How to Read an ls -l Permission String Such as rwxr-xr-x

The ten character string is the densest thing in a terminal listing and it decodes cleanly once you split it. Take the first character off as the file type, then read the remaining nine in three groups of three. Each group is always read, write, execute in that order, and a dash means the permission is absent. drwxr-xr-x is a directory where the owner has everything and group and others have read and traverse.

The special bits reuse the execute positions rather than adding characters, which is where the confusion starts. An s in the owner execute slot means setuid and execute together. A capital S in the same slot means setuid is set and execute is not, which is almost always an accident: there is nothing to execute, so the bit does nothing.

The same rule applies twice more. Position seven, the group execute slot, shows s or S for setgid, which on a directory is what makes new entries inherit the group. Position ten, the others execute slot, shows t or T for the sticky bit, which on a directory restricts deletion to the entry's owner. /tmp reads as drwxrwxrwt for exactly that reason.

An eleventh character sometimes appears. A trailing plus means the file has an access control list carrying permissions beyond the nine bits, so the string you are reading is not the whole story and getfacl is needed to see the rest. A trailing dot on some systems indicates a security context such as SELinux with no additional ACL.

Going the other way, from a string to an octal number, is three sums of the same three values: read is 4, write is 2, execute is 1. rwx is 7, r-x is 5, rw- is 6, r-- is 4 and --- is 0. The calculator does the conversion in both directions, and its symbolic box takes exactly this nine character form, with the leading type character optional so you can paste a line straight out of a listing.