Linux File Permissions
The Three Permission Classes and Their Rights
Linux file permissions decide who may read, change or run each file and directory, using three sets of rights: one each for the owner, the group and others, meaning everyone else. Each set can include read, write and execute rights.
For a regular file, read allows the contents to be viewed, write allows them to be changed, and execute allows the file to run as a program or script. For a directory, read allows names inside to be listed, write allows entries to be created or removed, and execute allows the directory to be entered and its contents accessed.
The system checks the classes in order. If the user is the owner, the owner set applies. If not, it checks whether the user is in the file's group. Only if neither applies is the "others" set used. Permissions are therefore evaluated in sequence, not added together. Ownership is covered in the article on users and groups.
Reading the Symbolic Notation in ls -l Output
The usual way to see permissions is the long listing from ls -l. A line such as -rw-r--r-- packs the information into ten characters. The first character gives the file type, where a hyphen means a regular file and a d means a directory.
The other nine characters form three groups of three, for owner, group and others. In each group the positions stand for read, write and execute. A letter means the right is granted and a hyphen means it is not. So rw- means read and write but not execute, and r-- means read only.
Some listings show an extra character at the end, such as a plus sign for extended access control lists. These go beyond the basic model and are usually covered in more advanced documentation. The numeric form of the same bits is explained in the article on chmod numeric modes.
Example: Permissions on a Website's Files
A common setup for a website is for the administrator to own the HTML and image files and for the web server to read them without being able to change them. The owner keeps write access for editing. In such a layout, the listing for a page might read -rw-r--r--, meaning the owner can edit it while the group and everyone else can only read it.
If the web server could write to every file, a flaw in a website script could let an attacker overwrite pages. Keeping write access narrow limits what a compromised component can change. Root can override these checks, as explained in the article on the root user, which is why permission design matters on servers as much as on personal computers.
Frequently asked questions
What Does drwxr-xr-x Mean?
It describes a directory, shown by the leading d. The owner can read, write and enter it. The group and others can read and enter it, but cannot add or remove entries. For directories, the execute right means permission to enter the folder and access the files inside.
Why Can't I Edit a File I Can See?
Being able to see a file is not the same as being able to change it. If the write right is not granted to your user, to your group or to others, editing will be refused. Being in the wrong group, or the file being owned by another account, are the most common reasons, along with a folder that does not allow you to create files.