VMware ESXi and vSphere Cluster Management

Identify File Types in Linux

Learn to identify Linux file types from ls -l, stat, file, find, readlink, and realpath, and understand how types differ from permissions and extensions.

Linux treats many kinds of filesystem objects as files. A regular document, a directory, a device interface, a named pipe, and a local socket all have a filesystem type recorded in their metadata. That type tells the kernel and programs how the object can be interpreted and accessed.

This lesson focuses on reading the first character of an ls -l mode string and verifying the result with standard Linux commands.

What a Linux file type is

A file type is the category of a filesystem object. The type is stored in filesystem metadata, including metadata associated with the object's inode. An inode is a filesystem metadata structure that records attributes such as the object type, permissions, ownership, and information used to locate its data.

Linux broadly treats resources as files because programs can often interact with them through file descriptors and filesystem paths. Directories organize names, device files provide interfaces to hardware or kernel facilities, and sockets provide communication endpoints. These objects are not all ordinary stored data, so their types affect how the kernel and programs interact with them.

Reading file types with ls -l

The ls -l command displays each entry in long format. Its mode string begins with one character for the object type, followed by nine permission positions.

-rwxr-xr--

Read the mode string in two parts:

  • The first character, - in this example, identifies the filesystem object type.
  • The remaining nine characters are permission bits: three for the owner, three for the group, and three for other users.
position:  1   2-4  5-7  8-10
meaning:   type owner group other
example:    d   rwx  r-x  r-x
full field: drwxr-xr-x

The type character and permission bits appear together, but they are separate concepts. The first character says what kind of object it is. The following characters describe allowed actions.

Common mode-string examples

-rw-r--r--  regular file
 drwxr-xr-x directory
 lrwxrwxrwx symbolic link

In an actual listing, the space before drwxr-xr-x above is only for visual alignment; the mode field itself starts with d.

Linux file type characters

Character  Type              Purpose                         Example
-          regular file      Stored data                     text, image, script
 d         directory         Names mapped to objects         /home/user
 l         symbolic link     Path reference                  shared configuration link
 c         character device  Character-stream interface      terminal or /dev/null
 b         block device      Block-addressed storage         disk or partition
 p         FIFO              Named IPC channel               producer-consumer pipe
 s         socket            Local process endpoint          service socket

The listed characters are the standard types users commonly encounter. Some filesystems or tools may expose uncommon filesystem-specific types, but the seven types above are the important general-purpose categories.

Regular files: -

A regular file is an ordinary file containing user or program data. Text, images, shell scripts, compiled executables, archives, and binary data are all regular files. They are represented by - as the first character of the ls -l mode string.

Directories: d

A directory is a filesystem object that organizes names and references to other objects. Conceptually, it maps names such as notes.txt to filesystem objects. Directories form the path hierarchy used to navigate the filesystem.

Execute permission on a directory does not mean that the directory contains executable program code. It generally controls whether a user may traverse or search the directory, including accessing entries when other required permissions are present.

Symbolic links: l

A symbolic link is a special file containing a path to another file or directory. It is commonly called a symlink. Long listings usually show the target after an arrow:

lrwxrwxrwx 1 user user 12 Aug 18 10:00 current -> releases/v2

A link can be dangling when its stored target path does not currently resolve to an existing object. The link itself still exists, but opening it through the link fails until the target is restored or the link is changed.

Character devices: c

A character device is a device interface that commonly transfers data as a stream of characters or bytes. Terminals and special devices such as a null device are typical examples. Device files are commonly found under /dev.

Block devices: b

A block device is a storage-oriented device interface accessed in blocks. Disks and partitions are common examples. Programs and the kernel use block devices differently from character-stream devices because storage is organized into addressable blocks.

Named pipes: p

A FIFO, or named pipe, is a filesystem-named channel for one-way interprocess communication. One process can write data while another reads it. The name persists in the filesystem, but the data passes between processes rather than being stored as ordinary file contents.

Local sockets: s

A socket is a communication endpoint. A local Unix-domain socket can allow processes on the same machine to communicate through a filesystem path. Service managers, desktop services, databases, and other programs commonly use sockets.

Interpreting a mixed listing

-rw-r--r-- 1 sam users  1200 Aug 18 09:00 notes.txt
drwxr-xr-x 2 sam users  4096 Aug 18 09:01 projects
lrwxrwxrwx 1 sam users     7 Aug 18 09:02 latest -> projects
crw-rw-rw- 1 root root  1, 3 Aug 18 09:03 null
brw-rw---- 1 root disk  8, 0 Aug 18 09:04 disk0
prw------- 1 sam users     0 Aug 18 09:05 work.pipe
srwxr-xr-x 1 sam users     0 Aug 18 09:06 service.sock

Identify only the first character first:

  • notes.txt begins with -, so it is a regular file.
  • projects begins with d, so it is a directory.
  • latest begins with l, so it is a symbolic link.
  • null, disk0, work.pipe, and service.sock begin with c, b, p, and s respectively.

Only after identifying the type should you interpret the permission positions.

File type versus permissions

In -rwxr-xr-x, the first - means regular file. It is not a missing permission. The next nine positions are permissions:

- rwx r-x r-x
  |   |   |
  |   |   other users
  |   group
  owner

Both a regular executable file and a directory can contain the character x in their permission fields:

-rwxr-xr-x  program
 drwxr-xr-x  project-directory

The first character distinguishes them. Execute permission on the regular file permits execution when the file is a suitable program or script. Execute permission on the directory permits traversal or searching; it does not execute the directory as code.

File type versus filename and extension

Linux does not determine a filesystem object's type from its filename extension. A regular file named photo.jpg, report.txt, or run.exe still begins with - in ls -l. Renaming a directory to end in .txt does not turn it into a regular file.

The file command answers a different question. It may inspect file contents, recognizable signatures, also called magic numbers, and text characteristics to infer a regular file's data format. A file signature or magic number is a recognizable sequence of content bytes used for this purpose.

Commands for determining file types

ls -l: quick visual inspection

ls -l PATH

Use the first character of each mode string for a quick classification. When the path is a directory, plain ls -l directory lists its contents. To inspect the directory entry itself, use:

ls -ld directory

The -d option tells ls to display the directory entry rather than listing the directory's contents.

stat: explicit metadata

stat PATH

stat displays detailed metadata and normally includes an explicit human-readable description such as regular file, directory, symbolic link, character special file, block special file, FIFO, or socket. It is useful when the single-character mode field is not enough.

file: content detection

file PATH

Use file to identify likely content formats such as plain text, an image format, or an executable format. It can also classify special filesystem objects. For a regular file, its result describes the data format, while ls -l describes the filesystem object category.

$ ls -l picture.png script.sh program
-rw-r--r-- ... picture.png
-rwxr-xr-x ... script.sh
-rwxr-xr-x ... program

$ file picture.png script.sh program
picture.png: PNG image data
script.sh:   POSIX shell script, ASCII text executable
program:     ELF executable

All three entries are regular files because they begin with -, even though their contents differ.

find: search by type

find uses type tests to locate objects in a directory tree:

find PATH -type f    # regular files
find PATH -type d    # directories
find PATH -type l    # symbolic links
find PATH -type p    # FIFOs
find PATH -type s    # sockets

On systems where you have permission to inspect device entries, the corresponding tests are:

find PATH -type c    # character devices
find PATH -type b    # block devices

The letters after -type are filters understood by find; they correspond to the common classifications but are command syntax, not permission positions.

readlink and realpath: inspect symbolic links

readlink LINK
realpath LINK

readlink prints the path stored inside a symbolic link. realpath attempts to resolve the link and print a canonical path. Resolution can fail for a dangling link, so use readlink when you need to inspect the stored target even if that target is missing.

Practical symbolic-link example

printf '%s\n' 'hello' > original.txt
ln -s original.txt current.txt
ls -l current.txt
readlink current.txt
realpath current.txt

The listing should show a leading l and notation similar to current.txt -> original.txt. The regular file is original.txt; current.txt is a path reference to it.

To make a broken-link example in a writable practice directory:

ln -s missing.txt broken.txt
ls -l broken.txt
readlink broken.txt
realpath broken.txt

readlink can print missing.txt, while realpath may report an error because the target cannot be resolved.

Practical FIFO example

Create named pipes only in a safe, writable practice directory:

mkfifo work.pipe
ls -l work.pipe
stat work.pipe
rm work.pipe

The mode string should begin with p. A FIFO can block when one process opens it for writing without a reader, so inspect it without casually writing to it. Device files and sockets may require privileges, a particular location, or a program that creates them; existing examples are safer for learning.

Troubleshooting

The first hyphen looks like a missing permission

In -rwxr-xr-x, the first hyphen is the regular-file type indicator. Read it separately from the nine permission positions.

ls -l directory shows contents instead of d

This is normal: ls lists a directory's contents when given a directory argument. Use ls -ld directory to display the directory entry itself.

A symbolic link exists but opening it fails

The link may be dangling. Run ls -l LINK to see its target and readlink LINK to print the stored path. Verify that the target exists relative to the link's location and recreate or update the link if needed.

file and ls -l appear to disagree

There is no conflict when file reports text or an image while ls -l shows -. The former identifies content format; the latter identifies the filesystem object type. Use both tools for their distinct purposes.

A special file cannot be created

Device files and sockets may require privileges, a particular filesystem location, or a service that creates them. Use existing device and socket examples for inspection. Safe practice examples include symbolic links and FIFOs in a writable directory.

Exam-relevant summary

  • The first character of an ls -l mode string identifies the filesystem object type.
  • - means regular file, d directory, l symbolic link, c character device, b block device, p FIFO, and s socket.
  • The following nine positions are permission bits for owner, group, and other users.
  • Filename extensions do not determine Linux filesystem types.
  • file commonly identifies content format, not merely the filesystem category.
  • stat provides explicit type and metadata details.
  • find -type l searches for symbolic links, and analogous tests search for other common types.
  • Use readlink to inspect a stored link target and realpath to resolve it when possible.