--- title: 'Permission Bits' source: 'https://academia.sh/en/courses/introduction-to-linux/permission-bits' course: 'Introduction to Linux' language: en updated: '2026-08-17T18:09:57+00:00' license: 'CC BY-SA 4.0' --- # Permission Bits Splitting the nine permission bits into three classes and three access types, octal notation, the exclusivity of class selection, what bits mean differently in directories, and the mask that sets default permissions. The previous lesson defined identity. Now what this identity can do to a file can be asked. The answer has been sitting in the first column of listing output from the start: ``` $ ls -l scripts/summary.sh -rwxr-xr-x 1 student student 142 Jul 26 18:49 scripts/summary.sh $ ls -l data/raw/measurement-01.csv -rw-r--r-- 1 student student 61 Jul 26 19:17 data/raw/measurement-01.csv ``` The first character is the file type and is unrelated to permission. The remaining nine characters are the table the kernel consults on every access request. ## Three Classes, Three Access Types The nine characters split into three groups of three. The groups correspond to **user classes**: - First three: the file's **owner** - Middle three: the file's **group** - Last three: **others** Within each group, three access types stand in the same order: read (`r`), write (`w`), execute (`x`). A dash sits in place of a permission that is not granted. So `-rwxr-xr-x` means: the owner can read, write, and execute; group members can read and execute but not write; others the same. ## Class Selection Is Exclusive The most common wrong assumption is that permissions are cumulative. They are not. The kernel selects a single class in order and applies **only that one**: 1. If the requesting process's user ID is the file's owner: the owner bits apply. 2. If not, and one of the user's groups is the file's group: the group bits apply. 3. If neither: the other bits apply. Once a decision is made, the other classes are never looked at. The surprising consequence is that an owner can have less access to their own file than others do: ``` $ chmod 044 /tmp/class.csv $ ls -l /tmp/class.csv ----r--r-- 1 student student 47 Jul 26 19:20 /tmp/class.csv $ id -un student $ cat /tmp/class.csv cat: /tmp/class.csv: Permission denied ``` The file's owner is `student`, and the read attempt is denied. The group and other classes have read permission, but because the owner class was selected, they were never consulted. The owner does retain one advantage: the right to change permissions is not held in the bits, it comes from ownership. An owner can lock themselves out, but can always unlock the file again. ``` $ chmod 644 /tmp/class.csv $ cat /tmp/class.csv time,temperature,humidity 08:00,19.8,61 12:00,23.1,52 ``` ## Octal Notation Nine bits, read in groups of three, give three octal digits. The octal base from the How Computers Work course fits this job exactly: each digit encodes exactly three bits. Weights are fixed by access type: | Access | Letter | Value | |---|---|---| | Read | `r` | 4 | | Write | `w` | 2 | | Execute | `x` | 1 | A class's digit is the sum of the bits open in that class: | Octal | Bits | Meaning | |---|---|---| | 7 | `rwx` | $4+2+1$ | | 6 | `rw-` | $4+2$ | | 5 | `r-x` | $4+1$ | | 4 | `r--` | $4$ | | 0 | `---` | $0$ | So `-rwxr-xr-x` becomes `755`, `-rw-r--r--` becomes `644`, and the `----r--r--` above becomes `044`. Octal notation's advantage is exactness: `chmod 644` sets all nine bits, regardless of the previous state. The letter notation instead makes a selective change. ## Symbolic Notation `chmod`'s letter form has three parts: which class (`u` owner, `g` group, `o` others, `a` all), which operation (`+` add, `-` remove, `=` set exactly), and which bits. ``` $ chmod 644 /tmp/s.txt $ ls -l /tmp/s.txt -rw-r--r-- 1 student student 0 Jul 26 19:20 /tmp/s.txt $ chmod u+x /tmp/s.txt $ ls -l /tmp/s.txt -rwxr--r-- 1 student student 0 Jul 26 19:20 /tmp/s.txt $ chmod go-r /tmp/s.txt $ ls -l /tmp/s.txt -rwx------ 1 student student 0 Jul 26 19:20 /tmp/s.txt $ chmod a=r /tmp/s.txt $ ls -l /tmp/s.txt -r--r--r-- 1 student student 0 Jul 26 19:20 /tmp/s.txt ``` `+` and `-` touch only the named bits; the others are preserved. `=` sets a class's entire bit set to the given value, that is, it turns off any bit not listed. The choice is clear: use octal to reach a known state, symbolic to add to or remove from an existing one. The `chmod +x` usage in the command path lesson was of the second kind — the file's read permissions were kept and only execute was added. ## Meaning Changes in Directories The same three letters mean something entirely different in directories. This is the most commonly misunderstood side of the permission model. **Read (`r`)** allows the **names in a directory to be listed**. **Write (`w`)** allows **entries to be added and removed**. **Execute (`x`)** allows **passing through** a directory, that is, reaching a name inside it. The directory hierarchy lesson said the path is resolved component by component; this is the permission checked at every component. The two bits are independent and can be tested separately. A directory with only pass-through permission cannot have its contents listed, but a file whose name is known can still be reached: ``` $ chmod 100 /tmp/dir $ ls -ld /tmp/dir d--x------ 3 student student 4096 Jul 26 19:20 /tmp/dir $ ls /tmp/dir ls: cannot open directory '/tmp/dir': Permission denied $ cat /tmp/dir/data.txt content ``` Listing was denied, but the file whose name was given directly could be read. This configuration is used in practice: directories whose contents stay hidden but grant access to specific files are set up this way. The reverse is more striking — read without pass-through: ``` $ chmod 400 /tmp/dir $ ls -ld /tmp/dir dr-------- 3 student student 4096 Jul 26 19:20 /tmp/dir $ ls /tmp/dir sub data.txt $ ls -l /tmp/dir ls: cannot access '/tmp/dir/data.txt': Permission denied ls: cannot access '/tmp/dir/sub': Permission denied total 0 d????????? ? ? ? ? ? sub -????????? ? ? ? ? ? data.txt ``` The names could be read because names are the directory's **content**. But getting each name's metadata requires passing through the directory, and pass-through permission is missing; that is why every column shows a question mark. The output makes visible the distinction that names live in the directory while metadata lives in the inode. The write bit's effect is also unexpected: a user with write permission on a directory can **delete the files inside it** — even without any permission on the file itself. Because deleting changes the directory entry, not the file, the permission checked is the directory's. How this gap is closed is the subject of the special permission bits lesson. ## Default Permissions New files' permissions are not given by a command; they come from the **mask (umask)**. The mask marks the bits to be turned off: the mask's bits are subtracted from the requested permissions. ``` $ umask 0022 $ touch /tmp/u1.txt $ mkdir -p /tmp/u1dir $ ls -l /tmp/u1.txt -rw-r--r-- 1 student student 0 Jul 26 19:20 /tmp/u1.txt $ ls -ld /tmp/u1dir drwxr-xr-x 2 student student 4096 Jul 26 19:20 /tmp/u1dir ``` The arithmetic: the starting value is `666` for files, `777` for directories. Subtracting mask `022` leaves `644` for files and `755` for directories. Files starting at `666` instead of `777` is deliberate: execute permission should never be granted unintentionally, since a data file being executable is never necessary. In directories, though, a directory cannot be used at all without pass-through permission. The mask can be changed: ``` $ umask 077 $ touch /tmp/u2.txt $ mkdir -p /tmp/u2dir $ ls -l /tmp/u2.txt -rw------- 1 student student 0 Jul 26 19:20 /tmp/u2.txt $ ls -ld /tmp/u2dir drwx------ 2 student student 4096 Jul 26 19:20 /tmp/u2dir ``` A `077` mask turns off all bits for the group and other classes; new files are open only to the owner. On multi-user systems this is the preferred default. The mask is a process property inherited by child processes; to make it persist, it is written into the configuration file read at login — the same place as the `PATH` setting from the command path lesson. ## Summary - The nine permission bits split into three classes (owner, group, others) and three access types (read, write, execute). - Class selection is exclusive: the first matching class applies and the others are never consulted; an owner can have less access to their own file than others do. - In octal notation, read is 4, write is 2, execute is 1; `chmod` sets exact state with octal, selective change with symbolic notation. - In directories, read allows listing names, write allows adding and removing entries, execute allows passing through. - A user with write permission on a directory can delete the files inside it even with no permission on the files themselves. - New files' permissions are set by the mask: mask bits are subtracted from a starting value of `666` for files and `777` for directories. ## Next Step If permissions apply based on a file's owner and group, how are ownership and the group itself changed? The next lesson covers the ownership-changing commands, who can change what, and why symbolic links cause trouble when changing ownership of an entire tree.