Linux Permission Bits: Read, Write, and Execute

Learn how Linux permission bits work, read ls -l output, understand owner, group, and other permissions, and distinguish file access from directory access.

Linux permission bits are a basic form of access control for filesystem objects such as regular files and directories. They determine whether particular classes of users may read, modify, execute, list, or traverse an object.

This lesson focuses on the nine basic permission bits: three for the owner, three for the group, and three for other users. Ownership information is related but separate. The owner and assigned group determine which permission class is evaluated for a user.

What Linux Permission Bits Control

A Linux file or directory has an associated user owner and group. It also has a mode containing permission positions. When a process accesses the object, Linux determines which user class applies and checks that class's permission bits.

The three classes are evaluated conceptually as follows:

If the accessing user is the owner, Linux uses the owner bits.
Otherwise, if an applicable group relationship exists, Linux uses the group bits.
Otherwise, Linux uses the other bits.

The permission bits do not say who owns an object. Instead, ownership identifies which class a user belongs to for access checking. For more background, see managing Linux file ownership.

The Three Permission Classes

Owner or user

The owner is the user account associated with the file or directory. The first group of three permission positions applies to that account. This class is often called the user class or simply u in permission-related documentation.

Group

The group is the group associated with the filesystem object. The middle group of three positions can apply to users who belong to that group, subject to the normal access rules.

Other

Other means users who are neither the owner nor covered by the applicable group permission class. The final group of three positions applies to these users.

Read, Write, and Execute Symbols

Each permission class has three fixed positions in this order: read, write, and execute. A permission string uses a letter when the permission is present and a hyphen when it is absent.

Permission Symbol Meanings

r — Read. For a regular file, permits reading its contents. For a directory, permits listing names in the directory.

w — Write. For a regular file, permits modifying its contents. For a directory, permits creating, removing, or renaming entries when the required directory access conditions are satisfied.

x — Execute. For a regular file, permits running it as a program or script when the file is otherwise valid. For a directory, permits traversal, searching, and accessing entries by name.

- — Absent. The permission represented by that position is not granted.

Examples of three-position permission triplets include rw-, which grants read and write but not execute; r--, which grants read only; and rwx, which grants all three basic permissions.

Displaying Permissions with ls -l

The ls command lists directory contents. Its long format, requested with -l, displays a permission field along with ownership and other file details.

ls -l

To inspect one named file, use:

ls -l bobs_file.txt

A typical result might look like this:

-rw-rw-r-- 1 root bob 1234 Aug 18 10:30 bobs_file.txt

The basic fields in this output are:

Permission field: -rw-rw-r--, containing a file-type indicator followed by nine basic permission positions.
Link count: 1 in this example.
Owner: root.
Group: bob.
Size: 1234, usually measured in bytes for a regular file.
Timestamp: the displayed modification date and time.
Filename: bobs_file.txt.

The first character of the permission field is a file-type indicator. It is separate from the nine basic permission bits. A hyphen commonly indicates a regular file, while d indicates a directory.

Anatomy of an ls -l Permission Field

A mode string such as -rw-rw-r-- contains ten visible positions: one file-type position followed by three permission triplets.

Anatomy of an ls -l Permission Field

First character — - in -rw-rw-r-- — represents the filesystem object type; here it indicates a regular file.

Positions 2–4 — rw- — represent the owner permissions.

Positions 5–7 — rw- — represent the group permissions.

Positions 8–10 — r-- — represent the other permissions.

The nine basic permission bits can be visually separated like this:

-  rw-  rw-  r--
|  |    |    |
|  |    |    +-- other
|  |    +------- group
|  +------------ owner
+--------------- file type

Reading a Permission String

Consider the mode string -rw-rw-r--:

The leading - identifies a regular file.
The owner triplet is rw-: the owner may read and write, but may not execute the file.
The group triplet is rw-: applicable group users may read and write, but may not execute the file.
The other triplet is r--: other users may read the file, but may not write or execute it.

Every execute position in this example contains a hyphen. Therefore, no class has basic execute permission.

Common Permission Triplets

rwx — Read, write, and execute are granted.

rw- — Read and write are granted; execute is absent.

r-x — Read and execute are granted; write is absent.

r-- — Only read is granted.

--- — None of the three basic permissions are granted.

Permission Meaning for Regular Files

For a regular file, the letters usually have these meanings:

Read (r): permits reading the file's contents.
Write (w): permits modifying the file's contents.
Execute (x): permits running the file as a program or script when it is otherwise valid and the command environment can use it.

A file with rw- has read and write permission but not execute permission. It cannot be run as an executable based on those bits alone.

Permission Meaning for Directories

Directories use the same r, w, and x positions, but the effects are directory-specific.

Read (r): permits listing names in the directory.
Write (w): permits creating, removing, or renaming directory entries when the necessary directory access conditions are met.
Execute (x): permits traversal and searching. It allows a user to access an entry by name and pass through the directory when other requirements are satisfied.

Directory execute permission does not mean executing the directory as a program. It means that the user can traverse or search the directory.

For example:

drwxr-x--- 2 alice developers 4096 Aug 18 10:35 project

The leading d identifies project as a directory.
The owner has rwx: list names, modify entries subject to directory rules, and traverse the directory.
The group has r-x: list names and traverse the directory, but not create, remove, or rename entries through the directory.
Other users have ---: no basic read, write, or traversal permission.

Common Reading Mistakes

Counting ten permission bits

The mode field has ten characters, but only nine are basic permission bits. The leftmost character is the file-type indicator. In -rw-rw-r--, the nine bits are rw-rw-r--.

Assuming rw- allows execution

rw- does not include x. A file must have execute permission in the applicable class to be run as a program or script.

Misreading the final triplet

The final triplet is the other class. If it is r--, users in that class have read-only access, not permission to modify the file.

Treating directory x as program execution

On a directory, x means traversal and searching. It does not mean that the directory itself can be executed like a program.

Assuming group bits apply to everyone

Group permissions apply to users covered by the file's assigned group. Users who are neither the owner nor applicable group members are evaluated using the other triplet.

Quick Interpretation Checklist

Run ls -l or ls -l filename.
Read the first character to identify the object type.
Split the remaining nine characters into owner, group, and other triplets.
Read each triplet from left to right as read, write, and execute.
Identify the object's owner and group before deciding which triplet applies to a particular user.
Remember that directory permissions describe listing, entry modification, and traversal rather than file-content operations.

Exam note: The essential layout is type | owner rwx | group rwx | other rwx. The type character is not one of the nine basic permission bits.