File Permissions

Linux represents many resources through file-like interfaces, and each filesystem object has metadata that controls access. Reading that metadata is a foundation for working safely with files and directories.

Reading a Long Listing

Use ls -l to display a long listing:

$ ls -ld Desktop/
drwxr-xr-x 2 pete penguins 4096 Dec 1 11:45 Desktop/

The first field, drwxr-xr-x, combines one file-type character with nine permission characters. The listing also identifies pete as the owner and penguins as the group associated with the directory.

The initial character describes the object type. Common values include:

• - for a regular file
• d for a directory
• l for a symbolic link

Other special file types also exist. The remaining nine characters are the access permissions:

d | rwx | r-x | r-x

CheckIn drwxr-xr-x, what does the first d indicate?

The object is a symbolic link. The object is a directory. The owner has delete permission.

Understanding r, w, and x

Each permission triplet uses these characters:

• r grants read permission.
• w grants write permission.
• x grants execute permission.
• - means that permission is absent.

For a regular file, read permits access to its contents, write permits modification of its contents, and execute permits the kernel to attempt to run it as a program. Execution can still fail if the file format, interpreter line, mount options, or another security control does not allow it.

For a directory, the meanings concern directory entries:

• Read permits listing names in the directory.
• Write permits creating or removing entries, normally in combination with execute permission.
• Execute, also called search permission, permits traversing the directory and accessing entries by name.

Deleting a file is governed primarily by permissions on its parent directory, not by the file's own write bit.

CheckWhat does execute permission on a directory primarily allow?

Running every regular file stored in the directory. Changing the contents of every file in the directory. Traversing the directory and accessing entries by name.

Owner, Group, and Other Classes

The nine mode characters form three triplets in a fixed order:

1. Owner: permissions used when the process's effective user ID matches the file owner.
2. Group: permissions used when an applicable process group ID matches the file's group.
3. Other: permissions used when neither of the preceding classes matches.

The kernel selects one applicable class; it does not combine the three triplets to find the most permissive result. Additional mechanisms such as access control lists, mount options, capabilities, or mandatory access controls can further affect the final decision.

In the example, the owner triplet is rwx, while both group and other are r-x. The owner can read, write, and search the directory. The group and other classes can read and search it but cannot create or remove entries through the directory's ordinary mode bits.

CheckAfter the file-type character, in what order do the three permission triplets appear?

Group, owner, then other. Other, group, then owner. Owner, group, then other.

CheckWhat ordinary permissions does the group class have in drwxr-xr-x?

Read and write. Write and execute. Read and execute.

To reinforce these concepts in an isolated environment, try the Linux User Group and File Permissions lab. It provides practice reading modes and changing ownership and permissions.

Summary

You can now interpret the basic permission field in a Linux long listing.

1. Separate the file-type character from the nine permission bits.
2. Read r, w, and x according to whether the object is a file or directory.
3. Divide the mode into owner, group, and other triplets.
4. Relate the triplets to the owner and group shown by ls -l.