Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In my CMS, I noticed that directories need the executable bit (+x) set for the user to open them. Why is the execute permission required to read a directory, and how do directory permissions in Linux work?

share|improve this question
11  
...uh, because that's what the "+x" flag is for :) –  badp Sep 22 '11 at 19:44
4  
8  
Think like this: the directory entry contains file names, so "reading" a directory is listing the files, "using" the directory is accessing the files. –  tylerl Sep 23 '11 at 9:12

3 Answers 3

up vote 134 down vote accepted

When applying permissions to directories on Linux, the permission bits have different meanings than on regular files.

  • The write bit allows the affected user to create, rename, or delete files within the directory, and modify the directory's attributes
  • The read bit allows the affected user to list the files within the directory
  • The execute bit allows the affected user to enter the directory, and access files and directories inside
  • The sticky bit states that files and directories within that directory may only be deleted or renamed by their owner (or root)
share|improve this answer
7  
Great answer, but I think the last sentence is misleading. None of these permissions can be overridden per-file actually. Here “access” is a bit ambiguous: +x on the directory grants access to files inodes through this specific directory (nothing less, nothing more, well… maybe chdir needs +x too). To read or write the contents of one file, the user also needs +r/+w on this file, but those are distinct permissions (they do not override anything). –  Stéphane Gimenez Sep 22 '11 at 13:06
1  
The immutable flag is filesystem specific and it won't precisely override those permissions, that's why I think the last sentence is misleading :-) –  Stéphane Gimenez Sep 22 '11 at 13:18
    
I think it might be useful to mention ACL in this and other answers, cause their application for some directories can be misleading if one will consider only information provided by Chris Down –  user907860 Dec 29 '14 at 12:30
1  
Seems that this answer doesn't mention the combined effect of write bit and execute bit, as Baldrick's answer mentions below? i.e. if you only have write permission but not execution permission, then it's quite useless. –  Xiang Ji Feb 16 at 8:55

First, think: What is a directory? It's just a list of items (files and other directories) that live within. So: directory = list of names.

Read bit = If set, you can read this list. So, for example, if you have a directory named poems:

  • You can ls poems and you'll get a list of items living within (-l won't reveal any details!).
  • You can use command-line completion i.e. touch poems/so <TAB> poems/somefile.
  • You cannot make poems your working directory (i.e. cd into it).

Write bit = If set, you can modify this list i.e. you can {add,rename,delete} names on it. But! You can actually do it only if the execute bit is set too.

Execute bit = Make this directory your working directory i.e. cd into it. You need this permission if you want to:

  • access (read, write, execute) items living within.
  • modify the list itself i.e. add, rename, delete names on it (of course the write bit must be set on the directory).

Interesting case 1: If you have write + execute permissions on a directory, you can {delete,rename} items living within even if you don't have write perimission on those items. (use sticky bit to prevent this)

Interesting case 2: If you have execute (but not write) permission on a directory AND you have write permission on a file living within, you cannot delete the file (because it involves removing it from the list). However, you can erase its contents e.g. if it's a text file you can use vi to open it and delete everything. The file will still be there, but it will be empty.

Summary:

Read bit = You can read the names on the list.
Write bit = You can {add,rename,delete} names on the list IF the execute bit is set too.
Execute bit = You can make this directory your working directory.

PS: The article mentioned by KAK is a good read.

share|improve this answer
7  
Thinking about directory as a list makes things more clear and logical. –  Trismegistos Jan 9 '14 at 8:51
1  
+1 for the file listing image. Love it! –  Alexandre Bourlier Aug 15 '14 at 19:33
4  
Great answer, but too focused on the term "working directory". I need the x bit for any access to this file: for cat a/b/c/d, I need the x bit on all a, b and c, even if I don't use them as cwd. –  glglgl Nov 3 '14 at 9:24
    
This is where I found out you can't write unless it's executable too! Case 2 is also interesting, great answer! –  Mirko Nov 30 '14 at 1:56
    
Another note is that even if you have x permission on the directory, if you don't have x permission on the file within, you can't really "execute" the file. You can only cat it for example, but you can't run the file itself. –  Xiang Ji Feb 16 at 9:19

Here is a good article on this.

Summary:

A directory with its x bit set allows the user to cd (change directory) into this directory, and access the files in it.

Details:

  • Read (r)

    The ability to read the names of files stored in this directory.

  • Write (w)

    The ability to rename files in the directory, create new files, or delete existing files, if you also have Execute permissions. If you don't have execute perms, then write perms are meaningless.

  • Execute (x)

    The ability to cd into this directory, and access the files in this directory.

Here are a few examples that should make it easier to understand:

# "Full Access".  Reegen can list, create, delete, rename, delete,
# and stat any files in dir.
# Access to file contents is subject to the permissions
# of the file itself.
# New files can be created, any file can be deleted, regardless of
# file permissions.
drwx------  1 reegen    reegen          4096 Jan 01 2003  dir

# Reegen can do everything in the "Full Access" list except create,
# delete, or rename files in this directory.
dr-x------  1 reegen    reegen          4096 Jan 01 2003  dir

# Reegen can do everything in the "Full Access" list except list the
# filenames in this directory.  If she suspects there is a file
# named "program" she can list it, but cannot do an 'ls'
# of the directory itself.  She can access any file (file
# permissions permitting) if she knows its name.  She can
# create new files, or rename/delete existing ones.
d-wx------  1 reegen    reegen          4096 Jan 01 2003  dir

# Reegen cannot create or delete any files in this directory.
# She can access any file (permissions permitting) if she
# knows its name already.
d--x------  1 reegen    reegen          4096 Jan 01 2003  dir

There is even more information in the Hacking Linux Exposed article.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.