Security and File System Permissions
Security and File System Permissions tests the Linux permission model and basic hardening: reading modes, setting ownership, applying least privilege, and protecting accounts and data. Expect practical chmod/chown questions plus security concepts.
Reading and setting modes
ls -l shows a type character and nine permission bits: owner, group, other, each r/w/x. Numeric values are read 4, write 2, execute 1. chmod 640 file gives owner rw-, group r--, other ---; chmod u+x,g-w,o=r uses symbolic form. On directories, r lists names, w creates/deletes entries, and x allows traversal into the directory. chown user:group file changes ownership; chgrp changes group. umask removes default bits from 666 for files and 777 for directories.
Special bits and hardening
The sticky bit on a world-writable directory (1777, as on /tmp) lets only owners delete their files. setuid runs an executable with the file owner’s identity; setgid does the same for group and preserves group ownership on directories. Security basics include least privilege via sudo, protecting /etc/shadow, SSH key authentication, disabling direct root SSH login, verifying downloads with GPG, and applying updates.
Worked example
A report is mode 664 and must become owner read/write, group read-only, others no access. Owner rw = 6, group r = 4, other = 0, so run chmod 640 report.txt. If the group must also be able to enter a directory, add x: chmod 750 directory.
Traps
chmod 777 grants write and execute to everyone; removing x from a directory blocks access to files inside even if the files are readable; chown does not change mode; umask is subtracted from defaults, not from existing files; and sticky bit does not stop file owners from deleting their own files.