Linux File Types

What Are Linux File Types?

Linux recognizes seven file types, all visible through the first character of ls -l’s permission string. This matters because tools like find -type and scripts that walk the filesystem need to distinguish a real file from a device, pipe, or socket that happens to sit in the same directory.

ls -l /
# d rwxr-xr-x  ...  /etc          <- directory
# - rw-r--r--  ...  /etc/hostname <- regular file
# l rwxrwxrwx  ...  /bin -> usr/bin  <- symlink
# c rw-rw-rw-  ...  /dev/null     <- character device
# b rw-rw----  ...  /dev/sda      <- block device
# p rw-r--r--  ...  mypipe        <- named pipe (FIFO)
# s rwxrwxrwx  ...  docker.sock   <- socket

The Seven Types

find / -type s 2>/dev/null   # find all sockets on the system
file report.txt              # identify a file's type/content by magic bytes
stat report.txt              # shows file type in the "File:" line

Character vs Block Devices

• Character devices transfer data as a continuous stream (keyboards, serial ports, /dev/null, /dev/urandom).
• Block devices transfer data in fixed-size blocks and support random access (hard disks, SSDs, USB drives) — this is what you partition and put filesystems on.

Named Pipes (FIFOs) & Sockets in Practice

# Create a named pipe — lets two unrelated processes communicate via a filesystem path
mkfifo /tmp/mypipe
echo "hello" > /tmp/mypipe &     # writer (backgrounded, blocks until read)
cat /tmp/mypipe                 # reader

# Unix domain sockets — how Docker's CLI talks to the daemon
ls -l /var/run/docker.sock
docker -H unix:///var/run/docker.sock ps

Production Considerations

• docker.sock being mounted into a container (-v /var/run/docker.sock:/var/run/docker.sock) effectively grants that container root access to the host — a well-known container-escape risk.
• Character devices like /dev/urandom are commonly used for entropy in cryptographic operations inside containers — running low on entropy can slow TLS handshakes.
• find -type f is the safe way to script over “only real files,” excluding directories, sockets, and device nodes that might otherwise break a naive loop.

Quick Interview Answer

“Linux has seven file types — regular files, directories, symlinks, character devices, block devices, named pipes, and sockets — all identifiable from the first character of ls -l. Character devices stream data (like /dev/null); block devices support random-access, block-sized I/O (like /dev/sda), which is why only block devices get partitioned and formatted.”

Common Mistakes

• Assuming everything under /dev is a “regular file” when scripting — always type-check with find -type f or [ -f file ] in bash.
• Mounting docker.sock into untrusted containers without understanding the privilege-escalation risk.