Linux Directory Permissions: Read, Write, Execute
In the Linux operating system, standard file permissions—read, write, and execute—behave significantly differently when applied to directories compared to regular files. While file permissions control access to file content and execution capability, directory permissions control how users interact with the directory's internal table of contents and traverse the filesystem hierarchy. Understanding the distinction between these permissions is critical for properly securing files, managing access control, and troubleshooting file management issues.
The Read Permission (r)
On a directory, the read permission controls the ability to view the directory contents.
- What it allows: A user with read access can list
the names of files and subdirectories located within the directory (for
example, using the
lscommand). - What it does not allow: Read permission alone does
not allow the user to view file metadata (such as file sizes, ownership,
or timestamps), nor does it allow accessing or modifying the files
inside. If a user runs
ls -lon a directory with read permission but without execute permission, the filenames may appear, but metadata fields will display question marks (?), and access will be denied.
The Write Permission
(w)
The write permission grants the ability to modify the contents of the directory itself.
- What it allows: A user can create new files, delete existing files, and rename files within the directory.
- Important behavior: In Linux, file deletion and creation are directory-level actions, not file-level actions. If a user has write and execute access to a directory, they can delete any file within it, even if they do not own the file or lack write permissions to the file itself (unless the sticky bit is applied).
- Dependency: Write permission on a directory is ineffective without execute permission. A user cannot create or delete files without the ability to traverse into the directory.
The Execute Permission
(x)
For directories, the execute permission is often referred to as the "search" or "traverse" permission.
- What it allows: The execute permission allows a
user to pass through (traverse) the directory to access its
subdirectories and files, or change into it using the
cdcommand. It also allows the system to read the metadata (inodes, file size, permissions) of files within the directory. - Direct file access: If a user knows the exact name
of a file and has the appropriate permissions on that file, having only
execute access (without read access) on the parent directory allows them
to open, read, or edit that file. However, they will not be able to list
the directory using
lsto find out what files are there.
Common Permission Combinations
- Execute only (
--x): The user cancdinto the directory or access a known file path directly, but cannot list files usingls. - Read only (
r--): The user can see the list of file names, but cannotcdinto the directory, cannot read file metadata (ls -lwill fail), and cannot access the files. - Read and Execute (
r-x): The standard "read-only" state for a directory. The user can view files, view file details (ls -l),cdinto the directory, and read files (subject to individual file permissions). - Read, Write, and Execute (
rwx): Full control. The user can enter, list, read, create, rename, and delete any files within the directory.