417778
The "raw mode in hex" is described in the programmer's manual for the stat function (man 2 stat
), noting that they are octal values:
The following flags are defined for the st_mode field:
S_IFMT 0170000 bit mask for the file type bit fields
S_IFSOCK 0140000 socket
S_IFLNK 0120000 symbolic link
S_IFREG 0100000 regular file
S_IFBLK 0060000 block device
S_IFDIR 0040000 directory
S_IFCHR 0020000 character device
S_IFIFO 0010000 FIFO
S_ISUID 0004000 set UID bit
S_ISGID 0002000 set-group-ID bit (see below)
S_ISVTX 0001000 sticky bit (see below)
S_IRWXU 00700 mask for file owner permissions
S_IRUSR 00400 owner has read permission
S_IWUSR 00200 owner has write permission
S_IXUSR 00100 owner has execute permission
S_IRWXG 00070 mask for group permissions
S_IRGRP 00040 group has read permission
S_IWGRP 00020 group has write permission
S_IXGRP 00010 group has execute permission
S_IRWXO 00007 mask for permissions for others (not in group)
S_IROTH 00004 others have read permission
S_IWOTH 00002 others have write permission
S_IXOTH 00001 others have execute permission
(Strangely, the online man page is missing this section.)
This is a bit field, and we can see that the last four digits match the access mode; the leading digit (in hex) matches the file type, so a hex mode of 81a4 corresponds to "directory, mode 0644", and a hex mode of 41ed corresponds to "regular file, mode 0775".