2

The other day I was doing some clean up and decided to delete a log file that I had stuck in my development environment, and when I did, I started to think the permissions should not have let me, I shouldn't have had permission. I don't need the file, but why did it let me? Here's the before and after:

jim@jim-pop-os:~/development/apps/apoxeia/log$ ls -altr
total 441800  
-rwxr-xr-x  1 jim  jim          0 Jan 25  2020 .gitkeep  
-rw-r--r--  1 jim  jim          0 Jan 25  2020 bullet.log  
drwxr-xr-x  2 jim  jim       4096 Apr  9 22:13 .  
-rw-r--r--  1 root root    759153 Apr 20 08:31 production.log  
-rw-r--r--  1 jim  jim    1208297 May  3 18:03 development.log  
-rw-rw-r--  1 jim  jim  449190680 May  6 08:07 test.log  
drwxr-xr-x 25 jim  jim       4096 May  6 08:14 ..  
-rw-rw-r--  1 jim  jim    1214644 May  6 08:41 capistrano.log  
jim@jim-pop-os:~/development/apps/apoxeia/log$ rm production.log   
rm: remove write-protected regular file 'production.log'? y  
jim@jim-pop-os:~/development/apps/apoxeia/log$ ls -altr  
total 441052  
-rwxr-xr-x  1 jim jim         0 Jan 25  2020 .gitkeep  
-rw-r--r--  1 jim jim         0 Jan 25  2020 bullet.log  
-rw-r--r--  1 jim jim   1208297 May  3 18:03 development.log  
-rw-rw-r--  1 jim jim 449190680 May  6 08:07 test.log  
drwxr-xr-x 25 jim jim      4096 May  6 08:14 ..  
-rw-rw-r--  1 jim jim   1214644 May  6 08:41 capistrano.log  
drwxr-xr-x  2 jim jim      4096 May  6 21:14 .  
jim@jim-pop-os:~/development/apps/apoxeia/log$   

Note that the file production.log had write permissions only for root, but I deleted it, WITHOUT root permissions.

How did that happen? [Sorry about the formatting. Looked at the tips, but still didn't see a better option.]

5

Deleting a file doesn't write to it – it only writes to the parent directory, where you already have the w and x permissions.

(Linux doesn't really have a "delete a file" system call – it only has an unlink call which works by removing a directory entry that points to the file... and if that was the last pointer, then the actual file gets garbage-collected. It's the opposite of link which creates hardlinks by adding directory entries.)

6
  • Wow! In 21 years of using Linux, I never knew this! So anyone who has write access to the parent directory can delete a file, regardless of the permission on the file itself?! Glad I learned this. Mostly I use Linux on single user systems. – codenoob May 8 at 16:51
  • Yes, unless the directory has the "sticky" (+t) permission bit, like /tmp, in which case only the file's owner (or the directory's owner) is allowed to delete it regardless of permissions. – user1686 May 8 at 16:53
  • Thanks. I wonder if I knew this at some point and just forgot. – codenoob May 8 at 19:30
  • Thanks. Also, thanks for reformatting the 'ls' output. At the risk of continuing to demonstrate the depth of my ignorance, how did you do that? – codenoob May 8 at 19:37
  • I clicked the "Code sample" button. StackOverflow uses Markdown similar to that of GitHub; you can use either 4-space indents, or three backticks ```, or in some cases <pre>. – user1686 May 8 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.