Filesystems · foundation
Unix file permissions
Traditional Unix permissions store read, write, and execute bits for three classes: the file's owner, its group class, and others. The meaning of each bit depends on whether the object is a regular file or a directory.
Why it matters
Permissions determine whether commands can read data, modify files, execute programs, list directory names, or traverse directory paths. Misreading directory bits causes many confusing access failures.
Mental model
How to reason about unix file permissions
Access checks first select an applicable class based on the process's effective credentials, then test the requested operation against that class's bits and any additional ACL or security rules. For directories, read exposes names, write changes entries, and execute permits traversal and lookup.
Analogy
Permissions are three sets of access badges for an object: owner, group, and everyone else. A directory's badges govern using the index and doors, not reading and editing one flat document.
Examples
See the boundary, not just the happy path
Worked example · Make a private regular file
chmod u=rw,go= secrets.envThe owner receives read and write; group and others receive no traditional mode permissions. This does not remove access granted by privileged capabilities or every possible ACL.
Worked example · Create a shared traversable directory
chmod 2750 team-dataOwner gets rwx, group gets r-x, and others get none. The leading 2 sets setgid, which commonly makes new entries inherit the directory's group on Unix-like systems.
Useful contrast · Directory execute means traversal
chmod 711 public-pathOther users can traverse public-path when they know a contained name, but cannot list its names without directory read permission. This differs from executing a regular program file.
Common mistakes
Misconceptions to remove early
Applying regular-file meanings to directories
Directory read controls listing names, write controls adding or removing entries, and execute controls lookup/traversal. Useful access often requires combinations of these bits.
Assuming mode bits are the entire authorization system
ACLs, capabilities, mandatory access controls, mount options, and privileged processes can further allow or deny operations. ls -l is important but not always complete.
Quick check
Can you predict the result?
1. What does execute permission on a directory primarily allow?
- • Searching or traversing the directory during pathname lookup.
- • Running every regular file stored inside it.
- • Listing all names in it without any other permission.
2. Why might access still be denied when ls -l appears to grant it?
Keep building