LFCS Certification Filesystem Permissions and ACLs 5 — Questions and Answers
Question 1: Which command removes only the named user ACL entry for 'dave' from 'data.csv'?
- setfacl -x u:dave data.csv (Correct answer)
- setfacl -m u:dave:--- data.csv
- setfacl -b u:dave data.csv
- getfacl -x u:dave data.csv
Correct answer: setfacl -x u:dave data.csv
setfacl -x removes a specific ACL entry without affecting other entries; -b would remove all ACL entries.
Question 2: A process runs as UID 1001. A file has owner UID 1001 and permissions '---rwxrwx'. Can the owner read the file?
- No — the kernel checks only the owner bits, which are '---' (Correct answer)
- Yes — the kernel falls through to group permissions
- Yes — the owner always has read access
- It depends on the ACL
Correct answer: No — the kernel checks only the owner bits, which are '---'
Linux permission checks stop at the first matching category; if the process UID matches the file owner, only the owner permission bits are evaluated, regardless of group or other bits.
Question 3: What does 'umask 0022' mean when a user creates a new directory?
- The directory gets permissions 755 (777 minus 022) (Correct answer)
- The directory gets permissions 644
- The directory gets permissions 700
- The directory gets permissions 666 minus 022 = 644
Correct answer: The directory gets permissions 755 (777 minus 022)
Directories start with a base of 777; subtracting umask 022 yields 755 (rwxr-xr-x).
Question 4: Which special permission bit, when set on an executable, causes it to run with the group privileges of the file's group rather than the invoking user's group?
- Setgid (chmod g+s) (Correct answer)
- Setuid (chmod u+s)
- Sticky bit (chmod +t)
- ACL mask
Correct answer: Setgid (chmod g+s)
The setgid bit on an executable makes it run with the file's group ID as the effective GID of the process.
Question 5: How can an administrator apply ACLs recursively to all files under '/srv/project'?
- setfacl -R -m u:alice:rwx /srv/project (Correct answer)
- setfacl -r -m u:alice:rwx /srv/project
- getfacl -R /srv/project | setfacl --apply
- acl --recursive u:alice:rwx /srv/project
Correct answer: setfacl -R -m u:alice:rwx /srv/project
The -R flag in setfacl applies the specified ACL modification recursively to all files and directories under the target path.
Question 6: A file is world-writable (-rw-rw-rw-) and located in /tmp which has the sticky bit. Can user 'eve' delete a file owned by 'frank'?
- No — the sticky bit on /tmp prevents eve from deleting frank's files (Correct answer)
- Yes — world-writable means anyone can delete any file there
- Yes — if eve has write permission on the file itself
- No — only root can delete files in /tmp
Correct answer: No — the sticky bit on /tmp prevents eve from deleting frank's files
The sticky bit on a directory restricts deletion so only the file owner, the directory owner, or root can remove a file regardless of write permissions.
Question 7: Which command would display numeric UIDs/GIDs instead of names in an ACL listing?
- getfacl -n file.txt (Correct answer)
- getfacl -N file.txt
- getfacl --numeric file.txt
- getfacl -i file.txt
Correct answer: getfacl -n file.txt
getfacl -n (--numeric) displays numeric user and group IDs instead of resolving them to names.
LFCS Certification Filesystem Permissions and ACLs 5
Which command removes only the named user ACL entry for 'dave' from 'data.csv'?