The "rwx" Triad: Read, Write, Execute

Decoding the Permission String

When you run ls -l, you see something like -rw-r--r-- 1 alice developers 2048 Jan 15 10:30 report.txt.

That first column (-rw-r--r--) is the permission string. It's 10 characters long. The first character indicates the file type (- for regular file, d for directory, l for symbolic link). The remaining 9 characters are three groups of three, representing permissions for User, Group, and Others respectively.

For each of the three categories (User, Group, Others), we define three basic actions they might be allowed to perform:

1. Read (r)

• For a File: You can open the file and see its contents. Commands like cat, less, grep, and text editors need read permission.
• For a Directory: You can list the filenames inside that directory using ls. However, you cannot access the files themselves without execute permission (see below).

2. Write (w)

• For a File: You can modify the file's contents, append to it, or truncate it. Text editors, echo >>, and programs that write output need write permission.
• For a Directory: You can create new files, delete existing files, or rename files inside that directory. Crucial Note: You do not need write permission on a file to delete it; you need write permission on the directory that contains it. This is a common source of confusion and interview questions.

3. Execute (x)

• For a File: You can run the file as a program or script. For scripts (shell, Python, etc.), the interpreter must also be able to read the file, but the execute bit is what allows the shell to launch it.
• For a Directory: You can "enter" the directory using cd and access files inside it if you know their names. Without execute permission, you cannot cd into a directory even if you have read permission to list its contents. You also cannot access file metadata (like running ls -l on a specific file inside the directory).

The Directory Execute Gotcha:

Execute permission on a directory is often called "traverse" or "search" permission. If a directory has r-- (read but not execute), you can see the list of filenames with ls, but you cannot cd into it or access any of the files. If it has --x (execute but not read), you cannot list the contents, but if you know a filename, you can access it directly (e.g., cat /path/to/dir/known_file.txt). This asymmetry is sometimes used deliberately for "hidden" directories where you want to allow access to specific files without revealing what else is there.

Key Point: In production systems, especially when debugging permission issues, always check both the file permissions AND all parent directory permissions in the path. A file might be world-readable, but if any parent directory lacks execute permission for your user, you cannot reach the file. This is a common cause of "Permission denied" errors that confuse junior engineers. Use namei -l /full/path/to/file to see permissions for every component of a path in one command.