Permission types (read, write, execute) in Linux CLI - Deep Dive

Overview - Permission types (read, write, execute)

What is it?

Permission types in Linux control what actions users can perform on files and directories. There are three main types: read, write, and execute. Read allows viewing the contents, write allows changing them, and execute allows running a file or entering a directory. These permissions help keep the system secure and organized.

Why it matters

Without permission types, anyone could change or run any file, causing accidental damage or security risks. Permissions protect important files from unwanted changes and prevent unauthorized users from running harmful programs. This system helps maintain order and safety on multi-user computers.

Where it fits

Learners should first understand basic Linux commands and file system structure. After mastering permissions, they can learn about ownership, groups, and advanced permission settings like ACLs and sudo. This topic is foundational for system administration and scripting.

Mental Model

Core Idea

Permissions are simple rules that say who can read, change, or run files and folders.

Think of it like...

Think of a file like a locked box: read permission lets you look inside, write lets you add or remove things, and execute lets you use the box as a tool or open it if it’s a door.

┌───────────────┐
│ File or Folder │
└──────┬────────┘
       │
       │
┌──────▼───────┐
│ Permissions  │
│ ┌─────────┐  │
│ │ Read    │  │
│ │ Write   │  │
│ │ Execute │  │
│ └─────────┘  │
└──────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding Basic Permission Types

Concept: Introduce the three basic permission types: read, write, and execute.

In Linux, every file and folder has three permission types: - Read (r): Allows viewing the contents of a file or listing a directory. - Write (w): Allows modifying a file or adding/removing files in a directory. - Execute (x): Allows running a file as a program or entering a directory. These permissions apply separately to the file owner, group, and others.

Result

You know what each permission type means and what actions they allow.

Understanding these three basic permissions is the foundation for controlling access and security on Linux systems.

2

Foundation

Viewing Permissions with ls -l Command

Concept: Learn how to see permissions using the ls -l command.

Run 'ls -l' in the terminal to see files with their permissions. The output shows a string like '-rwxr-xr--' where: - The first character shows file type (- for file, d for directory). - The next three characters are owner permissions (rwx). - The next three are group permissions (r-x). - The last three are others’ permissions (r--). Each letter means read (r), write (w), execute (x), or a dash (-) means no permission.

Result

You can read and understand permission strings for files and directories.

Being able to read permission strings lets you quickly assess who can do what with files.

3

Intermediate

Changing Permissions with chmod Command

🤔Before reading on: Do you think chmod changes permissions for owner only, or can it change group and others too? Commit to your answer.

Concept: Use chmod to change permissions for owner, group, and others.

The chmod command changes permissions. You can specify permissions using letters (r, w, x) and targets (u=owner, g=group, o=others, a=all). Examples: - 'chmod u+x file' adds execute permission to owner. - 'chmod go-w file' removes write permission from group and others. - 'chmod a+r file' adds read permission for everyone. You can also use numeric codes like 755, where each digit represents permissions for owner, group, and others.

Result

You can modify who can read, write, or execute files and directories.

Knowing how to change permissions precisely is key to managing file access securely and flexibly.

4

Intermediate

Understanding Execute Permission on Directories

🤔Before reading on: Does execute permission on a directory let you list its files, enter it, or both? Commit to your answer.

Concept: Execute permission on directories controls the ability to enter and access files inside.

For directories: - Read permission lets you list the files inside. - Execute permission lets you enter the directory and access files if you know their names. - Without execute permission, you cannot cd into the directory or access its contents even if you can list them. Write permission lets you add or remove files inside the directory.

Result

You understand how execute permission affects directory navigation and access.

Recognizing that execute on directories controls access, not just running, prevents confusion and permission errors.

5

Intermediate

Numeric Permission Codes Explained

Concept: Learn how numeric codes represent permissions in chmod.

Permissions can be set using numbers: - Read = 4 - Write = 2 - Execute = 1 Add these for each user type: - Owner - Group - Others Example: 7 means read+write+execute (4+2+1), 5 means read+execute (4+1). So 'chmod 755 file' means: - Owner: 7 (rwx) - Group: 5 (r-x) - Others: 5 (r-x) This shorthand is quick and common in scripts.

Result

You can read and write numeric permission codes confidently.

Understanding numeric codes lets you quickly set complex permissions without typing many letters.

6

Advanced

Combining Permissions for Security and Functionality

🤔Before reading on: Is it safe to give write permission to everyone on a shared directory? Commit to your answer.

Concept: Learn how to combine permissions carefully to balance access and security.

Giving write permission to everyone (others) can cause accidental or malicious changes. For shared directories, often group write permission is enough. Execute permission on scripts is needed to run them. Removing execute from files prevents running them but still allows reading. Use chmod carefully to avoid security risks. Example: 'chmod 750' lets owner full access, group read and execute, others no access.

Result

You can set permissions that protect files while allowing needed access.

Knowing how to combine permissions prevents common security mistakes and system problems.

7

Expert

Permission Bits and Special Flags Internals

🤔Before reading on: Do you think execute permission is stored as a single bit or multiple bits internally? Commit to your answer.

Concept: Explore how permissions are stored as bits and special flags like setuid, setgid, and sticky bit.

Permissions are stored as bits in the file system metadata: - Read, write, execute each use one bit per user type. - Special bits: - setuid (4xxx): runs a program with owner's permissions. - setgid (2xxx): runs with group's permissions or sets group on new files. - sticky bit (1xxx): on directories, only file owners can delete files. These bits add powerful control but can cause security issues if misused. Use 'ls -l' to see special bits (e.g., s or t in permission string).

Result

You understand the low-level permission storage and special flags.

Knowing permission bits and special flags helps diagnose tricky permission problems and secure systems better.

Under the Hood

Linux stores permissions as bits in the inode metadata of each file or directory. Each user class (owner, group, others) has three bits representing read, write, and execute. The kernel checks these bits when a user tries to access a file, allowing or denying actions accordingly. Special bits like setuid, setgid, and sticky bit modify this behavior to enable advanced access control.

Why designed this way?

This bit-based permission system was designed for simplicity, speed, and flexibility in multi-user environments. Early Unix systems needed a fast way to check access without complex rules. The three basic permissions cover most needs, while special bits add power without complicating the core model. Alternatives like Access Control Lists (ACLs) came later to handle more complex cases.

┌───────────────┐
│   File inode  │
│ ┌───────────┐ │
│ │ Permission│ │
│ │ Bits      │ │
│ │ ┌───────┐ │ │
│ │ │r w x  │ │ │
│ │ │r w x  │ │ │
│ │ │r w x  │ │ │
│ │ └───────┘ │ │
│ └───────────┘ │
└───────┬───────┘
        │
        ▼
┌───────────────┐
│ Kernel Access │
│ Check Logic   │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does removing execute permission from a directory prevent listing its files? Commit to yes or no.

Common Belief: If a directory lacks execute permission, you cannot list its files.

Reality: Without execute permission on a directory, you cannot enter it or access files inside, but you can still list files if you have read permission.

Why it matters: Misunderstanding this causes confusion when users can see filenames but cannot open or cd into the directory.

Quick: Does write permission on a file let you run it as a program? Commit to yes or no.

Common Belief: Write permission on a file means you can execute it.

Reality: Write permission allows modifying the file, but execute permission is needed to run it as a program.

Why it matters: Confusing write with execute can lead to permission errors when trying to run scripts or programs.

Quick: Does chmod 777 always make a file safe to share? Commit to yes or no.

Common Belief: Setting permissions to 777 (read, write, execute for all) is safe and convenient for sharing files.

Reality: 777 gives everyone full control, which can cause accidental deletion or security breaches.

Why it matters: Using 777 carelessly can expose systems to attacks or data loss.

Quick: Can the setuid bit be used on directories? Commit to yes or no.

Common Belief: The setuid bit works the same on files and directories.

Reality: setuid affects executable files by running them as the owner, but on directories it is ignored on most systems.

Why it matters: Misusing setuid on directories wastes time and can cause confusion about permission behavior.

Expert Zone

1

The execute bit on directories controls access to metadata and file contents differently than on files, which can cause subtle permission issues.

2

Special bits like setgid on directories can enforce group ownership on new files, aiding collaboration but requiring careful group management.

3

Numeric permission codes are octal representations of bits, and understanding this helps debug permission problems at the binary level.

When NOT to use

Basic read, write, execute permissions are limited for complex access control. Use Access Control Lists (ACLs) or SELinux for fine-grained permissions and security policies in enterprise environments.

Production Patterns

System administrators use permission schemes to separate user roles, protect system files, and enable shared project directories with group permissions and sticky bits. Scripts often set permissions automatically during deployment to ensure security.

Connections

Access Control Lists (ACLs)

Builds-on basic permissions by adding fine-grained control.

Understanding basic permissions is essential before using ACLs, which allow more detailed user and group access rules.

User Roles and Groups

Permissions apply differently based on user ownership and group membership.

Knowing how permissions interact with users and groups helps manage multi-user environments effectively.

Physical Security Locks

Same pattern of controlling access by granting keys or codes to trusted people.

Recognizing that digital permissions mirror physical locks helps grasp why access control is vital for safety and privacy.

Common Pitfalls

#1 Giving write permission to everyone on a shared directory.

Wrong approach:

chmod 777 /shared/directory

Correct approach:

chmod 775 /shared/directory

Root cause:

Misunderstanding that '777' allows anyone to modify or delete files, risking data loss or security breaches.

#2 Trying to run a script without execute permission.

Wrong approach:

./myscript.sh # Permission denied error

Correct approach:

chmod u+x myscript.sh
./myscript.sh

Root cause:

Not realizing execute permission is required to run files as programs.

#3 Removing execute permission from a directory to prevent access but still expecting to list files.

Wrong approach:

chmod o-rx /private_dir
ls /private_dir # Permission denied

Correct approach:

chmod o-r /private_dir
chmod o+x /private_dir
ls /private_dir # Lists files

Root cause:

Confusing the roles of read and execute permissions on directories.

Key Takeaways

Linux permissions control who can read, write, or execute files and directories, protecting system security and data integrity.

Read, write, and execute permissions apply separately to the owner, group, and others, allowing flexible access control.

Execute permission on directories controls the ability to enter and access files, not just running programs.

Changing permissions with chmod can use symbolic letters or numeric codes, each useful in different situations.

Special permission bits add powerful features but require careful use to avoid security risks.