Linux file permissions
Type an octal mode or an rwx string and the other side fills in. The part worth staying for is what happens when a special bit lands on a position that has no execute permission, which is where the letter changes case and most explanations stop.
Each of the three classes, owner then group then others, gets one digit built by adding 4 for read, 2 for write and 1 for execute. So 6 is read and write, 5 is read and execute, 7 is all three. 644 is the ordinary file, 755 the ordinary program or directory.
A fourth digit can sit in front for the special bits: 4 setuid, 2 setgid, 1 sticky. It is optional, and its absence means zero.
A special bit does not get its own column. It overwrites the execute position of the class it belongs to, and the letter tells you whether execute was there underneath:
4755 shows rwsr-xr-x, lowercase s: setuid, and the owner does have execute.4644 shows rwSr--r--, uppercase S: setuid is set but there is no execute under it, which is almost always a mistake.1777 shows rwxrwxrwt, lowercase t; 1644 shows rw-r--r--T, uppercase T.So an uppercase letter in a mode string is a signal, not a typo: something was switched on that cannot currently do anything.
setuid makes an executable run with the privileges of its owner rather than of whoever started it. On a root-owned binary that means it runs as root, which is why an unexpected setuid file on a system is a finding rather than a curiosity.
setgid does the same with the group. On a directory it does something else entirely: new files inside inherit the directory's group instead of the creator's, which is how a shared project directory stays shared.
sticky on a directory means only the owner of an entry, the owner of the directory, or root may delete it. That is precisely what makes /tmp at 1777 usable by everyone without everyone being able to delete each other's files.
This converts and explains a mode. It cannot see your filesystem, so it does not know whether a given mode is appropriate for a given file. Ownership matters as much as the mode: 600 means nothing useful if the file is owned by the wrong account. And on systems using ACLs or SELinux and AppArmor, the mode is only one of the layers deciding access.