Linux & Bash · Part I · Module 5 · Permissions, Ownership and Execution

Reading and Writing a Permission String

[Chapter 5.1](/linux-bash/users-groups-and-permissions) established who the system thinks you are and which of three categories you fall into. This chapter reads the setting itself — the ten characters at the start of every long listing, and the three-digit number that says the same thing more briefly. The first half is mechanical and you will have it in ten minutes. The second half is the one that takes longer to believe, because the same three letters mean something quite different on a directory than they do on a file, and the consequence is a fact most people meet by accident: a file nobody is allowed to write to can still be deleted.

Foundation17 min readLinuxPart IFundamentalsPermissionsMental Model

Part I · Module 5 · Chapter 5.2 · Reading and Writing a Permission String

1. Ten Characters, Four Parts

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ ls -l run.sh
-rwxr-xr-- 1 engineer design 128 Mar 24 14:02 run.sh

The first field is ten characters. It splits into four pieces, in a fixed order:

Figure 1 — the ten characters of a permission string. One character of type, then three groups of three, in the same order as Chapter 5.1's three questions: owner first, then group, then everyone else. Reading left to right is reading from the most specific audience to the least.

Against a real string:

Azvya Education Pvt. Ltd.VLSI Mentor

-rwxr-xr-- decoded

-  rwx  r-x  r--
│   │    │    └── everyone else:  read only
│   │    └─────── group:          read and execute
│   └──────────── owner:          read, write and execute
└──────────────── type:           an ordinary file

Chapter 2.5 taught the type character — - for a file, d for a directory, l for a symbolic link. The other nine are this chapter.

2. Three Positions, Always in the Same Order

Within each group of three, the positions never move:

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

r w x
│ │ └── execute
│ └──── write
└────── read

A letter means allowed; a dash means not allowed. The dash is a placeholder holding the position, which is why r-x and rx are not the same thing — the second would be unreadable, because you could not tell which permission was missing.

So:

String	Means
`rwx`	read, write and execute
`r-x`	read and execute, not write
`r--`	read only
`rw-`	read and write, not execute
`---`	nothing at all

3. What They Mean on a File

Straightforward, and probably what you already assumed:

On a file	Means
`r`	you can read the contents
`w`	you can change the contents
`x`	you can run it as a program

One note on x that Chapter 5.5 develops: execute permission is not about whether a file is sensible to run. Setting it on a text file does not make the file a program; it only means the system will attempt to run it if asked.

4. What They Mean on a Directory — the Hard Part

Here the same three letters mean something else, and the reason is Chapter 2.1's definition: a directory is a container of entries, each pairing a name with the thing it names.

Once you hold that, the meanings follow:

On a directory	Means	In practice
`r`	you can read the list of names	`ls` works
`w`	you can change the list — add or remove entries	creating and deleting work
`x`	you can go through it to reach what is inside	`cd` works; paths through it resolve

The word for x on a directory is traverse, or sometimes search. It has nothing to do with running anything.

These three are genuinely independent, and the combinations are instructive.

Read without execute

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ chmod 400 t          # r-- : readable, not traversable

$ ls t
inside.txt

$ cat t/inside.txt
cat: t/inside.txt: Permission denied

You can see that a file called inside.txt exists. You cannot reach it. Read gave you the list of names and nothing else — the names are the directory's contents, and reaching what a name points at requires traversing.

Execute without read

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ chmod 100 t          # --x : traversable, not readable

$ ls t
ls: t: Permission denied

$ cat t/inside.txt
secret

The mirror image, and it surprises everybody. You cannot list the directory — so you cannot discover what is in it — but if you already know a name, you can go straight to it.

This combination is used deliberately. A directory set to --x for everyone else is sometimes called a dark directory: people can reach files you tell them about and cannot browse for anything you did not.

5. The Consequence Nobody Expects

Now the fact this chapter exists for.

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ ls -l w/readonly.txt
-r--r--r-- 1 engineer engineer 9 Mar 24 15:10 w/readonly.txt

Mode r--r--r--: nobody may write to it, including its owner.

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ echo more >> w/readonly.txt
bash: w/readonly.txt: Permission denied

As expected. Now:

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ rm -f w/readonly.txt

$ ls w
$

It is gone. A file that nobody was allowed to modify was deleted without difficulty.

This is not a bug, and the explanation is exactly Chapter 3.3's. Deleting a file does not modify the file — it removes an entry from a directory. Changing the list of entries is write permission on the directory, and the directory was writable.

Azvya Education Pvt. Ltd.VLSI Mentor

Two different permissions, two different operations

change the CONTENTS of a file   →  w on the FILE
add or remove a NAME            →  w on the DIRECTORY that holds it

The file's own permissions have no say in whether its name can be removed.

6. The Numeric Form

The same information is written as three digits, and you will see both forms constantly.

Each permission has a value:

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

r = 4
w = 2
x = 1

Add the ones that are present to get a digit for that group:

Azvya Education Pvt. Ltd.VLSI Mentor

rwxr-xr-- as numbers

rwx   =  4 + 2 + 1  =  7     owner
r-x   =  4 + 0 + 1  =  5     group
r--   =  4 + 0 + 0  =  4     everyone else

                 →  754

The reverse direction is the same arithmetic backwards. Given 640:

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

6  =  4 + 2        =  rw-     owner
4  =  4            =  r--     group
0  =                  ---     everyone else

           →  rw-r-----

The eight possible digits, which you will come to recognise without adding:

Digit	Letters	Meaning
7	`rwx`	everything
6	`rw-`	read and write
5	`r-x`	read and traverse or run
4	`r--`	read only
3	`-wx`	write and execute — rare
2	`-w-`	write only — rare
1	`--x`	execute or traverse only
0	`---`	nothing

The values 4, 2 and 1 are chosen so that every combination produces a different total. That is why the arithmetic is unambiguous and why you can convert in either direction without a lookup table.

The ones worth recognising on sight

Four combinations cover the large majority of what you will meet:

Number	String	Typical use
`644`	`rw-r--r--`	an ordinary file — you edit it, others read it
`755`	`rwxr-xr-x`	a program or a directory — you change it, others use it
`600`	`rw-------`	private to you
`700`	`rwx------`	a private directory or program

Notice the pattern in the first two: directories and programs get 755, plain files get 644. The difference is exactly the execute bit, which a directory needs to be traversable and a plain file does not need at all.

7. Reading Real Listings

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

$ ls -l
drwxr-xr-x 2 engineer design   4096 Mar 24 14:00 scripts
-rwxr-xr-x 1 engineer design    128 Mar 24 14:02 scripts/run.sh
-rw-r--r-- 1 engineer design   8192 Mar 24 11:05 notes.txt
-rw------- 1 engineer engineer 2048 Mar 24 09:15 private.txt
drwx------ 2 engineer engineer 4096 Mar 24 09:00 .ssh

Line by line:

scripts is drwxr-xr-x, or 755. A directory you control; the group and everyone else can list it and traverse it, which is what makes the files inside reachable.
run.sh is -rwxr-xr-x, 755. Everyone can run it; only you can change it.
notes.txt is -rw-r--r--, 644. The default for a new file, as Chapter 5.6 will explain.
private.txt is -rw-------, 600. Only you, in any capacity.
.ssh is drwx------, 700. Chapter 2.6 pointed this out: the strictness protecting your keys is here in the permission field, and not in the leading dot.

That last point deserves restating because it closes a loop. Chapter 2.6 insisted that a dotted name provides no protection at all. This is what provides it.

8. Two Bits Not Covered

For completeness, since you may see them.

Occasionally a listing shows s or t where you expect x:

Azvya Education Pvt. Ltd.VLSI Mentor

Snippet

-rwsr-xr-x    an s in the owner's execute position
drwxrwxrwt    a t at the very end

These are additional bits with specialised meanings — one about running a program with its owner's rights, the other a rule on shared directories like /tmp that stops people deleting each other's files.

They are named here so they are not alarming and are deliberately not taught: the first has real security implications and the second only matters on directories you are unlikely to administer. Recognising that the letters are not x and mean something extra is enough for Part I.

9. Practice

Question 1. Decode -rw-r--r-- into type, and what each of the three categories may do.

Question 2. Convert rwxr-x--- to its three-digit form. Show the arithmetic.

Question 3. Convert 750 to a permission string. Show the arithmetic.

Question 4. What does r mean on a directory? What does x mean on a directory? Give the command that stops working when each is missing.

Question 5. A directory is r--. You can see a file is in it but cannot read that file. Explain exactly why.

Question 6. A directory is --x. Can you run ls on it? Can you read a file inside whose name you know? Explain both.

Question 7. A file is -r--r--r-- inside a directory you can write to. Can you edit the file? Can you delete it? Explain the difference in terms of which permission governs which operation.

Question 8. Why are the values 4, 2 and 1 used rather than 1, 2 and 3?

Question 9. Why do directories conventionally get 755 while ordinary files get 644?

Question 10. Chapter 2.6 said a leading dot provides no protection. Looking at drwx------ .ssh, say what actually provides it.

Answers

1. The leading - means an ordinary file. Then rw- for the owner: read and write, not execute. r-- for the group: read only. r-- for everyone else: read only. This is the commonest mode on a Linux system for a data file.

2. 750. Owner rwx = 4+2+1 = 7. Group r-x = 4+0+1 = 5. Other --- = 0. Each triplet is summed independently.

3. rwxr-x---. 7 = 4+2+1 = rwx for the owner. 5 = 4+1 = r-x for the group. 0 = --- for everyone else.

4. On a directory, r means you may list the names inside it; x means you may traverse it — enter it and reach the things inside by name. Without r, ls stops working. Without x, cd stops working — and so does every attempt to reach a file through that directory.

5. Because r on a directory lets you read its list of names, and nothing more. Reaching the file itself requires traversing the directory, which needs x — and you do not have it. So the name is visible and the file is unreachable:

Azvya Education Pvt. Ltd.VLSI Mentor

Measured — a directory at mode 400

ls ronly          ->  f.txt   (plus 'Permission denied' when it tries to stat it)
cat ronly/f.txt   ->  cat: ronly/f.txt: Permission denied

6. ls on it fails — listing needs r, which is absent. But you can read a file inside whose name you already know, because that only requires traversing the directory, which is exactly what x grants:

Azvya Education Pvt. Ltd.VLSI Mentor

Measured — a directory at mode 100

ls xonly              ->  ls: xonly: Permission denied
cat xonly/known.txt   ->  known

This is the basis of a genuinely useful pattern: a directory you may pass through but not survey.

7. You cannot edit it — writing to a file's contents is governed by the w bit on the file, and there is none. You can delete it — removing a name is a modification of the directory, and you have write permission there. Measured:

Azvya Education Pvt. Ltd.VLSI Mentor

Measured — a 444 file inside a 755 directory you own

append to wdir/ro.txt  ->  permission denied
rm wdir/ro.txt         ->  removed

The rule worth carrying: a file's own bits govern its contents; its directory's bits govern its name.

8. Because they are the three bits of a single octal digit — 4, 2 and 1 are powers of two, so every combination of read, write and execute produces a unique sum from 0 to 7. With 1, 2 and 3 you could not tell 1+2 from 3, so --x plus -w- would be indistinguishable from r--. The encoding only works because each permission has its own bit.

9. Because a directory needs x to be useful and a data file must not have it. 755 gives a directory rwx for the owner and r-x for everyone else — listable and traversable, which is what a directory is for. 644 gives a file rw- and r--, deliberately withholding execute, because a data file that is executable is at best meaningless and at worst dangerous.

10. The permissions provide it: drwx------ means the owner triplet is the only one with anything in it, so nobody else may list, enter or read anything inside. The leading dot does nothing but keep it out of a default ls. This is the clean contrast with Chapter 2.6 — the dot is a display convention, the mode is the enforcement.

10. Remember

Ten characters: one type, then three groups of three — owner, group, everyone else, in the same order as Chapter 5.1's three questions.
Within each group the order is always r, w, x. A dash is a placeholder marking which permission is absent.
On a file: read the contents, change the contents, run it.
On a directory: read the list of names, change the list by adding or removing entries, and traverse it to reach what is inside.
r is the list, x is the way through, and they are independent. A directory usually cannot function without x.
Deleting a file needs write permission on the directory, not on the file. A read-only file in a writable directory can be removed without difficulty.
Numeric form: r is 4, w is 2, x is 1, added per group. rwxr-xr-- is 754. The values are powers of two so every combination is a distinct total.
Recognise 644, 755, 600 and 700. Files get 644, directories and programs get 755 — the difference is the execute bit.
An s or t in place of an x is a specialised extra bit, outside Part I.

You can now read any permission string and predict what it allows. The next chapter changes them — in two notations, one of which lets you adjust a single permission without disturbing the other eight.

Where this fits

Part of the Linux & Bash curriculum.