Unix Directory Hierarchy Permissions

Question

Suppose I have a directory with no access for anyone except for root. Am I guaranteed that everything in the directory is inaccessible to everyone but root? In other words, are file permissions hierarchical, so that if a user can't access a directory, they can't access anything in it, even if they have permissions to something in the directory?

Answer 1

That is correct, removing permissions on a parent directory affects the ability to work with anything within that directory.

If a user does not have execute permission on a directory, they will not be able to see access any files in a directory.

You probably also want to remove the read permission on the directory, so that they won't be able to even see the contents (filenames) of the directory.

Answer 2

Wiile the answer is mostly "yes", there are special cases in which is can be "no".

Because unix files are not guaranteed to have a unique path. So if you have

$ ls -l
drwx------- 1 root  root [...] root_only

and

$ ls -l root_only
-rw-rw-rw-- 2 root  root [...] hopefully_private_file

and hopefully_private_file is hardlinked from elsewhere it may be universally readable.

How do you know? Look again at that ls -l:

$ ls -l root_only
-rw-rw-rw-- 2 root  root [...] hopefully_private_file
            ^
            |

The number over the arrow is the link count (for files, it has a different meaning for directories). If the link count is 1 you are safe; if it is something else there may be a problem.

Answer 3

To display something in the directory dir/ you need +x permission to be able to locate the inode of the file. So if you don't have +x, you can't read a file even if it is 777.