2

I'm just looking at the permissions on some of my folders through the terminal, and I don't quite know what they mean.

iMac:~ me$ ls -alt
total 40
drwx------   4 me  staff   136 10 Oct 06:17 .Trash
drwx------+  4 me  staff   136 10 Oct 06:16 Desktop
drwxr-xr-x   6 me  staff   204 10 Oct 06:16 .bash_sessions
-rw-r--r--@  1 me  staff  8196  8 Oct 22:37 .DS_Store
drwx------+  9 me  staff   306  8 Oct 22:37 Downloads
drwx------@ 12 me  staff   408  8 Oct 20:50 Google Drive
drwx------@ 13 me  staff   442  8 Oct 20:49 Dropbox
drwx------   9 me  staff   306  8 Oct 20:49 .dropbox
drwxr-xr-x+ 19 me  staff   646  8 Oct 20:48 .
-rw-r--r--   1 me  staff   100  4 Oct 12:03 .bash_history
drwx------@ 49 me  staff  1666  4 Oct 10:17 Library
drwx------   4 me  staff   136  4 Oct 09:52 Applications
-r--------   1 me  staff     7  4 Oct 09:45 .CFUserTextEncoding
drwx------+  3 me  staff   102  4 Oct 09:42 Documents
drwx------+  3 me  staff   102  4 Oct 09:42 Movies
drwx------+  3 me  staff   102  4 Oct 09:42 Music
drwx------+  3 me  staff   102  4 Oct 09:42 Pictures
drwxr-xr-x+  5 me  staff   170  4 Oct 09:42 Public
drwxr-xr-x   7 root             admin   238  4 Oct 09:42 ..

What is the difference between "drwxr-xr-x+" found in "." and "drwx------@" found in "Google Drive"?

1 Answer 1

7

Unix permissions are actually a lot less confusing than you'd first think, & once you stop trying to read the whole line as one thing & instead think of it in groups, always in the pattern 1 3 3 3 it becomes easier to grasp.
In fact, Mac & some other unix derivatives use a 1 3 3 3 1 structure - more about that at the end of this post.

This explanation is as simple as it can be, whilst including all the relevant concepts...

Extracted from https://www.cs.swarthmore.edu/help/chmod.html

unix file permissions

File permissions allow you to grant or deny access to your files and directories. There are three types of permissions:

  • r = read
  • w = write
  • x = execute

These permissions mean different things for files and directories.

For files:

  • read - you can open and read the file, you can also copy it.
  • write - you can modify the file
  • execute - you can execute (run) the file if it is executable (like a program or a command)

For directories:

  • read - you can ls the directory and see the contents.
  • write - you can make and remove files in that directory.
  • execute - you can cd into that directory.

Use the ls -l command to see the file permissions for your files and directories. Here's an example:

$ ls -l
total 188
drwx------  jk users  4096 2008-10-24 11:30 cs21/
drwx------  jk users  4096 2007-10-01 12:24 mail/
drwxr-xr-x  jk users  4096 2008-06-05 10:33 public/
-rw-------  jk users 83623 2008-09-10 08:29 turing.pdf
-rw-r--r--  jk users  9134 2008-01-24 16:26 unix-by-example

The first column above is the file permissions (drwx------ or -rw-r--r--), the second is the owner of the files and directories (jk), and the third column is the group (users).

For the file permissions, the first letter is either a "d" or a "-", meaning it's a directory or a file. The next three characters (e.g., rwx) are the permissions for the owner of the file. Then comes the group permissions (e.g., everyone in the users group), and finally permissions for everyone else. Here are some examples:

* drwx------ : directory only accessible by owner
* drwxr-xr-x : directory anyone can access
* -rwxr-xr-x : file anyone can read and execute
* -rw-r----- : file only people in the group can read

To see what groups you are in, run the groups command.

changing permissions on a file/directory

Use the chmod (CHange MODe) to change the file permissions. The chmod command can use numbers:

  • 4 - read
  • 2 - write
  • 1 - execute

The reason these aren’t 1,2,3 is because they need to add up to a unique number depending on what combination of them you use.

So, to give read and write permission:

read + write = 4 + 2 = 6

or execute and read permission:

execute + read = 1 + 4 = 5

Or just execute permission:

execute = 1

Or all permissions:

read + write + execute = 4 + 2 + 1 = 7

The chmod command takes three numbers for three permissions:

owner, group, all users (in that order)

The basic chmod command goes:

$ chmod ### directory/filename

So, if you wanted to give read access to all (-rw-r--r--):

$ chmod 644 filename

To make a file readable, writable, and executable by only you:

$ chmod 700 filename

To make a file readable and executable by you and your group, but only readable by everyone else:

$ chmod 554 filename

chmod can also use letters: u for user (owner), g for group, o for other, and a for all (u, g, and o). So you could do chmod g+r file to add read access for the group. For more information about chmod, see the man page (man chmod).

A note about that final character

On Mac OS X (and some other Unix derivatives), there's an additional character after the final set of permissions. It's usually a space, but may be a + or an @

A + indicates the file or directory has additional security information, such as an ACL.
An @ indicates the file or directory has extended attributes.

You can see see a file or directory's ACL by including the -e option when doing an ls (with the -l option), and extended attributes by including -@ (also with -l).
A discussion of ACLs and extended attributes is well beyond this answer, but more information about extended attributes can be found here and ACLs here (and of course Google will turn up more information than you want to know about them.)

6
  • This is a good overview of Unix permissions, but the question is from Mac OS X, so it's only a subset of Mac OS X permissions. For example, the group pattern on Mac OS X is 1 3 3 3 1, and there's that mysterious + and @ at the end that you didn't mention at all.
    – blm
    Oct 10, 2015 at 17:07
  • I thought extended attributes & ACLs might be getting a bit heavy; too long & complex for a single QA scope. Feel free to edit in if you feel it necessary.
    – Tetsujin
    Oct 10, 2015 at 17:21
  • 1
    I agree a full discussion would be too much, but it's probably worth mentioning as someone coming from a non-Mac OS X Unix might wonder what they are. I'll add a bit to the end of your answer.
    – blm
    Oct 10, 2015 at 20:13
  • Ok, added the final paragraph.
    – blm
    Oct 10, 2015 at 20:31
  • I added that Mac has 1 3 3 3 1 too in the opening paragraph, so the ACL part at the end doesn't come as a total surprise, & gave that final paragraph a header to make it more noticeable.
    – Tetsujin
    Oct 11, 2015 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.