Filesystem Permissions and ACLs Flashcards

Which command removes only the named user ACL entry for 'dave' from 'data.csv'?

Answer: setfacl -x u:dave data.csv

setfacl -x removes a specific ACL entry without affecting other entries; -b would remove all ACL entries.

A process runs as UID 1001. A file has owner UID 1001 and permissions '---rwxrwx'. Can the owner read the file?

Answer: No — the kernel checks only the owner bits, which are '---'

Linux permission checks stop at the first matching category; if the process UID matches the file owner, only the owner permission bits are evaluated, regardless of group or other bits.

What does 'umask 0022' mean when a user creates a new directory?

Answer: The directory gets permissions 755 (777 minus 022)

Directories start with a base of 777; subtracting umask 022 yields 755 (rwxr-xr-x).

Which special permission bit, when set on an executable, causes it to run with the group privileges of the file's group rather than the invoking user's group?

Answer: Setgid (chmod g+s)

The setgid bit on an executable makes it run with the file's group ID as the effective GID of the process.

How can an administrator apply ACLs recursively to all files under '/srv/project'?

Answer: setfacl -R -m u:alice:rwx /srv/project

The -R flag in setfacl applies the specified ACL modification recursively to all files and directories under the target path.

A file is world-writable (-rw-rw-rw-) and located in /tmp which has the sticky bit. Can user 'eve' delete a file owned by 'frank'?

Answer: No — the sticky bit on /tmp prevents eve from deleting frank's files

The sticky bit on a directory restricts deletion so only the file owner, the directory owner, or root can remove a file regardless of write permissions.

Which command would display numeric UIDs/GIDs instead of names in an ACL listing?

Answer: getfacl -n file.txt

getfacl -n (--numeric) displays numeric user and group IDs instead of resolving them to names.