The ls -al command shows the following output;

-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe

What are all the fields in the preceding display?

  • what does L means in these permisions.... lrwxrwxrwx – Lin-man Apr 7 '16 at 20:57
  • 1
    Please read the second answer. It is the file type flag; Regular file(-), Directory files(d), Block file(b), Character device file(c), Named pipe file or just a pipe file(p), Symbolic link file(l), Socket file(s). linuxnix.com/file-types-in-linux – Mr. White Apr 8 '16 at 6:33
up vote 171 down vote accepted

In the order of output;

-rwxrw-r--    1    root   root 2048    Jan 13 07:11 afile.exe
  • file permissions,
  • number of links,
  • owner name,
  • owner group,
  • file size,
  • time of last modification, and
  • file/directory name

File permissions is displayed as following;

  • first character is - or l or d, d indicates a directory, a line represents a file, l is a symlink (or soft link) - special type of file
  • three sets of characters, three times, indicating permissions for owner, group and other:
    • r = readable
    • w = writable
    • x = executable

In your example -rwxrw-r--, this means the line displayed is:

  • a regular file (displayed as -)
  • readable, writable and executable by owner (rwx)
  • readable, writable, but not executable by group (rw-)
  • readable but not writable or executable by other (r--)
  • 14
    There are more than 2 types of file. - is not for non-directories, it's for regular files, there's more than r, w and x permissions. On most systems, the first field is also used to indicate the presence of extra attributes like ACLs, security attributes or other extended attributes. Also note that for symlinks, the target of the symlink is also displayed in the output of ls -l. – Stéphane Chazelas Nov 29 '13 at 21:06
  • 11
    The first character can have different values (eg. b, D, and p`). There's a full explanation on Wikipedia. – ashes999 Oct 14 '14 at 13:53
  • 7
    The numbers of fields is poorly explained. For files it means number of hard links. For directory: number of directories inside directory + this directory itself + 1. – yanpas Mar 19 '16 at 19:20
  • 9
    What does number of links mean? Thanks. – tommy.carstensen Jan 6 '17 at 11:41
  • 2
    @tommy.carstensen see yanpas comment – akhan Apr 8 '17 at 5:57

The output of the "ls" command depends on the version of "ls", the options used, the platform used, etc. It appears from your example that you're using it from a typical un*x (such as Linux), and probably using a typical modern "ls" version. In which case:

-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe
?UUUGGGOOOS   00  UUUUUU GGGGGG ####    ^-- date stamp and file name are obvious ;-)
^ ^  ^  ^ ^    ^      ^      ^    ^
| |  |  | |    |      |      |    \--- File Size
| |  |  | |    |      |      \-------- Group Name (for example, Users, Administrators, etc)
| |  |  | |    |      \--------------- Owner Acct
| |  |  | |    \---------------------- Link count (what constitutes a "link" here varies)
| |  |  | \--------------------------- Alternative Access (blank means none defined, anything else varies)
| \--\--\----------------------------- Read, Write and Special access modes for [U]ser, [G]roup, and [O]thers (everyone else)
\------------------------------------- File type flag

I am not sure why your link count is so high for the example file you listed. Some platforms have an odd notion of what constitutes a "link". These usually include hard links and symbolic links, as well as directory entries (which is why directories often have high link counts – its parent has one link, the directory has a link to itself in the . entry, and each of its sub-directories has a link back via ..).

Some versions and/or command line flags will list the number of blocks used instead of the number of bytes; a filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as "1", meaning 1 block is used, from 1025 to 2048 as "2", using 2 blocks, and so on. But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.

The special/alternative access flag is usually a blank space, but on some platforms, it may be used to indicate there are special/alternative access modes (such as ACLs and security descriptors on WIN32, etc), and varies widely – consult your manual, man pages, info tool, or what-not.

The permissions (mode) flags (UUUGGGOOO) are three sets of three chars, where the first set is "User" (i.e., Owner), the second set is "Group" and the third set is "Others" (i.e., everyone else; anyone who is neither Owner nor Group). The three permissions flags in each set are typically r or - meaning the User/Group/Others can read the file (r) or not (-), followed by w or - indicating whether they can write to the file (you can have files which you can write to, but cannot read, as odd as that may sound!), and the third character is a 'catch-all' flag for other modes, typically something like x for execute (for directories, it means you can attempt to access the directory contents), or - for none. Sometimes you may encounter an s or S for setuid and/or setgid programs, or other less common characters; see your "ls" documentation for the mode characters it will show.

Finally, the very first character is the file type; typically one of: d for directory, l for a symbolic link (hard links show normally without a special character of their own), or - for a normal file. There are many other, but less commonly seen, file types for various filesystems. These first ten characters (file type and permissions) are discussed on Wikipedia. Again, your documentation will tell you exactly what kind of file types your command supports and displays.

BTW, if you cannot find a man/info page for "ls" itself ("man ls"/"info ls"), try looking in the "coreutils" package ("info coreutils"). Also note that among the more common platforms, Microsoft platforms tend not to translate very well to "ls" output, so you may see odd behavior, flags, or other unusual info in the output, depending on how your version of "ls" was compiled, what it was linked against, etc.

One more caveat: The file time stamp is usually the date/time the file was last modified, not the time the file was created. In fact, on a un*x-ish filesystem, there is no record of the file creation time; the ctime field does NOT mean "creation time" as it does on FAT/NTFS filesystems, but rather, it means the "inode [C]hange time" – the time the inode itself was last modified. The "mtime" (last [M]odified) and atime (last [A]ccesed/read) timestamps are the same on both systems – although the precision (FAT has a granularity of two seconds, for example) and time zone may vary.

  • 3
    Which system includes symbolic links in the link count? – celtschk Jul 6 '14 at 7:24
  • 1
    Sorry, I was not clear.. No system I know includes symbolic links in the link count.. I only meant in "what constitutes a 'link'". For example, in Windows', a "shell link" is considered a link, but most console commands will treat it as a normal file. This includes ls, which will not include it in the link count. To the best of my knowledge, unless the sources for 'ls' is otherwise modified, it only reports what the OS reports for the link count. – C. M. Jul 6 '14 at 14:30
  • 1
    Including sym-links and .lnk files would require a walk of the entire directory try. Just to list a file. It would be waaaaaaaaaaaaay slow. It only includes hard link. That is the number of directory entries that the file has. (it is used by the garbage collector. When the reference count gets to zero, then the file is deleted.) – ctrl-alt-delor Mar 5 at 9:26
  • 1
    Normally, my understanding of operating systems (OS) and file systems (FS) would agree, but I've seen some oddities from time to time with certain OS's and FS's. Although, it's not always part of the OS/FS; Sometimes, the oddities are the result of trying to port a tool from one OS to another, and then trying to adjust it for the new platform--the differences in the CTIME field between EXT and FAT/NTFS, for example--and how NTFS implements different kinds of "links" (shell links, reparse points, etc), making it difficult to give an exact and uniform definition. – C. M. Mar 14 at 23:18
  • Additional note: the file size for a directory is only the size of the metadata of the directory, not the total size of the files under the directory. – wisbucky May 22 at 21:18

On GNU systems, it is described in ls info page in a very detailed way. All you had to do to find it: just open man ls and find in the end link to the full documentation: info coreutils 'ls invocation'.

Here is quote from it:

`-l'
`--format=long'
`--format=verbose'
     In addition to the name of each file, print the file type, file
     mode bits, number of hard links, owner name, group name, size, and
     timestamp (*note Formatting file timestamps::), normally the
     modification time.  Print question marks for information that
     cannot be determined.

     Normally the size is printed as a byte count without punctuation,
     but this can be overridden (*note Block size::).  For example, `-h'
     prints an abbreviated, human-readable count, and
     `--block-size="'1"' prints a byte count with the thousands
     separator of the current locale.

     For each directory that is listed, preface the files with a line
     `total BLOCKS', where BLOCKS is the total disk allocation for all
     files in that directory.  The block size currently defaults to 1024
     bytes, but this can be overridden (*note Block size::).  The
     BLOCKS computed counts each hard link separately; this is arguably
     a deficiency.

     The file type is one of the following characters:

    `-'
          regular file

    `b'
          block special file

    `c'
          character special file

    `C'
          high performance ("contiguous data") file

    `d'
          directory

    `D'
          door (Solaris 2.5 and up)

    `l'
          symbolic link

    `M'
          off-line ("migrated") file (Cray DMF)

    `n'
          network special file (HP-UX)

    `p'
          FIFO (named pipe)

    `P'
          port (Solaris 10 and up)

    `s'
          socket

    `?'
          some other file type

     The file mode bits listed are similar to symbolic mode
     specifications (*note Symbolic Modes::).  But `ls' combines
     multiple bits into the third character of each set of permissions
     as follows:

    `s'
          If the set-user-ID or set-group-ID bit and the corresponding
          executable bit are both set.

    `S'
          If the set-user-ID or set-group-ID bit is set but the
          corresponding executable bit is not set.

    `t'
          If the restricted deletion flag or sticky bit, and the
          other-executable bit, are both set.  The restricted deletion
          flag is another name for the sticky bit.  *Note Mode
          Structure::.

    `T'
          If the restricted deletion flag or sticky bit is set but the
          other-executable bit is not set.

    `x'
          If the executable bit is set and none of the above apply.

    `-'
          Otherwise.

     Following the file mode bits is a single character that specifies
     whether an alternate access method such as an access control list
     applies to the file.  When the character following the file mode
     bits is a space, there is no alternate access method.  When it is
     a printing character, then there is such a method.

     GNU `ls' uses a `.' character to indicate a file with an SELinux
     security context, but no other alternate access method.

     A file with any other combination of alternate access methods is
     marked with a `+' character.
  • Thank you! I was unsure about the "character special file" meaning of the c in the first column when listing /dev/ – Bruno Bronosky Jun 29 at 19:42

The first column is the file mode, the next column is the numbers of link that the file has, the third and fourth are the name of the owner and the group which the file belongs to. Next column says the number of bytes of the file (some ls implementations have a -h option to see this information in a more user-friendly form). The last two columns indicate the timestamp and the name of the file. You'd read the man page for more info.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.