When using GNU stat to probe the filesystem, there are a number of format sequences available for the --format/--printf arguments; this one in particular

%f    Raw mode in hex

doesn't make much sense. Comparing with %a, access mode, something might have (you can see this with stat --format '%f %a') a raw mode of 41ed but an access mode of 755, or a raw mode of 81a4 and an access mode of 644.

So what does "raw mode" mean?

1 Answer 1


There are two parts in deciphering what the "raw mode in hex" means; the first is that it's in hex, but access modes are generally described in octal:

41ed16 = 407758
81a416 = 1006448

If you were to look at /tmp, which typically has the restricted deletion flag ('sticky bit') set:

$ ls -ld /tmp
drwxrwxrwt 17 root root 4096 2012-05-31 13:45 /tmp
$ stat --format '%f %a' /tmp
43ff 1777

and converting:

43ff16 = 417778

The "raw mode in hex" is described in the programmer's manual for the stat function (man 2 stat), noting that they are octal values:

The following flags are defined for the st_mode field:

S_IFMT     0170000   bit mask for the file type bit fields
S_IFSOCK   0140000   socket
S_IFLNK    0120000   symbolic link
S_IFREG    0100000   regular file
S_IFBLK    0060000   block device
S_IFDIR    0040000   directory
S_IFCHR    0020000   character device
S_IFIFO    0010000   FIFO
S_ISUID    0004000   set UID bit
S_ISGID    0002000   set-group-ID bit (see below)
S_ISVTX    0001000   sticky bit (see below)
S_IRWXU    00700     mask for file owner permissions
S_IRUSR    00400     owner has read permission
S_IWUSR    00200     owner has write permission
S_IXUSR    00100     owner has execute permission
S_IRWXG    00070     mask for group permissions
S_IRGRP    00040     group has read permission
S_IWGRP    00020     group has write permission
S_IXGRP    00010     group has execute permission
S_IRWXO    00007     mask for permissions for others (not in group)
S_IROTH    00004     others have read permission
S_IWOTH    00002     others have write permission
S_IXOTH    00001     others have execute permission

(Strangely, the online man page is missing this section.)

This is a bit field, and we can see that the last four digits match the access mode; the leading digit (in hex) matches the file type, so a hex mode of 81a4 corresponds to "directory, mode 0644", and a hex mode of 41ed corresponds to "regular file, mode 0775".

  • Excellent answer! I just wanted to note a useful snippet for converting this is: from_raw_mode() { _tmp=$(printf '%d' "0x$1"); printf '%s' $((($_tmp >> 9) & 0x7)) $((($_tmp >> 6) & 0x7)) $((($_tmp >> 3) & 0x7)) $(($_tmp & 0x7)); } particularly handy on limited platforms where stat is the only way to get this mode, and it only offers the raw form. Of course if you need to know a particular capability, then it's better just to test that bit directly if you have the raw mode.
    – Haravikk
    Jul 2, 2015 at 15:10
  • Thanks for this (so many years later). But isn't 81a4 the regular file, and 41ed the directory? Also, the table is (now) in the man page for inode. May 13 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .