Linux file types and the seven file kinds · Linux

Everything on a Linux system is a file. That sentence is more than a convenience — it is the abstraction that lets you use the same syscalls, the same tools, and the same mental model for ordinary text files, directories, network sockets, kernel devices, and pipes.

The seven file kinds

Character in `ls -l`	Kind	What it is
`-`	Regular file	Bytes on disk. Text, binaries, images, anything.
`d`	Directory	A special file whose contents are entries pointing to other files.
`l`	Symbolic link	A file whose contents are a path to another file.
`b`	Block device	A file representing block-addressable storage (disks, partitions, LVM volumes).
`c`	Character device	A file representing a character-stream device (terminals, /dev/null, /dev/random).
`p`	Named pipe (FIFO)	A file that lets two processes communicate via a kernel buffer.
`s`	Socket	A file representing a Unix domain socket — an IPC endpoint.

Read-only / Safethe five file kinds in one command— Five different file kinds in one listing: regular file (-), directory (d), socket (s), block device (b), character device (c). The leading character of the permission string is the file-kind indicator.

$ ls -l /etc/passwd /tmp /var/run/sshd.sock /dev/sda /dev/null

-rw-r--r-- 1 root root 3010 Aug  9 11:11 /etc/passwd
drwxr-xr-x 2 root root 4096 Aug  9 11:11 /tmp
srwxrwxr-x 1 root root    0 Aug  9 11:11 /var/run/sshd.sock
brw-rw---- 1 root disk  8, 0 Aug  9 11:11 /dev/sda
crw-rw-rw- 1 root root  1, 3 Aug  9 11:11 /dev/null

Illustrative output

Why it matters

Knowing the file kind is the difference between:

“I cannot edit this file” because it is a directory, not a regular file.
“I cannot rm this — it is busy” because it is the mount point of a filesystem.
“My application fails to start” because the socket it expects is actually a regular file left over from a botched install.
“Why does cat /dev/sda print gibberish?” because it is a block device, not a regular file.

Reading file metadata with stat

ls -l shows part of the story. stat shows everything the kernel tracks about a file:

Read-only / Safestat— stat shows file kind, size in bytes and blocks, the device holding it, the inode number, link count, permissions, ownership, and three timestamps: access (read), modify (write content), change (write inode metadata).

$ stat /etc/passwd

  File: /etc/passwd
Size: 3010      	Blocks: 8          IO Block: 1024   regular file
Device: 801h/2049d	Inode: 12345       Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-08-09 11:11:11 +0000
Modify: 2026-08-09 11:11:11 +0000
Change: 2026-08-09 11:11:11 +0000
Birth: 2024-04-22 12:34:56 +0000

Illustrative output

The three timestamps:

Timestamp	Set when	Updated by
atime (access)	file is read	`cat`, `less`, `grep`
mtime (modify)	file content is written	most writes
ctime (change)	inode metadata is written	chmod, chown, rename

The `file` command

When you do not know what a file is, file reads its magic bytes and guesses. It is not perfect — it pattern-matches on signatures, not on intent — but it is the fastest first answer.

Read-only / Safefile— file inspects a few bytes at the magic offset and reports the inferred file type. Note /var/run/docker.sock is a Unix domain socket — a file that is also an IPC endpoint.

$ file /bin/bash /etc/passwd /var/run/docker.sock

/bin/bash:               ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked
/etc/passwd:              Unicode text, UTF-8 text
/var/run/docker.sock:     socket

Illustrative output

The seven file kinds

Why it matters

Reading file metadata with stat

The file command

Knowledge check

The `file` command