Permission Bits

The previous lesson defined identity. Now what this identity can do to a file can be asked. The answer has been sitting in the first column of listing output from the start:

$ ls -l scripts/summary.sh
-rwxr-xr-x 1 student student 142 Jul 26 18:49 scripts/summary.sh
$ ls -l data/raw/measurement-01.csv
-rw-r--r-- 1 student student 61 Jul 26 19:17 data/raw/measurement-01.csv

The first character is the file type and is unrelated to permission. The remaining nine characters are the table the kernel consults on every access request.

Three Classes, Three Access Types

The nine characters split into three groups of three. The groups correspond to user classes:

• First three: the file’s owner
• Middle three: the file’s group
• Last three: others

Within each group, three access types stand in the same order: read (r), write (w), execute (x). A dash sits in place of a permission that is not granted.

So -rwxr-xr-x means: the owner can read, write, and execute; group members can read and execute but not write; others the same.

Class Selection Is Exclusive

The most common wrong assumption is that permissions are cumulative. They are not. The kernel selects a single class in order and applies only that one:

1. If the requesting process’s user ID is the file’s owner: the owner bits apply.
2. If not, and one of the user’s groups is the file’s group: the group bits apply.
3. If neither: the other bits apply.

Once a decision is made, the other classes are never looked at. The surprising consequence is that an owner can have less access to their own file than others do:

$ chmod 044 /tmp/class.csv
$ ls -l /tmp/class.csv
----r--r-- 1 student student 47 Jul 26 19:20 /tmp/class.csv
$ id -un
student
$ cat /tmp/class.csv
cat: /tmp/class.csv: Permission denied

The file’s owner is student, and the read attempt is denied. The group and other classes have read permission, but because the owner class was selected, they were never consulted.

The owner does retain one advantage: the right to change permissions is not held in the bits, it comes from ownership. An owner can lock themselves out, but can always unlock the file again.

$ chmod 644 /tmp/class.csv
$ cat /tmp/class.csv
time,temperature,humidity
08:00,19.8,61
12:00,23.1,52

Octal Notation

Nine bits, read in groups of three, give three octal digits. The octal base from the How Computers Work course fits this job exactly: each digit encodes exactly three bits.

Weights are fixed by access type:

Access	Letter	Value
Read	r	4
Write	w	2
Execute	x	1

A class’s digit is the sum of the bits open in that class:

Octal	Bits	Meaning
7	rwx	$4+2+1$
6	rw-	$4+2$
5	r-x	$4+1$
4	r--	$4$
0	---	$0$

So -rwxr-xr-x becomes 755, -rw-r--r-- becomes 644, and the ----r--r-- above becomes 044.

Octal notation’s advantage is exactness: chmod 644 sets all nine bits, regardless of the previous state. The letter notation instead makes a selective change.

Symbolic Notation

chmod’s letter form has three parts: which class (u owner, g group, o others, a all), which operation (+ add, - remove, = set exactly), and which bits.

$ chmod 644 /tmp/s.txt
$ ls -l /tmp/s.txt
-rw-r--r-- 1 student student 0 Jul 26 19:20 /tmp/s.txt
$ chmod u+x /tmp/s.txt
$ ls -l /tmp/s.txt
-rwxr--r-- 1 student student 0 Jul 26 19:20 /tmp/s.txt
$ chmod go-r /tmp/s.txt
$ ls -l /tmp/s.txt
-rwx------ 1 student student 0 Jul 26 19:20 /tmp/s.txt
$ chmod a=r /tmp/s.txt
$ ls -l /tmp/s.txt
-r--r--r-- 1 student student 0 Jul 26 19:20 /tmp/s.txt

+ and - touch only the named bits; the others are preserved. = sets a class’s entire bit set to the given value, that is, it turns off any bit not listed.

The choice is clear: use octal to reach a known state, symbolic to add to or remove from an existing one. The chmod +x usage in the command path lesson was of the second kind — the file’s read permissions were kept and only execute was added.

Meaning Changes in Directories

The same three letters mean something entirely different in directories. This is the most commonly misunderstood side of the permission model.

Read (r) allows the names in a directory to be listed.

Write (w) allows entries to be added and removed.

Execute (x) allows passing through a directory, that is, reaching a name inside it. The directory hierarchy lesson said the path is resolved component by component; this is the permission checked at every component.

The two bits are independent and can be tested separately. A directory with only pass-through permission cannot have its contents listed, but a file whose name is known can still be reached:

$ chmod 100 /tmp/dir
$ ls -ld /tmp/dir
d--x------ 3 student student 4096 Jul 26 19:20 /tmp/dir
$ ls /tmp/dir
ls: cannot open directory '/tmp/dir': Permission denied
$ cat /tmp/dir/data.txt
content

Listing was denied, but the file whose name was given directly could be read. This configuration is used in practice: directories whose contents stay hidden but grant access to specific files are set up this way.

The reverse is more striking — read without pass-through:

$ chmod 400 /tmp/dir
$ ls -ld /tmp/dir
dr-------- 3 student student 4096 Jul 26 19:20 /tmp/dir
$ ls /tmp/dir
sub  data.txt
$ ls -l /tmp/dir
ls: cannot access '/tmp/dir/data.txt': Permission denied
ls: cannot access '/tmp/dir/sub': Permission denied
total 0
d????????? ? ? ? ?            ? sub
-????????? ? ? ? ?            ? data.txt

The names could be read because names are the directory’s content. But getting each name’s metadata requires passing through the directory, and pass-through permission is missing; that is why every column shows a question mark. The output makes visible the distinction that names live in the directory while metadata lives in the inode.

The write bit’s effect is also unexpected: a user with write permission on a directory can delete the files inside it — even without any permission on the file itself. Because deleting changes the directory entry, not the file, the permission checked is the directory’s. How this gap is closed is the subject of the special permission bits lesson.

Default Permissions

New files’ permissions are not given by a command; they come from the mask (umask). The mask marks the bits to be turned off: the mask’s bits are subtracted from the requested permissions.

$ umask
0022
$ touch /tmp/u1.txt
$ mkdir -p /tmp/u1dir
$ ls -l /tmp/u1.txt
-rw-r--r-- 1 student student 0 Jul 26 19:20 /tmp/u1.txt
$ ls -ld /tmp/u1dir
drwxr-xr-x 2 student student 4096 Jul 26 19:20 /tmp/u1dir

The arithmetic: the starting value is 666 for files, 777 for directories. Subtracting mask 022 leaves 644 for files and 755 for directories.

Files starting at 666 instead of 777 is deliberate: execute permission should never be granted unintentionally, since a data file being executable is never necessary. In directories, though, a directory cannot be used at all without pass-through permission.

The mask can be changed:

$ umask 077
$ touch /tmp/u2.txt
$ mkdir -p /tmp/u2dir
$ ls -l /tmp/u2.txt
-rw------- 1 student student 0 Jul 26 19:20 /tmp/u2.txt
$ ls -ld /tmp/u2dir
drwx------ 2 student student 4096 Jul 26 19:20 /tmp/u2dir

A 077 mask turns off all bits for the group and other classes; new files are open only to the owner. On multi-user systems this is the preferred default.

The mask is a process property inherited by child processes; to make it persist, it is written into the configuration file read at login — the same place as the PATH setting from the command path lesson.

Summary

• The nine permission bits split into three classes (owner, group, others) and three access types (read, write, execute).
• Class selection is exclusive: the first matching class applies and the others are never consulted; an owner can have less access to their own file than others do.
• In octal notation, read is 4, write is 2, execute is 1; chmod sets exact state with octal, selective change with symbolic notation.
• In directories, read allows listing names, write allows adding and removing entries, execute allows passing through.
• A user with write permission on a directory can delete the files inside it even with no permission on the files themselves.
• New files’ permissions are set by the mask: mask bits are subtracted from a starting value of 666 for files and 777 for directories.

Next Step

If permissions apply based on a file’s owner and group, how are ownership and the group itself changed? The next lesson covers the ownership-changing commands, who can change what, and why symbolic links cause trouble when changing ownership of an entire tree.