Skip to main content

Lab 3.2 - Permission Management

Objectives​

By the end of this lab, you will be able to:

  • Understand Linux permissions (rwx)
  • Modify permissions with chmod
  • Change ownership with chown
  • Understand special permissions (SUID, SGID, sticky bit)
  • Use ACLs (Access Control Lists)

Prerequisites​

  • Ubuntu 24.04 installed
  • Terminal open
  • User access with sudo

Exercise 1: Understanding Permissions​

Step 1: View Permissions​

# Create test files
mkdir ~/test-permissions
cd ~/test-permissions

touch file1.txt file2.txt file3.txt
mkdir dir1 dir2

# View permissions
ls -l

# Format: -rw-r--r-- 1 user group 0 date file
# Type | Owner | Group | Others

Step 2: Interpret Permissions​

# Analyze each part
ls -l file1.txt

# Example: -rw-r--r--
# - = normal file (d = directory, l = link)
# rw- = owner: read, write, no execute
# r-- = group: read only
# r-- = others: read only

Exercise 2: Modifying Permissions (chmod)​

Step 1: Symbolic Mode​

# Add execution for owner
chmod u+x file1.txt

# Add read for group
chmod g+r file2.txt

# Remove write for others
chmod o-w file3.txt

# Combinations
chmod u+x,g+r,o-r file1.txt

# Verify
ls -l

Step 2: Octal Mode​

# 755 = rwxr-xr-x
chmod 755 file1.txt

# 644 = rw-r--r--
chmod 644 file2.txt

# 700 = rwx------
chmod 700 file3.txt

# 777 = rwxrwxrwx (DANGEROUS!)
chmod 777 file1.txt  # Avoid in production

Step 3: Directory Permissions​

# Executable directory = right to enter
chmod 755 dir1

# Non-executable directory = cannot enter
chmod 644 dir1  # ❌ Will not work correctly
ls -ld dir1

# Correct
chmod 755 dir1

Exercise 3: Ownership (chown)​

Step 1: Change Owner​

# Create a file
sudo touch /tmp/root-file.txt
ls -l /tmp/root-file.txt

# Change owner
sudo chown $USER /tmp/root-file.txt
ls -l /tmp/root-file.txt

# Change owner and group
sudo chown $USER:$USER /tmp/root-file.txt

Step 2: Change Group (chgrp)​

# View groups
groups

# Change group
sudo chgrp sudo file1.txt
ls -l file1.txt

# Or with chown
sudo chown :sudo file2.txt

Exercise 4: Special Permissions​

Step 1: SUID (Set User ID)​

# Create a script
cat > ~/test-suid.sh << 'EOF'
#!/bin/bash
whoami
id
EOF

chmod +x ~/test-suid.sh

# Add SUID
chmod u+s ~/test-suid.sh
ls -l ~/test-suid.sh  # Note the 's' instead of 'x'

# Test
./test-suid.sh

Step 2: SGID (Set Group ID)​

# Create a shared directory
mkdir ~/shared
chmod 2775 ~/shared  # 2 = SGID
ls -ld ~/shared  # Note the 's' in the group

# New files will inherit the group
touch ~/shared/file.txt
ls -l ~/shared/file.txt

Step 3: Sticky Bit​

# /tmp uses the sticky bit
ls -ld /tmp

# Create a directory with sticky bit
mkdir ~/sticky-dir
chmod 1777 ~/sticky-dir
ls -ld ~/sticky-dir  # Note the 't'

# Only the owner can delete their files

Exercise 5: ACLs (Access Control Lists)​

Step 1: Install ACLs​

# Check if installed
which setfacl

# Install if necessary
sudo apt update
sudo apt install acl

Step 2: Use ACLs​

# Create a file
touch file-acl.txt

# View current ACLs
getfacl file-acl.txt

# Grant permission to a specific user
sudo setfacl -m u:other-user:rw file-acl.txt

# Grant permission to a group
sudo setfacl -m g:developers:rx file-acl.txt

# View ACLs
getfacl file-acl.txt

Step 3: Default ACLs​

# Set default ACL for a directory
sudo setfacl -m d:u:other-user:rw dir1

# New files will inherit this ACL
touch dir1/new.txt
getfacl dir1/new.txt

Exercise 6: umask​

Step 1: Understand umask​

# View current umask
umask

# umask = denied permissions
# 022 = deny write for group and others
# Thus: 666 - 022 = 644 for files
#       777 - 022 = 755 for directories

Step 2: Change umask​

# More restrictive umask (027)
umask 027

# Create a file
touch file-umask.txt
ls -l file-umask.txt  # Should be 640

# Reset umask to default
umask 022

Exercise 7: Complete Practice​

Step 1: Real Scenario​

# Create a project structure
mkdir -p ~/project/{src,bin,docs}
touch ~/project/src/{script1.sh,script2.sh}
touch ~/project/docs/{readme.txt,guide.txt}

# Executable scripts for owner and group
chmod 750 ~/project/src/*.sh

# Read-only docs for all
chmod 644 ~/project/docs/*.txt

# Bin directory: executable for all
chmod 755 ~/project/bin

# Verify
ls -lR ~/project

Step 2: Securing​

# Sensitive file: read-only for owner
touch ~/project/config-secret.txt
chmod 600 ~/project/config-secret.txt

# System script: SUID root (with caution!)
sudo chown root:root ~/project/src/script1.sh
sudo chmod 4750 ~/project/src/script1.sh
ls -l ~/project/src/script1.sh

Verification​

Checklist​

Ensure you can:

  • Read and interpret permissions (ls -l)
  • Modify permissions with chmod (symbolic and octal)
  • Change owner with chown
  • Change group with chgrp
  • Use SUID, SGID, sticky bit
  • Configure ACLs
  • Understand and use umask

Reflection Questions​

  1. What is the difference between 755 and 644?

    • 755: executable (for scripts/directories)
    • 644: read-only (for normal files)

  2. When to use ACLs vs chmod?

    • ACLs: granular permissions for specific users/groups
    • chmod: standard permissions (owner/group/others)

  3. Why is the sticky bit important for /tmp?

    • Prevents users from deleting others' files
    • Security in shared directories

Next Steps​

  • Lab 3.3: Search and Links
  • Lab 3.4: Complete Practice
  • Chapter 3.5: File Permissions

Lab created on: December 2024 - Tested on Ubuntu 24.04