Security
File permissions
Every file has owner, group, and other bits. Octal: r=4, w=2, x=1, so 640 is rw-r-----. Directories need x to be entered. Special bits: SUID (4) runs as the file owner, SGID (2) inherits group on directories, sticky (1) on /tmp stops other users deleting your files. umask subtracts from defaults: files start at 666, directories at 777, so umask 027 gives 640 and 750.
Mandatory access control
SELinux labels every process and file with a context (user:role:type:level). Modes are enforcing, permissive, and disabled, set in /etc/selinux/config. Never fix a denial with chmod alone - read the AVC record (ausearch -m AVC, sealert). Persist context changes with semanage fcontext, then restorecon -Rv. AppArmor profiles live in /etc/apparmor.d.
Network and access security
Use firewalld zones/services, or nftables/ufw. Remember runtime versus permanent rules: firewall-cmd --permanent still needs --reload to take effect. Harden SSH with PermitRootLogin no, PasswordAuthentication no, keys only, and correct ownership on ~/.ssh (700) and authorized_keys (600).
Auditing and crypto
AIDE hashes files for integrity checking; auditd records syscalls; GPG signs and encrypts; TLS certificates chain to a CA.
Traps: the kernel ignores SUID on shell scripts. ACLs override mode bits through the mask. A file with perfect permissions can still be blocked by SELinux. Password aging is chage, not passwd.
Rule of thumb: least privilege - grant the narrowest right, to a group rather than the world, and check both DAC (mode/ACL) and MAC (SELinux) when access fails.