0

My question deals with the relationship between the read and execute bits on a directory. I'm going to give my assumptions, first, all according to my current knowledge, then ask my question in bold in the context of those assumptions. Please feel free to correct any incorrect assumptions:

  1. Files and directories both are stored using inodes.
  2. Files and directories both have permissions (let's just focus on the rwx bits, forgetting the sticky, setuid, setguid (unless they're relevant)).
  3. The contents of a directory's inode's data blocks store a mapping of file names to inode numbers.
  4. Read permission on a directory allows a user to obtain a list of the names of all files in that directory.
  5. The user must know a file's inode number in order to access its contents. UPDATE: The meaning of the original statement here doesn't reflect what I meant to express. What I meant is more along the lines of: The user doesn't need to know a file's inode number, but the user must have permission to get an inode for a given filename in order to get the contents of the file.
  6. Execute permission on a directory allows a user to "use" that directory, and I understand that specifically to mean obtaining the directory's inode number (I would like confirmation of my understanding of this). This will allow the user to do things like cd into that directory, which is the prototypical example given of what a user needs the execute permission for.

Given that a user must be able to obtain the "contents" of a directory (really the contents of the directory's inode's data blocks) in order to gain access to the directory listing, and that the user must know the directory's inode number to gain access to its contents, why is it that a user can still obtain a directory listing while not having execute permission on the directory? It seems that obtaining a listing of the contents of a directory D requires temporarily looking up its inode number in order to read the contents of the inode's data blocks. Furthermore, it would seem necessary that read permission would imply execute permission on a directory.

|improve this question
  • 2
    Answering the bolded question, that's not what execute permission is. Execute on a directory controls wether or not you can set the current working directory to that directory. You don't need to cd to a directory to read the file list. If you have r-- on a directory you can read the file list but not cd to it. – bahamat Jan 17 '13 at 7:41
  • jordanm, thank you for your reply. System calls may take path names, but whether or not the call is permitted depends on the permissions of the inodes. Regarding your example, can you be more specific? Are you talking about hard links, symlinks, or something else? Also, it seems that what you claim means this (read.cs.ucla.edu/111/_media/notes/inode.jpg) is wrong, correct? – BlueBomber Jan 17 '13 at 15:13
  • bahamat, thank you for your reply. I know that execute on a directory allows you to set the current working directory there (I acknowledged that in my question), but I'm talking about the underlying data structures. Essentially, I'm asking, why can you obtain a listing without the ability to look up the directory's inode number? – BlueBomber Jan 17 '13 at 15:18
  • Oh, boy. Yes, (5) is wrong (as a user, you get at a file by a path). But @jordanm is dead wrong: An inode is the file, a file can appear under different names in the filessytem, and all such links point at the same inode. Permissions and owner/group are stored in the inode. (6) is partly right, in order to use a directory to get at a file through it you need x permission on the directory (note that you don't need r for this). – vonbrand Jan 21 '13 at 5:17
  • @vonbrand You are right, my statement was incorrect and has been removed to avoid confusing anyone. – jordanm Jan 21 '13 at 6:31
2

I had a slight misunderstanding, which invalidates my point 6 above. The execute (aka "search") bit on a directory is required in order to obtain the inode numbers of the files it contains, but not its own inode number.

Quote:

You can think of read and execute on directories this way: directories are data files that hold two pieces of information for each file within, the file's name and it's inode number. Read permission is needed to access the names of files in a directory. Execute (a.k.a. search) permission is needed to access the inodes of files in a directory, if you already know the file's name.

References:

  1. https://askubuntu.com/questions/83788/accessing-files-in-a-directory-without-x-permission
  2. http://content.hccfl.edu/pollock/aunix1/filepermissions.htm
  3. https://superuser.com/questions/442581/why-do-you-need-execute-permission-on-the-parent-directory-to-rename-a-file
|improve this answer
  • Your second reference is a great explanation! – dash17291 Apr 22 '13 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.