How to Read ls -l Output in Linux: Permissions, Links, Owner, Size and Date Explained

Updated: 8 October 2026 · Applies to: Debian 13 (GNU coreutils ls 9.7), AlmaLinux 10 (GNU ls 9.5) and Ubuntu 26.04 (uutils ls 0.10.0)

Each line of ls -l has the same fields, left to right: file type and permissions, hard link count, owner, group, size in bytes, last modification time and name. This line is a regular file that its owner can read and write, its group can read and others cannot open, with an extra access list (+), one link, owner and group root, 7 bytes, changed on 7 October at 21:14:

-rw-r-----+ 1 root root 7 Oct  7 21:14 config.php

For the options of ls itself (hidden files, sorting, sizes), see how to list files in Linux with the ls command.

An annotated example

A test directory with one of each kind of entry, listed on Debian 13:

$ ls -l
total 40
srwxr-xr-x  1 root root       0 Oct  7 21:14  app.sock
-rw-r--r--  1 root root 5242880 Oct  7 02:30  backup.tar.gz
-rw-r-----+ 1 root root       7 Oct  7 21:14  config.php
lrwxrwxrwx  1 root root      12 Oct  5 10:00  current -> releases/2.1
drwxrwxrwt  2 root root    4096 Oct  5 10:00  dropbox
-rw-r--r--  1 root root       7 Jan 15  2027  future.txt
-rw-r--r--  1 root root       2 Oct  7 21:14 'my file.txt'
-rw-r--r--  1 root root      10 Dec  1  2025  notes.txt
-rw-r--r--  1 1050 1050       2 Oct  7 21:14  orphan.txt
prw-r--r--  1 root root       0 Oct  7 21:14  queue.pipe
drwxr-xr-x  4 root root    4096 Oct  5 10:00  releases
-rw-r--r--  2 root root      12 Oct  1 12:00  report.csv
drwxrwsr-x  2 root root    4096 Oct  5 10:00  shared
-rwsr-xr-x  1 root root      10 Oct  7 21:14  tool

total 40 is the disk space the listed files use, in 1024-byte blocks.

1. File type (first character)

- regular file, d directory, l symbolic link, p named pipe, s socket, as used by PHP-FPM and MySQL, c and b character and block devices in /dev (ls -l /dev/null printed crw-rw-rw- 1 root root 1, 3).

2. Permissions (next nine characters)

Three groups of three: owner, group, everyone else. r read, w write, x execute (for a directory: enter it), - not allowed. rw-r--r-- is 644 in numbers; see translate rwx permissions into octal. The third place of a group can show a special bit:

• s in the owner part (tool): setuid, the program runs with its owner's rights, as /usr/bin/passwd does. A capital S (-rwSr--r--) means setuid without execute, usually a mistake.
• s in the group part (shared): setgid. New files in the directory take its group: after chgrp web shared, a file root created inside belonged to group web.
• t at the end (dropbox, also /tmp): sticky bit. Anyone may create files, but only the file's owner, the directory's owner or root can delete them; our user bob got Operation not permitted on alice's file. Capital T (drwxrwx--T) means sticky without execute for others.

To find files with these bits, see find files with SUID and SGID permissions.

3. The character after the permissions: + or .

+ means an access control list (ACL) adds rights beyond the normal permissions. We set one with setfacl -m u:nobody:r config.php, and getfacl config.php listed user:nobody:r--; see how to configure ACLs. According to the GNU coreutils manual, . marks a file with an SELinux security context and nothing else, which you see on AlmaLinux, Rocky Linux and RHEL with SELinux on (our test host had SELinux off, so it did not appear). When no file in the list has either, GNU ls drops this column.

4. Link count

For a file, the number of names (hard links) for the same data: report.csv shows 2 because we ran ln report.csv /srv/old/report-2025.csv. For a directory, 2 plus the number of subdirectories: releases holds 2.0 and 2.1, so 4. See hard and symbolic links.

5. Owner and group

A number instead of a name (1050 1050 on orphan.txt) means no account has that ID, usually because the user was deleted: after userdel carol, her file showed 1002 1003. ls -n shows numeric IDs for every file.

6. Size

• Files: bytes; ls -lh shows 5242880 as 5.0M.
• Directories: 4096 is the directory's own list of names, not its contents. Use du -sh for that.
• Symbolic links: the length of the target path (releases/2.1 is 12 characters).
• Devices: major and minor numbers (1, 3) instead of a size. Pipes and sockets: 0.

7. Date and time

The last time the content changed, in the server's timezone. The GNU manual calls a time recent if it is less than six months old and not in the future; recent files show the time, others the year. So notes.txt shows Dec 1 2025 and future.txt shows Jan 15 2027 (a future date usually means a wrong clock). For the full date on every line:

$ ls -l --time-style=long-iso future.txt notes.txt
-rw-r--r-- 1 root root  7 2027-01-15 09:00 future.txt
-rw-r--r-- 1 root root 10 2025-12-01 09:00 notes.txt

--full-time adds seconds and the UTC offset. ls -lu shows the last access time, ls -lc the last status change (permissions, owner or content); stat shows all of them.

8. Name

A symbolic link shows -> and its target; ls -lLd current describes the target instead. In a terminal, GNU ls quotes names with spaces ('my file.txt') so you can paste them into a command, and indents the other names by one space to keep the column straight. In a pipe or file there are no quotes.

Ubuntu 26.04 (uutils ls)

Ubuntu 26.04 uses the Rust coreutils (ls (uutils coreutils) 0.10.0). In the same test it printed exactly the same output as GNU ls for every kind of entry above. One difference: ls -n aligned the numeric IDs to the left (1 0 0 7), where GNU aligns them to the right (1 0 0 7). GNU ls is still installed as gnuls.

To change these fields, use chmod, chown and chgrp; see making sense of 755 and rwxr-xr-x.