When using GNU stat to probe the filesystem, there are a number of format sequences available for the --format/--printf arguments; this one in particular

%f    Raw mode in hex

doesn't make much sense. Comparing with %a, access mode, something might have (you can see this with stat --format '%f %a') a raw mode of 41ed but an access mode of 755, or a raw mode of 81a4 and an access mode of 644.

So what does "raw mode" mean?

1 Answer 1


There are two parts in deciphering what the "raw mode in hex" means; the first is that it's in hex, but access modes are generally described in octal:

41ed16 = 407758
81a416 = 1006448

If you were to look at /tmp, which typically has the restricted deletion flag ('sticky bit') set:

$ ls -ld /tmp
drwxrwxrwt 17 root root 4096 2012-05-31 13:45 /tmp
$ stat --format '%f %a' /tmp
43ff 1777

and converting:

43ff16 = 417778

The "raw mode in hex" is described in the programmer's manual for the stat function (man 2 stat), noting that they are octal values:

The following flags are defined for the st_mode field:

S_IFMT     0170000   bit mask for the file type bit fields
S_IFSOCK   0140000   socket
S_IFLNK    0120000   symbolic link
S_IFREG    0100000   regular file
S_IFBLK    0060000   block device
S_IFDIR    0040000   directory
S_IFCHR    0020000   character device
S_IFIFO    0010000   FIFO
S_ISUID    0004000   set UID bit
S_ISGID    0002000   set-group-ID bit (see below)
S_ISVTX    0001000   sticky bit (see below)
S_IRWXU    00700     mask for file owner permissions
S_IRUSR    00400     owner has read permission
S_IWUSR    00200     owner has write permission
S_IXUSR    00100     owner has execute permission
S_IRWXG    00070     mask for group permissions
S_IRGRP    00040     group has read permission
S_IWGRP    00020     group has write permission
S_IXGRP    00010     group has execute permission
S_IRWXO    00007     mask for permissions for others (not in group)
S_IROTH    00004     others have read permission
S_IWOTH    00002     others have write permission
S_IXOTH    00001     others have execute permission

(Strangely, the online man page is missing this section.)

This is a bit field, and we can see that the last four digits match the access mode; the leading digit (in hex) matches the file type, so a hex mode of 81a4 corresponds to "directory, mode 0644", and a hex mode of 41ed corresponds to "regular file, mode 0775".

  • Excellent answer! I just wanted to note a useful snippet for converting this is: from_raw_mode() { _tmp=$(printf '%d' "0x$1"); printf '%s' $((($_tmp >> 9) & 0x7)) $((($_tmp >> 6) & 0x7)) $((($_tmp >> 3) & 0x7)) $(($_tmp & 0x7)); } particularly handy on limited platforms where stat is the only way to get this mode, and it only offers the raw form. Of course if you need to know a particular capability, then it's better just to test that bit directly if you have the raw mode.
    – Haravikk
    Jul 2, 2015 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .