Unix Foundations: File Permissions, Ownership, and Descriptors
Understand users, groups, permission bits, file descriptors, and redirection so shell and service behavior is easier to debug.
On this page
Key takeaways
- A process accesses files using its credentials and an open file descriptor, not just a pathname.
- Read, write, and execute mean different things for files and directories.
- Changing a pathname's permissions does not revoke access through an already-open descriptor.
- Standard input, output, and error are descriptors that shells can redirect or connect through pipes.
Identity controls access
Processes run with user and group credentials. Files and directories have an owner, a group, and permission bits for owner, group, and other users. Access-control lists and mandatory access-control systems can add further rules, but the basic mode bits remain a common first diagnostic.
For a regular file, read permits reading contents, write permits modifying contents, and execute permits running the file as a program. For a directory, read permits listing names, write permits adding or removing entries when combined with search permission, and execute permits looking up entries by name. A user may know a file exists yet be unable to traverse one parent directory.
Pathnames and open descriptors are different
A pathname is resolved through directories to an object. When a process opens a file, the kernel returns a file descriptor: a small process-local integer referring to an open file description. The descriptor carries access mode and file offset state. Changing permissions on the path does not necessarily invalidate a descriptor that was already opened.
This explains why changing permissions may not stop a running process from writing to an already-open log file, and why deleting a log pathname does not immediately free disk space if a process still holds the unlinked file open. Tools such as lsof can help find open descriptors; process restart or explicit close is needed to release them.
Standard streams and redirection
By convention, descriptor 0 is standard input, 1 is standard output, and 2 is standard error. A shell can redirect these streams before starting a command. 2>&1 duplicates the current standard output destination onto standard error; order matters because redirections are applied in sequence.
command >run.log 2>&1
This sends both output streams to the same file. In contrast, command 2>&1 >run.log first points standard error at the original standard output, then redirects only standard output, so errors can remain on the terminal.
Diagnose permission failures systematically
Inspect the identity with id, each path component with namei -l where available, and the target mode with stat or ls -l. Check ownership, parent-directory search permission, mount options, and service-level sandboxing. Avoid solving every access issue with world-writable permissions; grant the narrowest user or group access that matches the process's responsibility.
Understanding credentials and descriptors explains many operational surprises in containers, shell pipelines, log rotation, and service startup. It also gives a safer basis for changing permissions than simply retrying a command as root.