File Permissions Explained (rwx)

Linux is a multi-user operating system at its core, and its permission model is what makes it safe for many users (and processes) to share one filesystem. Every file and directory has an owner (a user), a group, and a set of permission bits controlling three kinds of access — read (r), write (w), and execute (x) — for three categories of accessor: the owning user, the owning group, and everyone else ('other'). This nine-bit rwx model, inherited from early Unix, is deceptively simple but underpins nearly all access control on a standard Linux system, from protecting your SSH private key to preventing an unprivileged web server process from overwriting system files.

Running ls -l shows a ten-character string like -rwxr-xr-- at the start of each line. The first character indicates the file type (- for regular file, d for directory, l for symbolic link, among others). The remaining nine characters are three rwx triplets in order: owner, group, other. Each triplet position is either the letter (r, w, or x) if that permission is granted, or a dash (-) if it is not. So -rwxr-xr-- means: it's a regular file; the owner can read, write, and execute; the group can read and execute but not write; and everyone else can only read.

The three permission bits mean subtly different things depending on whether they apply to a regular file or a directory. On a file: r lets you read its contents (e.g. with cat), w lets you modify or truncate it, and x lets you execute it as a program or script. On a directory, though: r lets you list the names of entries inside it (ls), w lets you create, rename, or delete entries inside it (which is why deleting a file actually depends on the containing directory's permissions, not the file's own), and x (often called the 'search' or 'traverse' bit) lets you cd into it or access files inside it by path at all — without x on a directory, even knowing a file's exact full path won't let you open it.

Permissions are frequently expressed as a 3-digit octal number instead of the rwx letters, because each rwx triplet maps directly onto 3 bits: r=4, w=2, x=1, and you sum the values you want. A single digit therefore ranges from 0 (---, no access) to 7 (rwx, full access). The permission -rwxr-xr-- becomes 754 (owner: 4+2+1=7, group: 4+0+1=5, other: 4+0+0=4). This compact octal form is what chmod most commonly takes as an argument, e.g. chmod 644 file.txt.