Unix files are an unstructured collection of zero or more bytes of information. A file might contain an email message, a word processor document, an image, or anything else that can be represented as a stream of digital information. In principle, files can be any size, from zero bits to multiple terabytes of data.

Most of the information that you store on a Unix system is stored as the contents of files. Even database systems such as Oracle or MySQL ultimately store their information as the contents of files.

For each set of file contents in the filesystem, Unix stores administrative information in a structure known as an inode (index node). Inodes reside on disk and do not have names. Instead, they have indices (numbers) indicating their positions in the array of inodes on each logical disk.

Each inode on a Unix system contains:

The last three pieces of information, stored for each item and coupled with UID/GID information about executing processes, are the fundamental data that Unix uses for practically all local operating system security.

Other information can also be stored in the inode, depending on the particular version of Unix involved, and the form of filesystem being used.

Figure 6-1 shows how information is stored in an inode.

Figure 6-1. Files and inodes

As a user of a modern computer system, you probably think of a directory (also known as a folder) as a container that can hold one or more files and other directories. When you look at a directory you see a list of files, the size of each file, and other kinds of information.

Unix directories are much simpler than this. A Unix directory is nothing more than a list of names and inode numbers. These names are the names of files, directories, and other objects stored in the filesystem.

A name in a directory can consist of any string of any characters with the exception of a “/” character and the “null” character (usually a zero byte).^[64] There is a limit to the length of these strings, but it is usually quite long: 255 characters or longer on most modern versions of Unix. Older AT&T versions limited names to 14 characters or less.

Each name can contain control characters, line feeds, and other characters. This flexibility can have some interesting implications for security, which we’ll discuss later in this and other chapters.

Associated with each name is a numeric pointer that is actually an index on disk for an inode. An inode contains information about an individual entry in the filesystem; these contents are described in the next section.

Nothing else is contained in the directory other than names and inode numbers. No protection information is stored there, nor owner names, nor data. This information is all stored with the inode itself. The directory is a very simple relational database that maps names to inode numbers.

Unix places no restrictions on how many names can point to the same inode. A directory may have 2, 5, or 50 names that each have the same inode number. In like manner, several directories may have names that associate to the same inode. These names are known as links or hard links to the file (another kind of link, the symbolic link, is discussed later).

The ability to have hard links is peculiar for the Unix environment, and “peculiar” is certainly a good word for describing how hard links behave. No matter which hard link was created first, all links to a file are equal. This is often a confusing idea for beginning users.

Because of the way that links are implemented, you don’t actually delete a file with commands such as rm . Instead, you unlink the name—you sever the connection between the filename in a directory and the inode number. If another link still exists, the file will continue to exist on disk. After the last link is removed, and the file is closed, the kernel will normally reclaim the storage because there is no longer a method for a user to access it. Internally, each inode maintains a reference count, which is the count of how many filenames are linked to the inode. The rm command unlinks a filename and reduces the inode’s reference count. When the reference count reaches zero, the file is no longer accessible by name.

Every directory has two special names that are always present unless the filesystem is damaged. One entry is "." (dot), and this is associated with the inode for the directory itself; it is self-referential. The second entry is for ".." (dot-dot), which points to the “parent” of this directory—the directory next closest to the root in the tree-structured filesystem. Because the root directory does not have a parent directory, in the root directory the “.” directory and the “..” directories are links to the same directory—the root directory.

You can create a hard link to a file with the Unix ln command. But you cannot create a hard link to a directory—only the kernel can do this.^[65] This is how the kernel creates the “..” directory. You can, however, create symbolic links to directories.