Linux Permission Model and rwx Bits

1. Permission checks connect a process to an object

Linux evaluates access in context. A process has an effective user ID, an effective group ID, and supplementary groups. A filesystem object has an owner ID, a group ID, and mode bits. The requested operation—reading a file, creating an entry, traversing a directory, or executing a program—determines which permission is required.

flowchart TD
  P["Process credentials
effective UID and groups"] --> C{"Which class matches?"}
  O["Object owner, group,
and mode bits"] --> C
  C -->|UID equals owner| U["Use owner bits"]
  C -->|A group matches| G["Use group bits"]
  C -->|No identity match| R["Use other bits"]
  U --> Q{"Requested operation allowed?"}
  G --> Q
  R --> Q
  Q -->|yes| A["Access continues"]
  Q -->|no| D["EACCES / permission denied"]

The classes are alternatives, not additive fallbacks. If the process matches the file owner, Linux evaluates the owner bits; it does not then borrow a more permissive group or other bit. ACLs can extend this model and are covered in Lesson 5.

# Inspect the shell's identity and group set.
id
id -u
id -g
id -nG

# Inspect the current shell process and its effective credentials.
ps -o pid,ppid,euser,egroup,groups,comm -p "$$"

2. Read the mode string from left to right

A long listing such as -rwxr-x--- begins with a type indicator and then three permission triplets: owner, group, and other. The same mode can be written numerically. In each triplet, read contributes 4, write contributes 2, and execute contributes 1:

\[m = 4r + 2w + x, \qquad r,w,x \in \{0,1\}\]

lab="$HOME/devops-academy/linux/chapter06/lesson01"
mkdir -p -- "$lab"
printf '#!/usr/bin/env bash
printf "permission lab\n"
' > "$lab/check.sh"
printf 'configuration=true
' > "$lab/app.conf"

ls -ld -- "$lab" "$lab/check.sh" "$lab/app.conf"
stat -c 'mode=%A octal=%a owner=%U group=%G name=%n' --   "$lab" "$lab/check.sh" "$lab/app.conf"

The execute bit does not guarantee that a file is a valid program. The file must also have a recognized executable format, such as an ELF binary or a script with a valid shebang.

3. Directory bits govern names, traversal, and entries

Directory permissions have different operational meanings because a directory maps names to inode references.

# Display every pathname component and its mode.
namei -l -- "$HOME/devops-academy/linux/chapter06/lesson01/app.conf"

# Compare metadata for a file and its containing directory.
stat -c '%A %a %U:%G %n' --   "$HOME/devops-academy/linux/chapter06/lesson01"   "$HOME/devops-academy/linux/chapter06/lesson01/app.conf"

4. Every parent directory participates

A readable file can still be inaccessible when one parent directory lacks execute permission for the relevant identity class. This is why checking only the final object often produces the wrong diagnosis. Start with the process identity, then inspect every component from the filesystem root to the target.

5. Hands-on lab: build a permission evidence report

This lab creates a controlled tree, records modes and identity, and verifies read, execute, and directory-entry behavior without elevated privileges.

set -eu
lab="$HOME/devops-academy/linux/chapter06/lesson01"
rm -rf -- "$lab"
mkdir -p -- "$lab/bin" "$lab/config" "$lab/output"

printf '#!/usr/bin/env bash
printf "health=ok\n"
' > "$lab/bin/health-check"
printf 'port=8080
' > "$lab/config/app.conf"
chmod 750 -- "$lab/bin"
chmod 640 -- "$lab/config/app.conf"
chmod 755 -- "$lab/bin/health-check"
chmod 700 -- "$lab/output"

{
  printf '=== identity ===
'
  id
  printf '
=== objects ===
'
  find "$lab" -maxdepth 2 -printf '%M %m %u:%g %p
' | LC_ALL=C sort
  printf '
=== path walk ===
'
  namei -l -- "$lab/config/app.conf"
  printf '
=== operation tests ===
'
  test -r "$lab/config/app.conf" && printf 'config readable=yes
'
  test -x "$lab/bin/health-check" && printf 'health executable=yes
'
  test -w "$lab/output" && printf 'output directory writable=yes
'
} > "$lab/permission-report.txt"

cat -- "$lab/permission-report.txt"
"$lab/bin/health-check"

6. Common permission-model mistakes

8. Knowledge check

9. Summary

Linux discretionary permissions connect process credentials to object ownership and mode bits. The owner, group, or other class is selected for a specific operation; directory bits govern listing, entry changes, and traversal; and every parent directory participates in pathname access. Reliable diagnosis begins with identity and path evidence, not permission guessing.

10. Further reading

• Linux man-pages: credentials(7), inode(7), path_resolution(7), and access(2).
• GNU Coreutils manuals for ls, stat, and mode representation.
• The namei(1) manual for pathname-component inspection.
• Filesystem Hierarchy Standard for conventional directory responsibilities.