LFCS Certification Filesystem Permissions and ACLs 3 — Questions and Answers
Question 1: A user's umask is 027. What permissions will a newly created regular file have?
- 640 (Correct answer)
- 750
- 644
- 755
Correct answer: 640
Files start at 666 max; 666 minus umask 027 gives 640 (rw-r-----) for regular files.
Question 2: What does 'setfacl -d -m g:developers:rwx projectdir' accomplish?
- Sets a default ACL so new files in projectdir inherit rwx for the developers group (Correct answer)
- Immediately grants rwx to developers on all existing files
- Deletes the developers group ACL from projectdir
- Creates a new group called developers with rwx on projectdir
Correct answer: Sets a default ACL so new files in projectdir inherit rwx for the developers group
The -d flag sets a default ACL entry that is automatically inherited by new files and subdirectories created inside the directory.
Question 3: Which ls option shows a '+' indicator next to files that have extended ACLs?
- ls -l (Correct answer)
- ls -a
- ls -Z
- ls -n
Correct answer: ls -l
ls -l displays a '+' at the end of the permission string for any file or directory that has an extended ACL beyond the standard POSIX permissions.
Question 4: A script has permissions '-rwsr-xr-x' and is owned by root. What happens when a normal user runs it?
- It runs with root privileges due to the setuid bit (Correct answer)
- It fails because non-root users cannot run setuid scripts
- It runs with the invoking user's privileges only
- It prompts for a sudo password before running
Correct answer: It runs with root privileges due to the setuid bit
The setuid bit (s in the owner execute position) causes the process to run with the file owner's (root's) effective UID.
Question 5: How do you copy a file's ACL from 'source.txt' to 'dest.txt'?
- getfacl source.txt | setfacl --set-file=- dest.txt (Correct answer)
- cp --acl source.txt dest.txt
- setfacl --copy source.txt dest.txt
- acl-copy source.txt dest.txt
Correct answer: getfacl source.txt | setfacl --set-file=- dest.txt
Piping getfacl output into setfacl --set-file=- is the standard way to copy ACL entries between files.
Question 6: Which permission allows a user to traverse (enter) a directory without reading its contents?
- Execute (x) (Correct answer)
- Read (r)
- Write (w)
- Setuid (s)
Correct answer: Execute (x)
The execute bit on a directory controls the ability to cd into it and access files within it by name, independent of read permission.
Question 7: A file is owned by 'alice' with permissions '640'. User 'bob' is in the same group. What can bob do?
- Read the file only (Correct answer)
- Read and write the file
- Read, write, and execute
- Nothing — no access
Correct answer: Read the file only
640 means rw-r-----, giving the group (which includes bob) read-only permission.
LFCS Certification Filesystem Permissions and ACLs 3
A user's umask is 027.
What permissions will a newly created regular file have?