Filesystem Permissions and ACLs Flashcards

A developer needs to set the permissions on a shell script named `deploy.sh` using symbolic notation. The owner should have read, write, and execute permissions, the group should have read and execute permissions, and others should have no permissions. Which of the following commands correctly applies these permissions?

Answer: chmod u=rwx,g=rx,o= deploy.sh

The `chmod` command is used to change file permissions. The `u=rwx` part sets the user (owner) permissions to read, write, and execute. The `g=rx` part sets the group permissions to read and execute. The `o=` part removes all permissions for others. Combining these with a comma provides the most precise way to set the exact permissions required.

Which octal value represents the file permissions `rwxr-x---`, granting read, write, and execute to the owner, read and execute to the group, and no permissions to others?

Answer: 750

Octal permissions are calculated by summing the values for read (4), write (2), and execute (1) for each of the three permission sets (user, group, and other). For the user `rwx` is 4+2+1=7. For the group `r-x` is 4+0+1=5. For others `---` is 0+0+0=0. This results in the octal value 750.

A file named `/data/report.docx` is owned by the user `admin` and the group `editors`. A user named `intern`, who is not a member of the `editors` group, needs to be granted read and write access to this specific file. Which command will accomplish this without changing the file's primary ownership or permissions?

Answer: setfacl -m u:intern:rw /data/report.docx

The `setfacl` command is used to set File Access Control Lists (ACLs). The `-m` option modifies the existing ACL. `u:intern:rw` specifies that the user (`u`) `intern` should be granted read (`r`) and write (`w`) permissions on the specified file, `/data/report.docx`.

After modifying a file's permissions with `setfacl`, a system administrator wants to verify that the Access Control List has been applied correctly. Which of the following commands is used to display the full ACL for a file or directory?

Answer: getfacl

The `getfacl` command is the standard utility for retrieving and displaying the File Access Control Lists (ACLs) of files and directories. While `ls -l` will show a `+` sign to indicate an ACL is present, it does not display the detailed ACL entries.

A system administrator sets the `setgid` permission (chmod g+s) on a directory named `/srv/collaboration`. What is the primary effect of this permission on new files and subdirectories created within `/srv/collaboration`?

Answer: New files and subdirectories will inherit the group ownership of the parent directory.

When the `setgid` bit is set on a directory, it enforces group inheritance. Any new file or subdirectory created within that directory will have its group ownership automatically set to the group of the parent directory, rather than the primary group of the user who created it. This is essential for shared directories where consistent group ownership is required for collaboration.

A security policy requires that all new non-executable files created by users have permissions of `rw-r-----` by default. What `umask` value should be set in the shell environment to enforce this policy?

Answer: 026

The `umask` works by masking or removing permissions from the default base permissions. For files, the base is `666` (rw-rw-rw-). To achieve the target permission of `640` (rw-r-----), the `umask` must subtract the unwanted permissions. User needs `rw` (6), so `6-6=0`. Group needs `r` (4), so `6-4=2`. Other needs no permissions (0), so `6-0=6`. Therefore, the required `umask` is `026`.