Understanding rwx
Every file has read, write and execute permissions for its owner, its group and everyone else.
Linux controls access with three permissions — read (r), write (w) and execute (x) — granted separately to three groups of people.
The three groups
- Owner — the user who owns the file.
- Group — members of the file's group.
- Other — everyone else.
A leading - means a regular file; d means a directory. On a directory, x means "may enter it".
Example
ls -l script.sh
# -rwxr-xr-- 1 alice devs 812 Jul 15 script.sh
# |└┬┘└┬┘└┬┘
# | | | └── other: read only
# | | └───── group: read + execute
# | └──────── owner: read + write + execute
# └────────── regular fileWhen to use it
- A sysadmin checks 'ls -l /etc/shadow' to confirm only root has read access to the hashed password file.
- A developer troubleshoots a 'Permission denied' error by running 'ls -l script.sh' to see it lacks execute permission.
- A security auditor reviews directory execute bits with 'ls -ld /var/www/html' to ensure the web root is not world-writable.
More examples
Read the permission string
Annotates the 10-character permission string showing file type, and read/write/execute bits for owner, group, and others.
ls -l /etc/passwd
# -rw-r--r-- 1 root root 2847 Jul 1 08:00 /etc/passwd
# ^ type
# ^^^ owner perms (rw-)
# ^^^ group perms (r--)
# ^^^ other perms (r--)Check permissions numerically
Uses stat to print the octal mode, which maps directly to rwx bits (r=4, w=2, x=1).
stat -c '%a %n' /etc/ssh/sshd_config
# 600 /etc/ssh/sshd_config
# 6 = rw- (4+2) 0 = --- 0 = ---
# Only root can read or write the SSH daemon configCheck execute permission before running
Shows that a missing execute bit causes 'Permission denied' even when the file owner tries to run a script.
ls -l deploy.sh
# -rw-r--r-- 1 alice alice 512 Jul 16 09:00 deploy.sh
./deploy.sh
# bash: ./deploy.sh: Permission denied
# The x bit is missing for owner
Discussion