CELE: Users, groups, and permissions study guide

This domain, Users, groups, and permissions, tests account management and the permission model that decides who may read, write, or execute what, including special bits, umask, and ACLs.

Accounts and groups

/etc/passwd holds name, UID, GID, GECOS, home, and shell; /etc/shadow holds the hash and aging data; /etc/group and /etc/gshadow define groups.
UID 0 is root; system accounts usually sit below 1000; regular users start at 1000 on most distributions.
useradd -m -s /bin/bash, usermod -aG wheel alice (append, never omit -a), passwd, chage -l, id, groups.
sudo is configured in /etc/sudoers through visudo; membership in wheel (RHEL) or sudo (Debian) is the usual grant.

Permissions

Three triads (owner, group, other) with r=4, w=2, x=1. Examples: chmod 640 file, chmod g+w,o-rwx file, chown alice:dev file.
On directories, x means traverse, w means create and delete entries, r means list names.
Special bits: setuid (4) runs as the file owner; setgid (2) on a directory makes new files inherit the group; sticky (1) on a shared directory stops users deleting each other's files (/tmp is 1777).
umask subtracts from base 666 for files and 777 for directories, so umask 027 yields files of 640 and directories of 750.
ACLs: setfacl -m u:bob:r-- file, inspected with getfacl.

Worked example

A file shows -rw-r----- 1 alice dev 1024 .... Owner alice reads and writes, group dev reads, others get nothing. To let bob read it without changing the group, run setfacl -m u:bob:r-- file. Reasoning: the ACL adds a per-user entry while leaving the traditional triad intact, and ls -l will show a + marker.

Traps

usermod -G without -a wipes supplementary group membership.
Group changes need a fresh login or token to take effect.
setuid is ignored on scripts for security reasons.
Deleting a file depends on write permission on the directory, not on the file.