CYBER LIBRARY
Explore the bootcamp
Security essentialsBeginner

Linux file permissions

Read, write, and execute rights apply differently to files and directories.

3 min readUpdated 12 Oct 20267 connections
Markdown

The idea

Traditional Linux permissions specify rights for the owner, group, and others. On a file, read allows reading content, write allows modifying it, and execute allows execution when appropriate. On a directory, read lists names, execute permits traversal, and write generally permits modifying directory entries. Ownership, access-control lists, special bits, and filesystem state can also affect access. Inspect the context before applying a recursive permission change.

In practice

A private configuration file might use owner-only read and write permissions. A directory needs traversal rights for someone to access files inside it, even if those files are readable.

A common misunderstanding

Making everything world-writable is not a troubleshooting solution. It introduces access risks and hides the original issue.

Check your understanding

Why might a readable file still be inaccessible?

Think it through: A parent directory may lack the required traversal permission, or another control may restrict access.

Evaluate the operation, not just the file's label

A fictional web service needs to read a configuration file but must not modify it. The service account's access depends on the file, its ownership, and the directories leading to it. A readable file inside a directory the account cannot traverse may remain inaccessible. Diagnose the complete path rather than making the file world-readable in frustration.

Directory permissions have different effects from ordinary file permissions. Listing names, traversing a directory, and changing directory entries are distinct operations. Deleting a file generally involves authority over its containing directory, with additional rules such as the sticky bit potentially affecting the result. Reading the file's own write bit alone does not answer every question.

Traditional mode bits are not the entire access model. ACLs, capabilities, mount options, and mandatory access controls may also matter in a particular environment. Record the account and operation being tested so the conclusion remains specific.

Build a small access table

Using a local training directory, define an owner, a group member, and an unrelated test identity conceptually. State who should read a dummy document, modify it, list its directory, and create another file there. Compare those intended outcomes with the configured permissions through approved test accounts.

Avoid recursive permission changes on system or shared directories as a learning shortcut. Such changes can expose secrets or break service assumptions far beyond the original problem. A useful repair grants only the required operation to the intended identity and verifies both legitimate access and expected denial. Understanding permissions is about explaining effective authority, not merely converting between symbolic letters and octal numbers.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

GNU Coreutils manualLinux man-pages: Inodes and file metadata
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

7 notes · 10 connections
100%
Linux file permissions · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (7)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.