diff --git a/apps/app.c b/apps/app.c
index 16d92096..74e4670a 100644
--- a/apps/app.c
+++ b/apps/app.c
@@ -15,10 +15,10 @@ int main()
     atexit(bye);
     printf("Welcome to %s from userspace (pid %d)!\n", "Luna", getpid());
 
-    mkdir("/home", 0);
-    mkdir("/home/user", 0);
+    mkdir("/home", 0755);
+    mkdir("/home/user", 0755);
 
-    int fd = open("/home/user/notes.txt", O_RDWR | O_CREAT);
+    int fd = open("/home/user/notes.txt", O_RDWR | O_CREAT, 0644);
     if (fd < 0)
     {
         perror("open");
diff --git a/kernel/src/InitRD.cpp b/kernel/src/InitRD.cpp
index 37e3f210..1a65dae5 100644
--- a/kernel/src/InitRD.cpp
+++ b/kernel/src/InitRD.cpp
@@ -1,7 +1,9 @@
 #include "InitRD.h"
+#include "Log.h"
 #include "arch/MMU.h"
 #include "boot/bootboot.h"
 #include "fs/VFS.h"
+#include <bits/modes.h>
 
 TarStream g_initrd;
 extern const BOOTBOOT bootboot;
@@ -13,7 +15,7 @@ void InitRD::initialize()
     g_initrd.initialize((void*)virtual_initrd_address, bootboot.initrd_size);
 }
 
-static Result<void> vfs_create_dir_if_not_exists(const char* path)
+static Result<void> vfs_create_dir_if_not_exists(const char* path, mode_t mode)
 {
     auto rc = VFS::create_directory(path);
     if (rc.has_error())
@@ -21,6 +23,7 @@ static Result<void> vfs_create_dir_if_not_exists(const char* path)
         if (rc.error() == EEXIST) return {};
         return rc.release_error();
     }
+    rc.value()->chmod(mode & (mode_t)~S_IFMT);
     return {};
 }
 
@@ -33,8 +36,12 @@ Result<void> InitRD::populate_vfs()
         {
             auto file = TRY(VFS::create_file(entry.name));
             file->write(entry.data(), 0, entry.size);
+            file->chmod(entry.mode & (mode_t)~S_IFMT);
+        }
+        else if (entry.type == TarStream::EntryType::Directory)
+        {
+            TRY(vfs_create_dir_if_not_exists(entry.name, entry.mode));
         }
-        else if (entry.type == TarStream::EntryType::Directory) { TRY(vfs_create_dir_if_not_exists(entry.name)); }
     }
     return {};
 }
diff --git a/kernel/src/fs/VFS.h b/kernel/src/fs/VFS.h
index 97df0fa8..37d0a769 100644
--- a/kernel/src/fs/VFS.h
+++ b/kernel/src/fs/VFS.h
@@ -1,5 +1,6 @@
 #pragma once
 #include <luna/SharedPtr.h>
+#include <sys/types.h>
 
 namespace VFS
 {
@@ -28,9 +29,15 @@ namespace VFS
 
         virtual Result<void> truncate(usize size) = 0;
 
+        // Metadata accessors
         virtual usize size() = 0;
 
-        // Generic methods
+        virtual mode_t mode() = 0;
+
+        // Metadata changers
+        virtual Result<void> chmod(mode_t mode) = 0;
+
+        // Generic VFS-related methods
         virtual FileSystem& fs() const = 0;
 
         virtual ~Inode() = default;
diff --git a/kernel/src/fs/tmpfs/FileSystem.h b/kernel/src/fs/tmpfs/FileSystem.h
index 6c71c6d7..f7ec31b7 100644
--- a/kernel/src/fs/tmpfs/FileSystem.h
+++ b/kernel/src/fs/tmpfs/FileSystem.h
@@ -67,12 +67,24 @@ namespace TmpFS
 
         usize size() override;
 
+        mode_t mode() override
+        {
+            return m_mode;
+        }
+
+        Result<void> chmod(mode_t mode) override
+        {
+            m_mode = mode;
+            return {};
+        }
+
         virtual ~FileInode() = default;
 
       private:
         VFS::FileSystem* m_fs;
         Buffer m_data_buffer;
         usize m_inode_number;
+        mode_t m_mode;
     };
 
     class DirInode : public VFS::Inode
@@ -117,6 +129,17 @@ namespace TmpFS
             return 0;
         }
 
+        mode_t mode() override
+        {
+            return m_mode;
+        }
+
+        Result<void> chmod(mode_t mode) override
+        {
+            m_mode = mode;
+            return {};
+        }
+
         VFS::FileSystem& fs() const override
         {
             return *m_fs;
@@ -142,6 +165,7 @@ namespace TmpFS
       private:
         VFS::FileSystem* m_fs;
         usize m_inode_number;
+        mode_t m_mode;
 
         SharedPtr<VFS::Inode> m_self;
 
diff --git a/kernel/src/sys/mkdir.cpp b/kernel/src/sys/mkdir.cpp
index 5474d146..dd0a9b3e 100644
--- a/kernel/src/sys/mkdir.cpp
+++ b/kernel/src/sys/mkdir.cpp
@@ -6,10 +6,12 @@
 Result<u64> sys_mkdir(Registers*, SyscallArgs args)
 {
     auto path = TRY(MemoryManager::strdup_from_user(args[0]));
+    mode_t mode = (mode_t)args[1];
 
     kinfoln("mkdir: attempting to create %s", path.chars());
 
-    TRY(VFS::create_directory(path.chars()));
+    auto inode = TRY(VFS::create_directory(path.chars()));
+    inode->chmod(mode);
 
     return 0;
 }
diff --git a/kernel/src/sys/open.cpp b/kernel/src/sys/open.cpp
index b619d264..204c1699 100644
--- a/kernel/src/sys/open.cpp
+++ b/kernel/src/sys/open.cpp
@@ -3,6 +3,7 @@
 #include "memory/MemoryManager.h"
 #include "sys/Syscall.h"
 #include "thread/Scheduler.h"
+#include <bits/modes.h>
 #include <bits/open-flags.h>
 
 // These flags are needed after open(), the rest only affect open().
@@ -12,6 +13,7 @@ Result<u64> sys_open(Registers*, SyscallArgs args)
 {
     auto path = TRY(MemoryManager::strdup_from_user(args[0]));
     int flags = (int)args[1];
+    mode_t mode = (mode_t)args[2];
 
     Thread* current = Scheduler::current();
 
@@ -25,14 +27,22 @@ Result<u64> sys_open(Registers*, SyscallArgs args)
     auto maybe_inode = VFS::resolve_path(path.chars());
     if (maybe_inode.has_error())
     {
-        if (maybe_inode.error() == ENOENT && (flags & O_CREAT)) inode = TRY(VFS::create_file(path.chars()));
+        if (maybe_inode.error() == ENOENT && (flags & O_CREAT))
+        {
+            inode = TRY(VFS::create_file(path.chars()));
+            inode->chmod(mode);
+        }
         else
             return maybe_inode.release_error();
     }
     else if (flags & O_EXCL)
         return err(EEXIST);
     else
+    {
         inode = maybe_inode.release_value();
+        if ((flags & O_RDONLY) && (inode->mode() & S_IRUSR) == 0) return err(EACCES);
+        if ((flags & O_WRONLY) && (inode->mode() & S_IWUSR) == 0) return err(EACCES);
+    }
 
     if ((flags & O_WRONLY) && (flags & O_TRUNC)) inode->truncate(0);
 
diff --git a/libc/include/bits/modes.h b/libc/include/bits/modes.h
new file mode 100644
index 00000000..cf9c572a
--- /dev/null
+++ b/libc/include/bits/modes.h
@@ -0,0 +1,29 @@
+/* bits/modes.h: S_* constants for stat(), mkdir(), open() and more. */
+
+#ifndef _BITS_MODES_H
+#define _BITS_MODES_H
+
+#define S_IFMT 070000
+#define S_IFREG 000000
+#define S_IFDIR 040000
+
+#define S_IRWXU 0700
+#define S_IRUSR 0400
+#define S_IWUSR 0200
+#define S_IXUSR 0100
+#define S_IRWXG 070
+#define S_IRGRP 040
+#define S_IWGRP 020
+#define S_IXGRP 010
+#define S_IRWXO 07
+#define S_IROTH 04
+#define S_IWOTH 02
+#define S_IXOTH 01
+#define S_ISUID 04000
+#define S_ISGID 02000
+#define S_ISVTX 01000
+
+#define S_ISREG(m) ((m & S_IFMT) == S_IFREG)
+#define S_ISDIR(m) ((m & S_IFMT) == S_IFDIR)
+
+#endif
diff --git a/libc/include/fcntl.h b/libc/include/fcntl.h
index b6760cf2..5cbfd5d2 100644
--- a/libc/include/fcntl.h
+++ b/libc/include/fcntl.h
@@ -11,7 +11,7 @@ extern "C"
 #endif
 
     /* Open a file path and return a file descriptor to it. */
-    int open(const char* path, int flags);
+    int open(const char* path, int flags, ...);
 
 #ifdef __cplusplus
 }
diff --git a/libc/include/sys/stat.h b/libc/include/sys/stat.h
index 2f49059c..dc89b780 100644
--- a/libc/include/sys/stat.h
+++ b/libc/include/sys/stat.h
@@ -3,6 +3,7 @@
 #ifndef _SYS_STAT_H
 #define _SYS_STAT_H
 
+#include <bits/modes.h>
 #include <sys/types.h>
 
 #ifdef __cplusplus
diff --git a/libc/src/fcntl.cpp b/libc/src/fcntl.cpp
index a2bbba8d..b9caee0c 100644
--- a/libc/src/fcntl.cpp
+++ b/libc/src/fcntl.cpp
@@ -1,13 +1,21 @@
 #include <bits/errno-return.h>
 #include <fcntl.h>
+#include <stdarg.h>
 #include <sys/syscall.h>
 #include <unistd.h>
 
 extern "C"
 {
-    int open(const char* path, int flags)
+    int open(const char* path, int flags, ...)
     {
-        long rc = syscall(SYS_open, path, flags);
+        va_list ap;
+        va_start(ap, flags);
+
+        mode_t mode = (mode_t)va_arg(ap, int);
+
+        long rc = syscall(SYS_open, path, flags, mode);
+
+        va_end(ap);
         __errno_return(rc, int);
     }
 }
diff --git a/libc/src/sys/stat.cpp b/libc/src/sys/stat.cpp
index 8bce55fb..1316d0a3 100644
--- a/libc/src/sys/stat.cpp
+++ b/libc/src/sys/stat.cpp
@@ -5,9 +5,9 @@
 
 extern "C"
 {
-    int mkdir(const char* path, mode_t)
+    int mkdir(const char* path, mode_t mode)
     {
-        long rc = syscall(SYS_mkdir, path);
+        long rc = syscall(SYS_mkdir, path, mode);
         __errno_return(rc, int);
     }
 }