$ ls -lhd fooledYa/
d-wx------ #snip
First thing's first: I can write to the directory (make new entries) and I can execute (cd
) to the directory. I can't read the directory, though. What that means isn't intuitive.
When you work with directories in Unix systems, the directory point to inodes, which are different things than the pointer entry. Being able to follow references down a directory tree is controlled by the eXecute
bit. For each directory level down the tree, the operating system checks the execute bit before descending to the next level.
Meanwhile, the Read
bit controls accessing the inode's contents. Everything you can reference on your filesystem is an inode entry. Directories or files, they point to an inode.
ls -ldi fooledYa/
121100226 d-wx------ #snip
In this case, the directory inode is 121100226. The read permission tells whether I can access that inode file in userspace to read its contents. The contents of the directory inode are the references to other files. The kernel can always read that. You as a user are controlled by the kernel's decisions regarding the entries within that.
Thus, since ls
tries to read the contents to tell me what's there (as checked by the Read
flag), it is denied. Since I still have eXecute
permission, however, the kernel will allow me to traverse to files that I specify if the directories above the file I want all permit me to eXecute
into them, regardless of whether I can read them to see what the reference.
So, to summarize for directories, think of execute as a master permission. Without it, you can't enter the directory to do anything. After that, think of them as a two column file. If you have read permission, you can see the entries. If you have write permission, you can add or remove entries. If you lack those two permissions but have execute, you can make references to entries in the list, but you cannot read the list.
This is a good illustrative examples of inodes and how they represent directory references and file block on disk references: http://teaching.idallen.com/dat2330/04f/notes/links_and_inodes.html
chmod 0300
would gived-wx------
which would allow you tocd
into the directory (due tox
), but not list the files (nor
). However because you didn't set the permissions recursively (chmod -R 0300 fooledYa/
) the child directoryohReally
has normaldrwx------
permissions, hence as you see.fooledYa
with read permissions revoked on all files/directories, and one fromohReally
with read permissions granted on all files/directories INCLUDING.
which points to itself.chmod 0300 somedir
revokes the permission to read thesomedir
listing, and not anything to the contents.0710
and0711
for things that need to be visible to e.g. daemons but shouldn't be too easy for a casual user to get into. It isn't bullet-proof security, but for non-owner, non-root users, makes it just a little harder to look at the contents of the directory while still allowing access based on a full file path.