Running `ls` with `--color=auto|always` needs execute permissions

Question

I've been thoroughly confused for quite some time with ls just plain refusing to work in some places, even though I have read permissions. After messing around a bit, it turns out that ls works fine, as long as I run it with --color=never, but as soon as I use auto or always, I get the familiar Permission denied error on everything where I lack execution permissions.

What causes this and how can I stop it while keeping my ls output in color?

Update: Okay, finally figured it out (as usual, directly after asking for help). You need execute permissions to enter directories, so cd and ls --color doesn't work on directories without it. I have no idea why I can still ls --color=never on directories without it though. Curious why that is?

Answer 1

To see the contents of a directory (the names of the entries) requires only read permission on the directory.

That means you can run /bin/ls and see all the names without a problem.

But to decide which color the names should be displayed with, ls uses other properties from the entries. It uses metadata from the file (permissions, size, filetype, etc.) This requires that it stat() the file, and that requires execute permission on the directory to succeed.

Just the names of the files in a directory: you only need read permission. For metadata about the files in a directory: you need read and execute permission

Answer 2

To just list the names of things in a directory, without caring about their types (etc.), just requires read permission on the directory.

In order to assign the color to the things inside a directory, ls needs to know stuff about them—type of entry (another directory, plain file, device, symlink, etc.), size, symlink target; it finds those by various syscalls on the entry. That requires the +x permission bit on the directory containing those items. (Actually, depending on the kernel version, you can still get some color—getdents can give both the name and type).

My version of ls, by the way, still lists the directory after spitting out the permission denied errors (though all of the colors). And if you want to see something else weird, try -l:

$ ls -l test 2>/dev/null 
total 0
l????????? ? ? ? ?            ? badsymlink
-????????? ? ? ? ?            ? empty
p????????? ? ? ? ?            ? fifo
l????????? ? ? ? ?            ? goodsymlink
-????????? ? ? ? ?            ? notempty