Table of Contents
BASH - Commands - ls - ls output fields definitions
The output of the ls command depends on the version of “ls”, the options used, the platform used, etc.
ls -al
returns:
-rwxrw-r-- 10 root root 2048 Jan 13 07:11 afile.exe
-rwxrw-r-- 10 root root 2048 Jan 13 07:11 afile.exe ?UUUGGGOOOS 00 UUUUUU GGGGGG #### ^ ^-- File name. ^ ^ ^ ^ ^ ^ ^ ^ ^ \-- Date Time stamp. | | | | | | | | \--- File Size. | | | | | | | \-------- Group Name (for example, Users, Administrators, etc). | | | | | | \--------------- Owner Name. | | | | | \---------------------- Link count (Usually refers to number of hard links; but can vary.) | | | | \--------------------------- Alternative Access (blank means none defined, anything else varies) | \--\--\----------------------------- File Mode Permissions. Read, Write and Special access modes for [U]ser, [G]roup, and [O]thers (everyone else). \------------------------------------- File Type flag.
- File Type flag: The very first character. Typically one of: d for directory, l for a symbolic link (hard links show normally without a special character of their own), or - for a normal file.
- There are many others, but less commonly seen, file types for various filesystems. These first ten characters (file type and permissions) are discussed on Wikipedia. Again, your documentation will tell you exactly what kind of file types your command supports and displays.
- File Mode Permissions: Three sets of three chars, where:
- First set is permissions for the “User” (i.e., Owner)
- Second set is permissions for the “Group”
- Third set is permissions for “Others” (i.e., everyone else; anyone who is neither Owner nor Group).
- Link count: For files it means number of hard links. For directories, its the number of directories inside the directory + this directory itself.
- Alternative Access flag: Usually a blank space, but on some platforms, it may be used to indicate there are special/alternative access modes (such as ACLs and security descriptors on WIN32, etc), and varies widely – consult your manual, man pages, info tool, or what-not.
- File Size: Some versions and/or command line flags will list the number of blocks used instead of the number of bytes; a filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as “1”, meaning 1 block is used, from 1025 to 2048 as “2”, using 2 blocks, and so on. But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.
- Date Time stamp: Usually the date/time the file was last modified, not the time the file was created.
NOTE: If you cannot find a man/info page for ls itself (man ls / info ls), try looking in the coreutils package (info coreutils).
Also note that among the more common platforms, Microsoft platforms tend not to translate very well to ls output, so you may see odd behavior, flags, or other unusual info in the output, depending on how your version of “ls” was compiled, what it was linked against, etc.
File Types flag
On most systems, the first field is also used to indicate the presence of extra attributes like ACLs, security attributes or other extended attributes.
| - | Regular file |
| b | Block special file |
| c | Character special file |
| C | High performance (“contiguous data”) file |
| d | Directory |
| D | Door (Solaris 2.5 and up) |
| l | Symbolic link |
| M | Off-line (“migrated”) file (Cray DMF) |
| n | Network special file (HP-UX) |
| p | FIFO (named pipe) |
| P | Port (Solaris 10 and up) |
| s | Socket |
| ? | Some other file type |
File Mode Permissions
Each of the three characters represent the read, write, and execute permissions:
Usually in the form:
rwx rwx rwx
- First set of rwx are permissions for the owner of the file.
- Second set of rwx are permissions for the group that the owner belongs to. Everyone in the same group will get these permissions to the file.
- Third set of rwx are permissions for others. That are not the owner; nor part of the group the owner is part of.
| r | Reading is permitted. |
| w | Writing is permitted. |
| x | Execution is permitted. For directories it means you can attempt to access the directory contents. |
| - | The specific permission is not allowed. |
but ls can combine multiple bits into the third character of each set of permissions as follows:
| s | If the set-user-ID or set-group-ID bit and the corresponding executable bit are both set. |
| S | If the set-user-ID or set-group-ID bit is set but the corresponding executable bit is not set. |
| t | If the restricted deletion flag or sticky bit, and the other-executable bit, are both set. The restricted deletion flag is another name for the sticky bit. |
| T | If the restricted deletion flag or sticky bit is set but the other-executable bit is not set. |
| x | If the executable bit is set and none of the above apply. |
NOTE: Sometimes you may encounter an s or S for setuid and/or setgid programs, or other less common characters.
See your ls documentation for the mode characters it will show.
Alternative Access Types
Links
Some platforms have an odd notion of what constitutes a link.
These usually include hard links and symbolic links, as well as directory entries (which is why directories often have high link counts – its parent has one link, the directory has a link to itself in the . entry, and each of its sub-directories has a link back via ..
File Size
Some versions and/or command line flags will list the number of blocks used instead of the number of bytes.
A filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as “1”, meaning 1 block is used, from 1025 to 2048 as “2”, using 2 blocks, and so on.
But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.
NOTE: The file size for a directory is only the size of the metadata of the directory, not the total size of the files under the directory.
Date Time stamp
The Date Time stamp is usually the date/time the file was last modified, not the time the file was created.
NOTE: On un*x-ish filesystems there is no record of the file creation time
The ctime field does NOT mean “creation time” as it does on FAT/NTFS filesystems, but rather, it means the “inode [C]hange time” – the time the inode itself was last modified.
The mtime (last [M]odified) and atime (last [A]ccesed/read) timestamps are the same on both systems – although the precision (FAT has a granularity of two seconds, for example) and time zone may vary.