Sstrhsrtj

First, think: What is a directory? It's just a list of items (files and other directories) that live within. So: directory = list of names.

Read bit = If set, you can read this list. So, for example, if you have a directory named poems:

• You can ls poems and you'll get a list of items living within (-l won't reveal any details!).


• You can use command-line completion i.e. touch poems/so <TAB> poems/somefile.


• You cannot make poems your working directory (i.e. cd into it).

Write bit = If set, you can modify this list i.e. you can {add,rename,delete} names on it. But! You can actually do it only if the execute bit is set too.

Execute bit = Make this directory your working directory i.e. cd into it. You need this permission if you want to:

• access (read, write, execute) items living within.


• modify the list itself i.e. add, rename, delete names on it (of course the write bit must be set on the directory).

Interesting case 1: If you have write + execute permissions on a directory, you can {delete,rename} items living within even if you don't have write perimission on those items. (use sticky bit to prevent this)

Interesting case 2: If you have execute (but not write) permission on a directory AND you have write permission on a file living within, you cannot delete the file (because it involves removing it from the list). However, you can erase its contents e.g. if it's a text file you can use vi to open it and delete everything. The file will still be there, but it will be empty.

Summary:

Read bit = You can read the names on the list.
Write bit = You can {add,rename,delete} names on the list IF the execute bit is set too.
Execute bit = You can make this directory your working directory.

PS: The article mentioned by KAK is a good read.

Here is a good article on this.

Summary:

A directory with its x bit set allows the user to cd (change directory)
into this directory, and access the files in it.

Details:

• 
  

  Read (r)

  
  
  

  
  

  The ability to read the names of files stored in this directory.

  
  

  
  


• 
  

  Write (w)

  
  
  

  
  

  The ability to rename files in the directory, create new files, or delete existing files, if you also have Execute permissions. If you don't have execute perms, then write perms are meaningless.

  
  

  
  


• 
  

  Execute (x)

  
  
  

  
  

  The ability to cd into this directory, and access the files in this directory.

  
  

  
  

Here are a few examples that should make it easier to understand:

# "Full Access".  Reegen can list, create, delete, rename, delete,

# and stat any files in dir.

# Access to file contents is subject to the permissions

# of the file itself.

# New files can be created, any file can be deleted, regardless of

# file permissions.

drwx------  1 reegen    reegen          4096 Jan 01 2003  dir



# Reegen can do everything in the "Full Access" list except create,

# delete, or rename files in this directory.

dr-x------  1 reegen    reegen          4096 Jan 01 2003  dir



# Reegen can do everything in the "Full Access" list except list the

# filenames in this directory.  If she suspects there is a file

# named "program" she can list it, but cannot do an 'ls'

# of the directory itself.  She can access any file (file

# permissions permitting) if she knows its name.  She can

# create new files, or rename/delete existing ones.

d-wx------  1 reegen    reegen          4096 Jan 01 2003  dir



# Reegen cannot create or delete any files in this directory.

# She can access any file (permissions permitting) if she

# knows its name already.

d--x------  1 reegen    reegen          4096 Jan 01 2003  dir

There is even more information in the Hacking Linux Exposed article.

I have prepared this table with all the possible permissions and their practical effects.

(*) Only file names: other attributes such as size or date are not accesible. E.g. you can use tab key to autocomplete but not ls command.

Some thoughts:

• With X unset, R and W are mostly useless.


• 
  X alone disabling RW gives you a false sense of security since you could blindly read and write file contents and access subdirectories. You should be sure that every direct children of the directory have explicit permissions.


• Rarely you will use other values than:
  
  
  
  
  • 
    0: No access.
  
  
  • 
    1: Minimum access allowing traversing.
  
  
  • 
    5: Allow reading / writing, but not altering the structure of the directory tree itself.
  
  
  • 
    7: Full access.
  
  
  
  

From Robert Love's book "LINUX System Programming" chapter 1 section permission-

For any operation accessing a file or directory, it must first resolve the path to the file or directory. The resolution requires the user has execute permission on all directories along the path, except the final path component. So for directories, you can think of the execute bit means "resolvable".

Take path /a/b/c.txt as an example, say the user has 1) execute permission on / and /a; 2) has read permission on /a/b; 3) read and write permission on /a/b/c.txt.

• The user will fail to read (list) /a, because it has no read permission. But the path resolution doesn't fail.




• The user will be able to read (list) /a/b, because the user has execute permission on /, /a and /a/b and has read permission on /a/b. Note that, when reading /a/b, the filename c.txt is visible, but the metadata (e.g. filesize) and the content is not, because the filename is stored with the directory, not with the file, but the metadata is stored in the inode of the file.




• The user will fail to read /a/b/c.txt, because when resolving the path from / to /a to /a/b, it fails at /a/b since the user doesn't have execute permission.

See also how a pathname is resolved to a file.

The meaning of Execute for directories is quite clear. Since there is no Traverse permission, unlike Windows, you must overload something. The designers picked Execute, That causes endless confusion. As a computer security guy assigning Execute rights to something you don't intend to actually Execute looks dodgy.