The Execute Bit on a Directory Means Traverse, Not Run

The single most common permissions misunderstanding is that read lets you into a directory. It does not. Reading a directory means obtaining the list of names it holds, and that is the whole of it. Getting to anything inside, including calling stat on it to find out its size or its own permissions, requires the execute bit on the directory.

This is why a directory at 644 is useless. It looks like a sensible file mode, and applied to a directory it removes traversal from every class, so even the owner cannot cd into it or open anything within. The same applies to 664, 640 and 600 on directories: all are unenterable, and all are what a recursive chmod with a file mode produces.

The two failure modes look different, which is a useful diagnostic. Read without execute gives you a listing where every entry shows as question marks, because ls got the names from the directory and then failed to stat each one. Execute without read gives a clean permission denied from ls while cat on a known path succeeds.

Traversal is checked at every component of the path, not just the last one. Opening /home/alice/site/index.html needs execute on /, on home, on alice and on site, and read only on the file itself. One directory anywhere in that chain without execute for the requesting account produces a permission denied that appears to come from the wrong place entirely.

The command that untangles this is namei -l, which prints the mode, owner and group of every component of a path in order. Run it as the user that is failing, and the offending directory is usually obvious in the first three lines. Guessing at modes further down the tree is what turns a two minute problem into an afternoon.