LICM: Security and File Permissions study guide

Domain 5 - Security and File Permissions

This domain tests account types, the files that define them, and the permission model that protects everything on disk - the highest-yield topic on the exam.

Core rules

root (UID 0) bypasses permission checks. Standard users have UID ≥ 1000; system accounts have low UIDs and usually no login shell. sudo runs one command as root; su - opens a root shell.
/etc/passwd holds username, UID, GID, home and shell; /etc/shadow holds the hashed password and is readable only by root; /etc/group holds group membership. id, who, w and last reveal who is logged in.
useradd, groupadd, usermod -aG and passwd manage accounts; /etc/skel seeds each new home directory.
ls -l shows a mode like -rwxr-x---: file type, then owner/group/other triples of r(4), w(2), x(1). chmod 750 file yields rwxr-x---. chown user:group file and chgrp change ownership.
umask subtracts from defaults; 022 gives files 644 and directories 755.
SUID (4xxx) runs a program as the file owner, SGID (2xxx) as the file's group, and the sticky bit (1xxx) on /tmp stops users deleting each other's files.
Hard links share an inode and cannot cross filesystems; symbolic links (ln -s) store a path and can dangle.

Worked example

backup.sh must be executable and readable by all but writable only by its owner: chmod 755 backup.sh. Reasoning: 7 = rwx for owner, 5 = r-x for group, 5 = r-x for others; scripts also need read permission to be interpreted.

Traps

chmod 777 as a universal fix - it grants world write.
Mode 644 on a directory removes the execute bit and breaks cd.
usermod -aG without -a replaces all supplementary groups.
Editing /etc/shadow by hand instead of using passwd.