Linux permissions: read and understand file rights

The ls -l command shows a series of rwx letters next to each file: those are the permissions. They decide who can read, change or run a file. Knowing how to read them is essential before changing them, and that is what this guide is about.

What you will learn

• Decode each column of ls -l
• Understand r, w, x applied to a file
• Understand r, w, x applied to a directory
• Tell apart the owner, the group and the others
• Know the role of umask (default permissions)

How do you read the output of ls -l?

The ls -l command prints one line per file, and the first ten characters of each line hold its permissions:

ls -l

Output

-rw-r--r-- 1 bob bob  4096 Apr  6 10:00 report.txt
drwxr-xr-x 2 bob bob  4096 Apr  6 10:00 projects
-rwxr-x--- 1 bob dev  8192 Apr  6 10:00 script.sh

Each line reads from left to right, and every column has a fixed meaning:

Position	Example	Meaning
1st character	- or d	Type: - = file, d = directory, l = link
Characters 2-4	rw-	Rights of the owner (user)
Characters 5-7	r--	Rights of the group
Characters 8-10	r--	Rights of the others (everyone else)
Number	1	Number of links
Name 1	bob	Owner of the file
Name 2	bob	Group of the file
Size	4096	Size in bytes
Date	Apr 6	Date of last change
Name	report.txt	Name of the file or directory

Swipe to see more

What do r, w and x mean?

The same three letters apply to files and to directories, but they do not protect the same thing. On a file they protect its contents; on a directory they protect its list of names.

On a file

On a file, each letter matches an action on its contents:

Permission	Letter	Meaning
Read	r	Read the contents of the file
Write	w	Change the contents of the file
Execute	x	Run the file (script, program)

Swipe to see more

A dash - in place of a letter means that the permission is absent. Four combinations cover most of what you will read:

Permissions	Meaning
rw-	Read and write, no execute
r--	Read only
rwx	Every right
---	No right

Swipe to see more

On a directory

The same letters have a different meaning for directories, because a directory is a list of names:

Permission	Letter	Meaning on a directory
Read	r	List the contents (ls)
Write	w	Create, rename or delete files in the directory (with x)
Execute	x	Enter the directory (cd) and reach the files

Swipe to see more

The trap of a directory without x

A directory with r-- lets you list the file names, but not open them or enter the directory. Without x, the directory is unreachable in practice.

Deleting a file: the directory decides

A counter-intuitive point, often misunderstood. Deleting a file does not write to the file: the operation removes its name from the parent directory, through the unlink system call. The rights checked are therefore those of the directory, not of the file. You need the w (change the contents of the directory) and the x (go through the directory to reach it).

A direct consequence: a file in chmod 000 is deleted without any trouble if you have the w on its directory, whereas a file in 777 is indestructible in a directory where you do not have the w. The permissions of a file protect its contents; those of the directory protect its name and its existence.

Three exceptions reverse this rule, documented in unlink(2):

• the sticky bit (chmod +t, the t of /tmp): in a shared directory, only the owner of the file (or of the directory, or root) can delete it, even if everyone has the w;
• the immutable attribute (chattr +i): deletion refused, even to root, whatever the permissions;
• a file system mounted read-only: no deletion possible.

What are the three levels of rights?

The 9 permission characters are split into three groups of three, one per category of user:

 rwx   r-x   r--
 ───   ───   ───
  u     g     o

Level	Letter	Applies to
User (owner)	u	The owner of the file
Group	g	The members of the file's group
Others	o	Every other user

Swipe to see more

The system checks the rights in this order, and stops at the first level that matches you:

1. Are you the owner? → u rights apply
2. Are you a member of the group? → g rights apply
3. Otherwise → o rights apply to the others

Only one level applies

If you are the owner, only the u rights count, even if the g or o rights are more permissive. The system stops at the first level that matches.

How do you decode common examples?

These four permission strings come up constantly. Read each one level by level, owner, then group, then others:

Permissions	Who can do what
-rw-r--r--	Owner reads and writes. Group and others only read.
-rwxr-xr-x	Owner has every right. Group and others read and execute.
-rwx------	Only the owner has access. Nobody else can do anything.
drwxr-xr-x	Directory open to everyone, but only the owner can create files in it.

Swipe to see more

To practise, run ls -la in your home directory:

ls -la ~/

Try to decode each line: who is the owner? which group? which permissions for each level?

What does umask do?

When you create a file, it does not get rwxrwxrwx by default. A mask called umask automatically removes some permissions at creation time.

umask

Usual output

0022

The umask 022 means that the w permissions are removed for the group and the others:

Creation	Without umask	With umask 022	Result
File	666 (rw-rw-rw-)	666 − 022	644 (rw-r--r--)
Directory	777 (rwxrwxrwx)	777 − 022	755 (rwxr-xr-x)

Swipe to see more

Check the permissions of a freshly created file

touch test.txt && ls -l test.txt

You will see -rw-r--r-- if your umask is 022.

Troubleshooting

Most permission errors come down to a level you did not expect, or to a directory on the path rather than the file itself. Before changing anything, read the rights of the file and of its parent with ls -ld.

Symptom	Likely cause	Fix
Permission denied when reading a file	No r right for your level	Check with ls -l and ask the owner
Permission denied when entering a directory	No x right on the directory	Check with ls -ld directory/
A new file is readable by everyone although it should not be	Default umask 022, which leaves r to others	umask 077 in the session, or chmod 600 on the file
ls works but cat file does not	r right on the directory but not on the file	Check the rights of the file itself

Swipe to see more

Key points

• ls -l shows permissions in the form rwxrwxrwx: owner, group, others.
• r = read, w = write/change, x = execute (file) or enter (directory).
• The system checks a single level: user → group → others, in that order.
• Deleting a file depends on the directory (w + x), not on the file: chmod 000 does not protect from deletion. Exceptions: sticky bit, chattr +i, read-only file system.
• umask decides the default permissions of new files.
• Understanding permissions is a prerequisite before changing them.

Knowledge check

Check that the essentials of this guide stuck. The questions cover only what has just been explained here.

Knowledge check

Check what you have learned with this interactive quiz

6 questions

6 min

70% to pass

How it works

• The timer starts when you click Start
• Multiple choice, true/false and short answer questions
• You can move between questions
• Detailed results are shown at the end

Start the quiz

Starts the quiz and the timer

×

See in the glossary →