chmod 711: Directories You Can Enter but Cannot List

711 is the clearest demonstration that read and execute are different permissions on a directory. Execute grants the right to resolve a name through the directory; read grants the right to enumerate the names. With execute but no read, a process that already knows a file is called report.pdf can open it, and the same process running ls gets permission denied.

The classic use is a home directory on a shared host that also serves personal web pages. /home/alice at 711 lets the web server traverse into /home/alice/public_html without letting other users on the box list what else is in Alice's home. Some hosting panels set exactly this, and it is why you can sometimes fetch a file by URL from a directory you cannot browse.

It is a usability barrier rather than a security boundary. Names can leak from logs, backups, error messages, browser history or simple guessing, and once a name is known the file opens if its own mode allows it. Treat 711 as a way to keep casual listing out, never as a way to keep a secret. The file's own mode is what protects the contents.

On a file rather than a directory, 711 is almost always a mistake. It means others can execute the program but cannot read it, which works for a compiled binary and fails immediately for a shell script, because the interpreter has to read the script's bytes to run it. A non readable script produces permission denied even though the execute bit is set.

Load it into the calculator next to 755 and the difference is one column: r becomes a dash for group and others, and the ls -l rendering changes from drwxr-xr-x to drwx--x--x. That single column is the whole difference between a browsable directory and a traversable one.