VMware ESXi and vSphere Cluster Management

Linux Permission Bits: Read, Write, and Execute Access

Learn how Linux permission bits work, how owner, group, and other access is represented, and how to read permissions with ls -l.

What Linux Permission Bits Do

Linux uses permission bits to describe basic access control for files and directories. The basic model contains nine access-control positions: three for the file's owner, three for its group, and three for other users.

These permissions regulate what different users may do with a filesystem object. Linux evaluates the classes separately: the owner uses the owner permissions, a matching group member uses the group permissions, and everyone else uses the other permissions.

The Three Permission Classes

Every file and directory has an associated user account and group. The permission classes are always shown in this order:

1. Owner or user: the account that owns the file or directory.
2. Group: users who belong to the group assigned to the file or directory.
3. Other: users who are neither the owner nor members of the assigned group.

For access decisions, the owner class takes precedence for the owner account. A user who is not the owner is evaluated against the group class when the user matches the assigned group; otherwise, the other class applies.

Read, Write, and Execute Symbols

Each class has three fixed positions in r, w, x order:

• r means read permission.
• w means write permission.
• x means execute permission.
• - means that permission is not granted in that position.

For example, rw- grants read and write but not execute. The three positions are repeated for owner, group, and other to create nine basic permission bits.

Reading ls -l Output

The ls -l command displays a long listing. It includes the mode, link count, owner, group, size, time information, and filename.

$ ls -l bobs_file.txt
-rw-rw-r-- 1 bob developers 1200 Aug 18 10:15 bobs_file.txt

The mode is the first field on the line: -rw-rw-r--. It is commonly called a permission string, although it contains both a file-type indicator and permission positions. The complete leading field is also part of the file's mode.

Split -rw-rw-r-- like this:

- | rw- | rw- | r--
  | owner | group | other

The first character is not one of the nine basic permission bits. It identifies the object type. The remaining nine characters are the owner, group, and other permission triplets.

Common File-Type Indicators

The first character in an ls -l mode field identifies the kind of filesystem object.

For example, d in drwxr-xr-x means the object is a directory, while - in -rw-r--r-- means it is a regular file. In lrwxrwxrwx, the leading l identifies a symbolic link. Do not interpret the displayed link permissions as the target's effective access permissions; inspect the target when you need to understand access to the referenced object.

Practical Example: -rw-rw-r--

Consider this listing:

-rw-rw-r-- 1 bob developers 1200 Aug 18 10:15 bobs_file.txt

• The leading - identifies a regular file.
• The owner triplet rw- means the owner can read and modify the file, but cannot execute it.
• The group triplet rw- means members of the assigned group can read and modify the file, but cannot execute it.
• The other triplet r-- means all other users can read the file but cannot modify or execute it.

Therefore, the owner and matching group members can read and change the file. Other users can read it only. No class has execute permission because none of the three triplets contains x.

Directory Permissions

Read, write, and execute have related but different practical meanings for directories:

• Read generally allows a user to list the names in the directory.
• Write generally allows changes to directory entries, such as creating, removing, or renaming entries when the surrounding permissions permit the operation.
• Execute allows traversal or lookup through the directory. It is needed to access an object by path inside the directory.

A typical directory mode is drwxr-xr-x. The owner has read, write, and execute access. The group and other classes have read and execute access but not write access. The leading d identifies the object as a directory.

$ ls -ld directory_name
drwxr-xr-x 2 bob developers 4096 Aug 18 10:20 directory_name

The -d option tells ls to show the directory itself rather than listing the directory's contents.

Useful Inspection Commands

• ls -l displays files in the current directory using long-listing format.
• ls -l bobs_file.txt inspects one named file and shows its mode, owner, group, and other metadata.
• ls -ld directory_name inspects the directory object itself.

$ ls -l bobs_file.txt
$ ls -ld directory_name

The owner and group names appear after the link count in a long listing. In the example, bob is the owner and developers is the assigned group. Those names help you determine which permission class applies to a user.

Common Reading Mistakes

• Treating the first hyphen as a missing permission: In -rw-rw-r--, the first - means regular file. Start the permission analysis with the next nine characters.
• Applying group permissions to every user: The group triplet applies to users who belong to the file's assigned group, not to all users.
• Assuming read and write imply execute: Execute is independent and appears as x in the third position of a triplet.
• Ignoring file type: Check the leading character to distinguish a regular file, directory, symbolic link, or another object type.

Exam- and Practice-Ready Summary

• Linux's basic access model has nine permission bits: owner, group, and other, with three bits per class.
• The fixed order within each class is read, write, execute: rwx.
• A hyphen means the permission in that position is absent.
• The first character in an ls -l mode field identifies file type and is not one of the nine permission bits.
• -rw-rw-r-- describes a regular file whose owner and group can read and write, while other users can read only.
• drwxr-xr-x describes a directory whose owner has all three permissions and whose group and other classes have read and execute.
• Read, write, and execute have directory-specific meanings: list names, change entries, and traverse or look up paths.

After learning to inspect these bits, the next related skills are changing permissions with chmod, changing ownership with chown or chgrp, and investigating advanced controls such as ACLs.