The permissions of a directory

Let us put it beside the file version.

Thinking of a box as a ledger of names makes it easier.

• r — turn the pages and read the names (you can ls)
• w — add and cross out lines in the ledger (make and remove files)
• x — go on through (cd into it, reach the things inside)

x matters most. Without x, whatever is inside is out of reach. Even knowing the name, you cannot open it.

Let us take the x off.

~ $ chmod 600 docs~ $ cd docs-sh: cd: can not cd to docs: Permission denied

600 is rw-, so there is no x, and you cannot get in.

Without x a directory becomes a dead end.

• you cannot cd in
• you cannot cat the files inside (even knowing the names)
• you cannot go on to the directories beyond it

Thinking of it as the permission for a path makes it sit right. To open /home/learner/docs/inside.txt you need x on all of /, home, learner and docs. Miss one and you stop there.

Which is why directories had x on them from the start. Without it they are useless.

The interesting part is that you can take r and x off separately.

With only x (-wx = 300)

~ $ chmod 300 docs~ $ ls docsls: can not open docs: Permission denied~ $ cat docs/inside.txtthe contents are here

You cannot read the list, but if you know the name you can open it. No permission to turn the pages of the ledger, but permission to pass through.

With only r (r-- = 400)

~ $ chmod 400 docs~ $ ls docsls: docs/inside.txt: Permission denied

The other way round. You could read the name, but you cannot go on. So it cannot find out the size or the date, and out comes an error.

These two get used as ways of hiding. Set 300 and you have a box only people who know what is inside can use.

This is the most surprising thing today.

~ $ chmod 444 docs/inside.txt   # a file nobody can write~ $ rm docs/inside.txt~ $ ls docs(nothing)

Gone. A file nobody was supposed to be able to write.

Here is why. Removing a file is not an operation on that file; it is crossing one line out of the box's ledger.

So what is needed is the box's w, and the file's own w has nothing to do with it.

It goes the other way too.

~ $ chmod 500 docs      # the box has no w~ $ rm docs/inside.txtrm: can not remove docs/inside.txt: Permission denied

Without w on the box, you cannot remove the file inside even at 777.

"To protect something, harden the box rather than the file" — that is the right way to protect things in Linux.

There are only two shapes you use much on a box.

Read 755. The others get r-x, meaning "can read the names and pass through, but cannot add or remove". They may visit but not leave anything.

700 is the same shape as the /root you saw earlier. Remember the administrator's room being drwx------. Others get ---, so they cannot even tell what is inside.

Remember it as boxes are 755 or 700, files are 644 or 600. Those four cover nearly every day.

Just as with files, the last two digits decide whether others get to see.

To change a directory and everything in it, add -R.

chmod -R 700 docs

-R is the first letter of recursive, meaning "everything inside as well". The same idea you saw with the find of chapter 3 and the tools of chapter 5.

But take care over one thing. It gives files and boxes the same number.

chmod -R 755 docs

That puts the text files inside on 755 too, setting the execute mark on them. Data does not need x.

To do it properly, combine it with find and split by kind.

find docs -type d -exec chmod 755 {} +find docs -type f -exec chmod 644 {} +

The -type d and -type f of chapter 3 pay off here, letting you give 755 to boxes and 644 to files separately.

Your home holds a box called docs/ with inside.txt in it (which says the contents are here), plus memo.txt.

Today's questions mostly go break it on purpose, check, then mend it. Box permissions are easy to shoot yourself in the foot with, so experience it safely here.

One thing to help. If you get stuck unable to cd, you are the owner, so you can open it again with chmod. As you saw last lesson, the standing of being the owner survives even with no permissions.

And the Linux is rebuilt for each question, so you can move on even leaving it broken. Break things without worry.