Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I have a directory with no access for anyone except for root. Am I guaranteed that everything in the directory is inaccessible to everyone but root? In other words, are file permissions hierarchical, so that if a user can't access a directory, they can't access anything in it, even if they have permissions to something in the directory?

share|improve this question

migrated from Jun 27 '11 at 16:02

This question came from our site for professional and enthusiast programmers.

Wiile the answer is mostly "yes", there are special cases in which is can be "no".

Because unix files are not guaranteed to have a unique path. So if you have

$ ls -l
drwx------- 1 root  root [...] root_only


$ ls -l root_only
-rw-rw-rw-- 2 root  root [...] hopefully_private_file

and hopefully_private_file is hardlinked from elsewhere it may be universally readable.

How do you know? Look again at that ls -l:

$ ls -l root_only
-rw-rw-rw-- 2 root  root [...] hopefully_private_file

The number over the arrow is the link count (for files, it has a different meaning for directories). If the link count is 1 you are safe; if it is something else there may be a problem.

share|improve this answer
That's not really fair. Even if the file is hardlinked (and therefore accessible) from somewhere else, you still can't access it from the disallowed path. If the owner of the file hardlinked it from an accessible path, that implies that they understand that now there are two ways of accessing that file. – Adam Batkin Jun 27 '11 at 17:26
@Adam, that really depends on what Echostar is trying to achieve here. But people need to be aware of this if they are to understand what the can can can not assume about file accessibility on unix systems. Of course, chmod 600 hopefully_private_file solves the problem. – dmckee Jun 27 '11 at 17:29

To display something in the directory dir/ you need +x permission to be able to locate the inode of the file. So if you don't have +x, you can't read a file even if it is 777.

share|improve this answer
Hardlinks to the files can break this guarantee. See my answer. – dmckee Jun 27 '11 at 17:11

That is correct, removing permissions on a parent directory affects the ability to work with anything within that directory.

If a user does not have execute permission on a directory, they will not be able to see access any files in a directory.

You probably also want to remove the read permission on the directory, so that they won't be able to even see the contents (filenames) of the directory.

share|improve this answer
Unless some of the files are hardlinked from a path the user can read. See my answer. – dmckee Jun 27 '11 at 17:11

You must log in to answer this question.