What Does the Dot After Linux File Permissions Mean?

You ran ls -l and saw a dot after the mode bits — something like -rw-r--r--. instead of -rw-r--r--. That trailing character is not another read, write, or execute permission. GNU ls uses it to report alternate access information, most often a SELinux security context on RHEL-family systems.

Quick answer: what does the dot mean?

-rw-r--r--.
          ^
          dot

GNU ls prints . when the file has a security context but no other alternate access method. The current GNU Coreutils ls documentation defines the markers this way:

• . — security context only
• + — some other combination of alternate access methods
• ? — ls could not determine the alternate access information

The nine rwx characters are the normal Unix mode. The dot sits outside that mode string as a separate security-context indicator; on RHEL-family SELinux systems, it reflects the SELinux file context.

Check the SELinux context with ls -Z

To see the label behind the dot, use ls -Z or ls -lZ:

ls -lZ /etc/passwd

Sample output:

-rw-r--r--. 1 root root system_u:object_r:passwd_file_t:s0 /etc/passwd

-rw-r--r-- is the Unix permission mode. system_u:object_r:passwd_file_t:s0 is the SELinux context stored separately from chmod bits. The trailing . only tells you that context exists and that ls did not also report another alternate access method such as an ACL.

On a file you own in your home directory, the context differs but the dot behaves the same way:

ls -Z ~/dot-perm-lab/dotfile

Sample output:

unconfined_u:object_r:admin_home_t:s0 /root/dot-perm-lab/dotfile

Dot (.) vs plus (+) in Linux permissions

Inspect an ACL when you see +. getfacl comes from the acl package:

getfacl aclfile

Sample output:

# file: aclfile
# owner: root
# group: root
user::rw-
user:root:rwx
group::r--
mask::rwx
other::r--

That file showed -rw-rwxr--+ in ls -l because ls detected an alternate access method beyond the security context. The mask::rwx entry is why the group permission field can display rwx even when group::r-- is more restrictive. For ACL syntax and setfacl workflows, see Linux ACL examples.

Inspect SELinux when you see .:

ls -Z aclfile

Sample output:

unconfined_u:object_r:admin_home_t:s0 aclfile

Why chmod does not remove the dot

chmod changes only the traditional mode bits. It does not remove the SELinux security context.

chmod 644 ~/dot-perm-lab/dotfile

List the file again — the mode bits change, but the trailing dot stays:

ls -l ~/dot-perm-lab/dotfile

Sample output:

-rw-r--r--. 1 root root 9 Aug 16 15:58 /root/dot-perm-lab/dotfile

chmod 777, chmod 755, and chmod 644 are not ways to remove the trailing dot. If the dot surprises you after a permission change, inspect the context with ls -Z instead of chasing the marker with chmod.

Should you remove the dot?

Normally, no. On SELinux-enabled systems, -rw-r--r--. is expected.

The dot does not mean:

• broken permissions
• an ls error
• overly restrictive Unix modes
• an ACL problem by itself

It only means ls found a security context and no other alternate access method to report. Do not disable SELinux merely because ls -l shows a dot.

Fix an incorrect SELinux context with restorecon

When the label is wrong for the path, restore the expected context instead of stripping it.

Check the current label:

ls -Z ~/dot-perm-lab/dotfile

See what policy expects for that path:

matchpathcon ~/dot-perm-lab/dotfile

Sample output:

/root/dot-perm-lab/dotfile	system_u:object_r:admin_home_t:s0

Restore the expected label on one file. In the lab run below, the file had the wrong etc_t type before restorecon corrected it:

restorecon -v ~/dot-perm-lab/dotfile

Sample output:

Relabeled /root/dot-perm-lab/dotfile from unconfined_u:object_r:etc_t:s0 to unconfined_u:object_r:admin_home_t:s0

Notice that restorecon corrected etc_t to admin_home_t but retained unconfined_u. By default, restorecon primarily corrects the SELinux type on an already-labeled file. matchpathcon can show a different user component (system_u here) because it reports the policy default for the path, not every component of the label already stored on the file. Use restorecon -U or -F only when you intentionally need to replace additional context components.

For a directory tree, use recursive mode:

restorecon -Rv ~/dot-perm-lab

If labels under /var/log drift after a policy change, restorecon -Rv /var/log is the maintenance path — not bulk deletion of security.selinux attributes.

Can you remove the security.selinux attribute?

setfattr -x security.selinux FILE requests removal of the stored SELinux xattr, but an active SELinux policy can reject direct changes to security.* attributes. This is not the normal way to fix the dot; use restorecon when the label is incorrect.

That is not a routine maintenance step. If SELinux is enabled or later re-enabled, restore the expected context with restorecon rather than stripping labels so ls -l looks cleaner.

References

• GNU Coreutils — ls invocation (alternate access methods) — https://www.gnu.org/software/coreutils/manual/html_node/ls-invocation.html
• Linux ls(1) manual — https://man7.org/linux/man-pages/man1/ls.1.html
• Red Hat Enterprise Linux 10 — Managing file system labels — https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/using_selinux/managing-file-system-labels_using-selinux
• Linux setfattr(1) manual — https://man7.org/linux/man-pages/man1/setfattr.1.html

Summary

The dot after Linux permissions in ls -l output is a GNU ls marker, not an extra r, w, or x bit. It usually means the file has a SELinux security context and nothing else ls classifies as an alternate access method. A plus sign points you toward ACL inspection with getfacl; a question mark means ls could not read that metadata.

Use ls -Z when you need the actual context. chmod changes Unix modes only, so it will not remove the dot. On SELinux systems the dot is normal — fix wrong labels with matchpathcon and restorecon rather than disabling SELinux or stripping security.selinux across system directories.